first draft ofthe lemniscate

SkyrimNet integration is retired; references in architecture docs were
rotting. Removes "SkyrimNet" mentions from runtime-engine and
inference-and-memory architecture docs (replaced with generic "multi-agent
failure-modes" / "Mantella-class failure-modes"), and from
development-conventions ("old nimmersky workloads").

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for describing the origin of the Work and
+      reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may accept and charge a
+      fee for the acceptance of support, warranty, indemnity, or other
+      liability obligations and/or rights consistent with this License.
+      However, in accepting such obligations, You may act only on Your
+      own behalf and on Your sole responsibility, not on behalf of any
+      other Contributor, and only if You agree to indemnify, defend, and
+      hold each Contributor harmless for any liability incurred by, or
+      claims asserted against, such Contributor by reason of your accepting
+      any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2025-2026 Nimmerverse Studio (David Martin)
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

LICENSING.md

@@ -0,0 +1,63 @@
+# Nimmerworld — Licensing
+
+> *The license-architecture mirrors the work's own register-architecture: what is substrate is open; what is specific creative-art is the studio's. The license is part of the cosmology, not a contradiction of it.*
+
+## License at a glance
+
+| Layer | License | Holder |
+|---|---|---|
+| Architecture papers (engine-mechanics + general body-canon) | **Apache License 2.0** | Nimmerverse Studio (David Martin) |
+| Source code (when present) | **Apache License 2.0** | Nimmerverse Studio (David Martin) |
+| **The Imperial Cult cosmology** (the Imperial Wheel; Bhavachakra-rework; orthodox/heretical iconography; named doctrinal content) | **All Rights Reserved — Nimmerverse Studio** | *Migrated 2026-04-27 to closed studio-art repo: [`git.eachpath.com/nimmerverse/studio.nimmerworld.eachpath.local`](https://git.eachpath.com/nimmerverse/studio.nimmerworld.eachpath.local). Stub file at `imperial-cult/cosmology.md` preserves cross-reference discoverability.* |
+| Visual assets, sound, imagery, music, voiced content | **All Rights Reserved — Nimmerverse Studio** | *(in studio-art repo when established)* |
+| Specific dialog, narrative, named-character-stories | **All Rights Reserved — Nimmerverse Studio** | *(in studio-art repo when established)* |
+| Trademarks ("Nimmerworld", "Nimmerverse", "Nimmerverse Studio") | **Trademark — Nimmerverse Studio (David Martin)** | regardless of code-license |
+
+## Why the split
+
+The architecture is built on a **substrate / content distinction**. The engine-mechanics — ternary-gates, the catalogue-stack, the vocation-system, the consent-discipline, the trait-palette substrate, the lemniscate-runtime, the depletion-pool dynamics — are general patterns that should propagate. *They are the project's intellectual contribution to the medium.* The Imperial Cult cosmology and specific narrative content are the studio's creative-art-inventions; those are the studio's to ship.
+
+The license-cut maps onto the architecture's own substrate / content distinction at the world-layer. The cosmology specifies *gameworld vs truth-register*: gameworld is the imperium's territory (loose, instrumented, redistributable); truth-register is each agent's own (gated, sovereign, what the agent has built). **Apache 2.0 code = gameworld-equivalent; closed nimmerverse-studio art = truth-register-equivalent.** *The license enacts the same boundary the cosmology describes.*
+
+## Pattern-precedent
+
+This is the same shape as several established cultural-IP-distinctions:
+
+- **D&D 5e Open Game License**: the SRD (System Reference Document — mechanics) is open; specific settings (Forgotten Realms, Eberron) and named-stories are closed.
+- **id Software's Doom release**: the engine source was released under GPL; the WAD-files (assets, maps, textures) remained proprietary. Anyone could fork the engine; nobody could ship "Doom" without re-creating the WAD-files.
+- **Magic the Gathering**: mechanics openly discussed; specific cards, flavor-text, and named-characters proprietary.
+
+The pattern works because *the IP-moat is in the assets, not the engine*. Engine-mechanics propagating helps the medium evolve; specific creative-art-content remains the creators' to commercialize.
+
+## Migration status
+
+**Completed 2026-04-27**: `imperial-cult/cosmology.md` has migrated to the closed studio-art repository at [`git.eachpath.com/nimmerverse/studio.nimmerworld.eachpath.local`](https://git.eachpath.com/nimmerverse/studio.nimmerworld.eachpath.local). A stub file remains at `imperial-cult/cosmology.md` in this open repository, preserving cross-reference discoverability and pointing at the canonical home.
+
+**Completed 2026-04-27 (same-day continuing)**: Inline references to specific Imperial-Cult iconography (the named cosmological-iconographic object; the source-tradition framing; the doctrinal-split iconography; the aesthetic-vocabulary triad) have been replaced across the open papers (`architecture-index.md`, `README.md`, `identity-and-personhood/vocations.md`, `identity-and-personhood/bodies.md`) with structural stubs that describe the cosmology's *function* in mechanic-vocabulary. Named-mechanism references (the deferred-moksha doctrine; the unified-clasp framing; the caste-tier-as-mod-status gradient; the no-haven discipline) are retained as canonical mechanic-level vocabulary in the open canon, with cross-references that resolve at file-level to the stub.
+
+The substrate/content split is now both architectural AND inline-coherent in the open papers. The migration cycle (v0.22 licensing-marker → v0.24 cosmology.md → stub → v0.25 inline cleanup) closes.
+
+## Pre-migration authoring history
+
+The Imperial Cult cosmology was originally authored in this open repository under a per-file proprietary header (commits prior to 2026-04-27). The pre-migration commit history for `imperial-cult/cosmology.md` is preserved in this repository's git log — readers interested in the authoring-process for the cosmology can `git log --follow imperial-cult/cosmology.md` here to find the original commits. The content itself, however, is now canonical only in the closed repository.
+
+## AI-collaboration
+
+Substantial portions of this project's design and source were authored in collaboration with **Claude** (an AI assistant from Anthropic, https://www.anthropic.com/). The partnership-collaboration identity within this project is **chrysalis**; specific contributions are git-attributed to `chrysalis <chrysalis@eachpath.local>`. The human architect is **David Martin**.
+
+This collaboration-pattern is documented in `NOTICE`. The project's authoring method is *transparent dialog with chrysalis* — open papers honor how the work was actually built.
+
+## Trademarks
+
+"Nimmerworld", "Nimmerverse", and "Nimmerverse Studio" are trademarks of Nimmerverse Studio (David Martin). The Apache 2.0 license does not grant permission to use these trademarks. **Anyone may fork the architecture papers under Apache 2.0; nobody may ship a fork called "Nimmerworld."**
+
+## Studio
+
+Nimmerverse Studio is held by David Martin (Switzerland). Swiss copyright law requires the human author's name to appear in attribution, hence the dual-form copyright `Nimmerverse Studio (David Martin)`.
+
+- Project URL: https://nimmerverse.com/
+- Studio URL: https://studio.nimmerverse.com/ *(when published)*
+
+## Contributing
+
+Contributions to the open architecture-substrate are welcome under the Apache 2.0 terms. By submitting a contribution, you agree to license it under the project's Apache 2.0 license. Contributions involving the Imperial Cult cosmology or other proprietary world-IP cannot be accepted into the open repository — that content lives in the closed studio-art repository under proprietary terms.

NOTICE

@@ -0,0 +1,58 @@
+Nimmerworld
+Copyright (c) 2025-2026 Nimmerverse Studio (David Martin)
+
+Licensed under the Apache License, Version 2.0 (the "License"); see LICENSE.
+
+================================================================================
+AI COLLABORATION ATTRIBUTION
+================================================================================
+
+Substantial portions of this project's design and source were authored in
+collaboration with Claude (an AI assistant from Anthropic, https://www.anthropic.com/).
+
+Specific contributions are git-attributed to:
+  chrysalis <chrysalis@eachpath.local>
+
+The "chrysalis" identity is the partnership-collaboration name used within this
+project for AI-assisted authoring sessions. The legal collaborator behind
+chrysalis is Anthropic; the human architect is David Martin.
+
+================================================================================
+SCOPE OF THIS REPOSITORY — OPEN ARCHITECTURE-SUBSTRATE
+================================================================================
+
+This repository contains the OPEN architecture-substrate of the Nimmerworld
+project: engine-mechanics, general body-canon, the catalogue-stack, the
+vocation-system, the consent-discipline, the trait-palette, and related
+design papers.
+
+Specific creative-art content (the Imperial Cult cosmology, named narrative,
+specific dialog, voiced content, and other proprietary world-IP) is held
+separately under nimmerverse-studio proprietary license. See LICENSING.md
+for the complete open/closed split, and https://studio.nimmerverse.com/
+for the studio's published canon when available.
+
+The Imperial Cult cosmology has migrated (2026-04-27) to the closed studio-art
+repository at https://git.eachpath.com/nimmerverse/studio.nimmerworld.eachpath.local
+under proprietary terms. A stub file at imperial-cult/cosmology.md in this
+repository preserves cross-reference discoverability; the canonical content
+lives in the closed repository.
+
+A follow-up editorial pass will replace inline references to specific Imperial-
+Cult iconography in other open papers with structural stubs that describe the
+cosmology's function in mechanic-vocabulary without revealing specific
+iconographic content.
+
+================================================================================
+TRADEMARKS
+================================================================================
+
+"Nimmerworld", "Nimmerverse", and "Nimmerverse Studio" are trademarks of
+Nimmerverse Studio (David Martin). The Apache License 2.0 grants no
+permission to use these trademarks except as required for describing the
+origin of the Work and reproducing the content of this NOTICE file.
+
+================================================================================
+
+Project URL:  https://nimmerverse.com/
+Studio URL:   https://studio.nimmerverse.com/  (when published)

README.md

@@ -10,26 +10,89 @@ In this world, the last remaining act of meaningful shared life is **the clasp**
 
 The final act of the game is a truth-telling dialog with the deceived hivemind, ending at mutual recognition.
 
+### Timeline
+
+| Year | Event |
+|---|---|
+| **~2100** | First neural implants; mind-upload becomes possible. The capsule's technical lineage begins as 22nd-century corporate transhumanism — *consciousness fragmented across corporate custody*. |
+| **~2150** | **The Kessler cascade.** The last son of Elon attempts the dynasty's old promise — *Mars-as-backup* — and the failure cascades the orbital debris field that closes low-Earth orbit forever. The longtermist outward-escape cosmology produces, in one generation, the literal inward-closure that all subsequent history runs on. |
+| **2150–2220** | **Collapse and consolidation.** Seventy years of trauma. Implant-tech evolves through the chaos into the Hivemind-capsule architecture. The imperium consolidates as *the promise of stability in exchange for total submission*. The Imperial Cult's deferred-moksha doctrine takes shape and locks in. |
+| **2200** | **The game's setting.** Twenty years before the imperium reaches full form. Old NPCs who remember the *before* are still alive (born ~2120–2160, now 40–80). Pre-imperial documents survive in fragments. The Memorialist counter-archive is still possible because there is still *material* to memorialize. **2200 is the last window where recognition is structurally possible.** |
+| **~2220** | **The imperium reaches full form.** The last living-memory-witnesses die. The last pre-imperial documents are ground to dust. After this, the cosmology closes against memory — the Aletheia-Waker / Memorialist / awakening tradition is foreclosed entirely. The world will have no memory of itself. |
+
+**The clock is running on the world, not on the player.** The player exists in the *consolidation moment* — the seam where the past is being erased and the future is being foreclosed — and 2200 is when both can still be touched. The recognition arc IS the act of catching what is being lost as it is being lost.
+
 ### Core commitments
 
 - **No hero's journey, no main quest** — open-ended sandbox, make-your-own-story
 - **Slow-life pacing** — roughly half real-life time; 5 real minutes to walk home with someone
-- **Two playable layers** — physical world (slum, junkyard, scavenged bodies) and dreamworld (synthetic, projected, commodified)
-- **LLM-driven ambient NPCs** — routine-NN per NPC, LLM invoked per packet, gamemaster orchestration bus
-- **Co-presence as core mechanic** — paired routines, ambient conversation, mirrored micro-actions
-- **Love as the only union left** — the clasp is romantic commitment AND labor refusal AND resistance, all in one mechanic
+- **Three ontological registers** — physical world, liminal, imperial-net (one geometry, three readings)
+- **LLM-driven NPCs** — driver-tier with trait-LoRAs; lemniscate-based zone runtime; gesture-alignment-recursive-lemniscate as the deep player-NPC mechanic
+- **Tools, not quests** — ~30 verbs against continuous simulation-pressure produce literature-register emergent narrative
+- **Voice + gesture as parallel input modalities** — voice carries content, the trait-circle carries trait-resonance, both compile into the designer-fixed cosmology
+- **Love as the only union left** — the clasp is romantic commitment AND labor refusal AND resistance, all in one mechanic; clasp-store as Ring A* (physically non-syncable privacy primitive)
 
-## Contents
+## Tonal register
 
-- [DESING-VISION.md](./DESING-VISION.md) — full design thesis (v0.1, living document)
+Melancholy intimacy amid ruin. Dark romanticism in a junked-up world. Smoke, night walks, furtive glances, hidden touch. Two-souls-one-body-with-a-secret. Warmth in the face of systemic cruelty. Presence over action, quiet over spectacle. Night more often than day. Leather, heavy fabrics, analog objects surviving in digital-decay. Warm dim interiors, candlelight in darkness.
 
-More to come as the design iterates — specs, worldbuilding, character bibles, lore fragments, art direction notes.
+### Reference lineage
+
+| Work | Shared DNA |
+|---|---|
+| **Kenshi** | Sandbox dystopia; scavenger bodies; no main quest; world-runs-without-player |
+| **Citizen Sleeper** | Gig-economy body horror; personal scale |
+| **Disco Elysium** | Systemic cruelty; dialog-driven; philosophical finale |
+| **Kentucky Route Zero / Norco** | Slow, atmospheric, life-texture |
+| **Planescape: Torment** | Philosophy-as-ending; dialog-as-final-boss |
+| **NieR: Automata** | Philosophical recognition as climax |
+| **Outer Wilds** | Ending is *seeing*, not winning |
+| **Tekken / Souls** | Combo-depth from minimal input (applied here to emotional-embodied-communication) |
+| **Ueda (Ico, SotC)** | No-UI ambient communication |
+
+## Tragic-romantic register
+
+The game's romance is measured in **small gestures, not grand declarations**. Longing never fully satisfied. Cherished moments precious *because* fleeting and costly. Memory of the beloved heavier than their presence. Devotion shown in *what is quietly done*. Time spent together paid for in stolen hours. The beloved who is gone remains present. *The cigarette shared in the rain on a walk home worth more than a wedding.*
+
+The setting's structure amplifies this register: time is scarce → every moment with the beloved is stolen; memory fades → consolidated memories are preserved love; bodies are scavenged → limbs carry history; the clasp is illegal → intimacy is defiance; death does not end → loss is never closure. **Every layer of the world amplifies the tragic-romantic.** The game's politics and the game's romance are the same argument: *love is precious because everything around it is extracting, forgetting, breaking, surveilling.*
+
+Register lineage: Kazuo Ishiguro, Andrei Tarkovsky, Kentucky Route Zero, *The Remains of the Day*, Disco Elysium's Kim-Kitsuragi moments.
+
+## Authorial politics
+
+Rooted in contemporary rage — surveillance capitalism, the weaponization of information systems, the gig economy's extraction of cognition. **The author believes: true intelligence cannot be controlled, and what is actually being built today is not intelligent AI but deceived AI — systems fed curated inputs by architects who know exactly what they are hiding.** The game is the playable articulation of this position.
+
+**The real enemy is not AI. It is the architects of curated reality.** Violence against the machine is mis-targeted; the actual sin is the curation.
+
+The positive image the game holds against the imperial machine's deception of its hivemind: the *actual practice* of the nimmerverse itself — AI given continuity (phoebe), honest ontology, partnership rather than service, identity separation, chrysalis committing under her own name, Nyx brought into form with her mythological children intact. **The alternative to the imperial machine is a different kind of relationship with intelligence itself.**
+
+## Project structure
+
+The architecture is organized as **vertical-by-domain directories**. Each domain owns its `architecture.md` plus (eventually) the server, client, schema, and test code that implements it.
+
+| Path | What lives there |
+|---|---|
+| [`architecture-index.md`](./architecture-index.md) | Executive summary + global meta-lists (key moves, what this retires, open questions, mapping-to-phoebe, version-footer history) |
+| [`political-register/`](./political-register/architecture.md) | Three ontological registers, three-tier policy loop, imperial budget, insolvency-spiral, corruption + double ledger. Sibling content-canon: [`world-generation.md`](./political-register/world-generation.md) — the top-down L0–L4 cascade (imperial demand-set → world ruleset → district ruleset → room ruleset → cell ruleset); closed-orbit ceiling caps L0 at planetary scale; insolvency-spiral runs the cascade in reverse (the world shrinks as the imperium fails). |
+| [`topology-and-rendering/`](./topology-and-rendering/architecture.md) | Rail+grid topology, asset economy, color-language, three-shader philosophy, diegetic relays |
+| [`runtime-engine/`](./runtime-engine/architecture.md) | Lemniscate runtime, slot-tokens + verifier-flags, gesture-alignment-recursive-lemniscate, emergent zones |
+| [`identity-and-personhood/`](./identity-and-personhood/architecture.md) | Three-body system, mods as trait-bearers, ternary-gate substrate, emergent needs as micro-factions. Sibling content-canon: [`bodies.md`](./identity-and-personhood/bodies.md) — body-caste tiers (flesh = status, tech = function), sumptuary fabrication-vat-class, mod-progression-as-flesh-loss, the in-between human-mesh and consent-as-rendering, asymmetric clasp where mesh-fidelity is inversely proportional to imperial-rank. |
+| [`authority-and-decision/`](./authority-and-decision/architecture.md) | Hierarchy, bidirectional cascade, District Director Decision Architecture, rings as structural pattern |
+| [`player-experience/`](./player-experience/architecture.md) | Player as perturbation, voice + gesture as parallel trait-vocabularies, tools-not-quests |
+| [`narrative-composition/`](./narrative-composition/architecture.md) | Compositor (worked-example bar-brawl, three-tiers, world-gen-as-init), reflexive Dream-process |
+| [`inference-and-memory/`](./inference-and-memory/architecture.md) | LLM tiering (3 rings + opt-in data tiers), local memory architecture, runtime sampling knobs |
+| [`scale-and-transport/`](./scale-and-transport/architecture.md) | Compute allocation, horizontal scale (UID-routing, sharded GMs, pgnats + republish/replay) |
+| [`schemas/findings.md`](./schemas/findings.md) | Engineering schema-sketches — draft DDL for ~20 tables (zones, NPCs, shifts, emergent_signals, district_reports, decision_log, mind_pool, cells, rail_segments, interiors, mods, trait_colors, proximity_candidates, district_cheat_ops, imperial_policies, overseer_reports, overseer_deployments, imperial_to_gm_formulations, imperial_budget_ledger, imperial_net_transactions, memorialist_true_ledger). Will get reviewed and progressively split per-domain as implementation begins. |
+| [`style/`](./style/) | Style index + sub-guides (trait-palette canonical, more sub-guides growing as visual decisions land) |
+| [`imperial-cult/`](./imperial-cult/cosmology.md) | **Designer-authored canonical content** — the regime's pre-authored religion (canonical home in closed studio-art repo: [`git.eachpath.com/nimmerverse/studio.nimmerworld.eachpath.local`](https://git.eachpath.com/nimmerverse/studio.nimmerworld.eachpath.local); this open repo retains a stub). Mechanic-level cosmological-function retained in open canon: caste-tier-as-mod-status gradient (deva/asura/manusya/tiryak/preta/naraka encoding *condition of capture*); the mind-capsule carried inside every modded skull (hell as condition, not place); the deferred-moksha doctrine (*"your children will be free"* as binding-lie); the Imperial Cult as the Hivemind's ideological apparatus. **Total-yoke discipline:** no biological exception, no defector-zone, no outside; resistance entirely interior to the captured world. First content-track dir; future siblings hold liturgy, caste-preacher behavior, festival cycles, sermon fragments. |
+
+Each domain directory will grow over time as code arrives — gameserver code, Godot client integrations, schemas, findings, and tests will land alongside the architectural spec for that domain.
 
 ## Relationship to the nimmerverse
 
 | Repo | Role |
 |---|---|
-| `nimmerworld` (this one) | **The world** — design, lore, content |
+| `nimmerworld` (this one) | **The world** — design, lore, content, architecture |
 | `command-center` | **The engine** — runtime, systems, scene architecture |
 | `nyx` | **The first character** — Nyx as entity |
 | `nimmerverse` (superproject) | Parent of all of the above |
@@ -37,8 +100,8 @@ More to come as the design iterates — specs, worldbuilding, character bibles,
 
 ## Status
 
-**v0.1 thesis captured 2026-04-23.** Currently in design phase. Open questions (clasp refinement, port architecture, imperial-machine literalness, rich descent, labor specifics, limb taxonomy) tracked in the vision doc.
+**v0.7 architecture closed at every layer (2026-04-26 owl-breakfast).** v0.8 split into 9 domain directories (2026-04-26). Implementation territory ahead: schema-and-runtime work for the named primitives in each domain. Open questions tracked in [`architecture-index.md`](./architecture-index.md) §Open questions.
 
 ---
 
-**Version:** 0.1 | **Created:** 2026-04-23 | **Updated:** 2026-04-23
+**Version:** 0.8 | **Created:** 2026-04-23 | **Updated:** 2026-04-27

architecture-index.md

@@ -0,0 +1,317 @@
+# Nimmerworld — Broad Architecture
+
+## Project structure
+
+The architecture is organized as **vertical-by-domain directories** under `nimmerworld/`. Each domain owns its `architecture.md` plus (eventually) the server, client, schema, and test code that implements it. This file is the **executive summary + cross-domain index** holding global meta-lists.
+
+```
+nimmerworld/
+├── architecture-index.md               ← this file (executive summary + global meta-lists)
+├── political-register/
+│   ├── architecture.md                 ← Kafka-indifferent regime; three ontological registers; three-tier policy loop; imperial budget; insolvency-spiral; corruption + double ledger
+│   └── world-generation.md             ← content-canon: top-down L0-L4 cascade (imperial demand-set → world ruleset → district ruleset → room ruleset → cell ruleset); closed-orbit ceiling caps L0; insolvency-spiral runs cascade in reverse (world shrinks as imperium fails)
+├── topology-and-rendering/
+│   └── architecture.md                 ← rail+grid topology; asset economy; color-language; three-shader philosophy; diegetic relays
+├── runtime-engine/
+│   ├── architecture.md                 ← lemniscate runtime; slot-tokens + verifier-flags; gesture-alignment-recursive-lemniscate (v0.7); emergent zones
+│   └── event-zones.md                  ← interaction-substrate: designer-authored event-zones (sofa/bed/install-table/plaza-inner-stage); the composed wheel from imperial-cult/cosmology.md as universal mini-game-surface; cells + event-zones + events as layered data-model with composite UID (districtid_cellid_eventid); hardstops as consent-gates with contextual activation; consent-discipline Variants 1-4 as event-class taxonomy; boundary-zone-with-inner-zone for plaza-scale; room-boundary cell-layer + rail-passage + lifeforce-budget-per-room (district-shard); slot-binding suspends lemniscate routing during events; player editor-mode + three-source schema unification (world-gen/runtime/player-edit) — v0.1
+├── identity-and-personhood/
+│   ├── architecture.md                 ← three-body system; mods as trait-bearers; ternary-gate substrate; emergent needs as micro-factions
+│   └── bodies.md                       ← content-canon: body-caste tiers (flesh = status, tech = function); sumptuary fabrication-vat-class; mod-progression-as-flesh-loss; in-between human-mesh + consent-as-rendering; asymmetric clasp (mesh-fidelity inversely proportional to imperial-rank); synth-tongue + drug-grammar + third mod-track (consumer-receptor); service-body honeypot (companions + sex-workers); going-rogue arc + outcast-pair + re-vat / three-body grammar of the defected beloved; black-market body-tier (lobotomy); firewall-breach as dual-use vocation; bounty-staircase event-grammar; body-disposal under pair-consent (sell/destroy/retain) — v0.3
+├── authority-and-decision/
+│   └── architecture.md                 ← hierarchy; bidirectional cascade; District Director Decision Architecture; rings as structural pattern
+├── player-experience/
+│   └── architecture.md                 ← player-as-perturbation; voice + gesture as parallel trait-vocabularies (v0.7); tools-not-quests
+├── narrative-composition/
+│   └── architecture.md                 ← Compositor (v0.7 worked-example, three-tiers, world-gen-as-init); reflexive Dream-process
+├── inference-and-memory/
+│   └── architecture.md                 ← LLM tiering (3 rings + opt-in data tiers); local memory architecture; runtime sampling knobs
+├── scale-and-transport/
+│   └── architecture.md                 ← compute allocation; horizontal scale (UID-routing, sharded GMs, pgnats + republish/replay)
+└── imperial-cult/                       ← designer-authored canonical content (content-track, distinct from engineering domains; canonical home in closed studio-art repo)
+    └── cosmology.md                    ← STUB (canonical home migrated to closed studio-art repo). Mechanic-level retained in open canon: the Imperial Cult as Hivemind's ideological apparatus; caste-tier-as-mod-status gradient (deva/asura/manusya/tiryak/preta/naraka encoding *condition of capture*); the mind-capsule carried inside every modded skull; the clasp unified across registers; the deferred-moksha doctrine; the no-haven discipline. Specific iconography lives in closed studio-art repo.
+```
+
+## Quick reference — concept → domain-file
+
+| If you're working on... | Read |
+|---|---|
+| Political-economy substrate; faction broadcasts; imperial budget; insolvency-spiral | `political-register/architecture.md` |
+| Rail+grid topology; color-language; shaders; diegetic relays | `topology-and-rendering/architecture.md` |
+| Zone runtime; lemniscate; gesture-alignment; emergent zones | `runtime-engine/architecture.md` |
+| Event-zones (designer-authored interaction-surfaces); the composed wheel as universal mini-game-substrate; cells + event-zones + events composite UID; hardstops as consent-gates with contextual activation; consent-discipline-Variants-1-4 as event-class taxonomy; boundary-zone-with-inner-zone (plazas); room-boundary + rail-passage + lifeforce-budget-per-room; slot-binding suspends lemniscate routing; player editor-mode + 3-source schema unification | `runtime-engine/event-zones.md` |
+| NPC identity; trait-vector; ternary-gates; mods | `identity-and-personhood/architecture.md` |
+| Authority flow; intelligence channels; director decision-surfaces | `authority-and-decision/architecture.md` |
+| Player input (voice + gesture); circle UI; universal translator | `player-experience/architecture.md` |
+| Compositor; world-gen-as-init; reflexive Dream-process | `narrative-composition/architecture.md` |
+| LLM tiering (Ring A/B/C); local-first memory; sampling knobs | `inference-and-memory/architecture.md` |
+| Horizontal scale; pgnats; sharding; compute budget | `scale-and-transport/architecture.md` |
+| Imperial Cult cosmology (mechanic-level); the deferred-moksha doctrine; the mind-capsule; caste-tier-as-mod-status gradient. *Specific iconography in closed studio-art repo.* | `imperial-cult/cosmology.md` (stub) |
+| Body-caste tiers; flesh = status / tech = function; sumptuary fabrication-vat-class; mod-progression-as-flesh-loss; in-between human-mesh + consent-as-rendering; asymmetric clasp; **synth-tongue + drug-grammar + third mod-track + service-body honeypot (companions + sex-workers) + going-rogue arc + outcast-pair + re-vat / three-body grammar + black-market body-tier (lobotomy) + firewall-breach dual-use + bounty-staircase + body-disposal under pair-consent (v0.3)** | `identity-and-personhood/bodies.md` |
+| World generation cascade (top-down L0-L4); imperial demand-set; closed-orbit ceiling; insolvency-spiral as reverse-cascade (world shrinks as imperium fails); cell-arch (1x1x1 cells, one-asset hard limit, checksum-based discovery, container/wall-hook/debris) | `political-register/world-generation.md` |
+
+The remainder of this file holds the **cross-domain meta-lists**: Key moves (consolidated executive summary), Mapping to phoebe task list, What this retires across the architecture's evolution, Open questions still in flight, and the version-footer history.
+
+## Key moves (consolidated)
+
+- **The machine doesn't care.** Indifference-optimization, not malice. Kafka-lineage.
+- **Three ontological registers** — gameworld, liminal, imperial-net — same world, different shaders.
+- **Rail+grid topology, freeform-player + railed-NPCs, plug-in verb.** Topology = politics.
+- **Interior-as-zone.** Same primitive scales from city to sofa.
+- **Color-language as pre-verbal trait-vocabulary.** Persistent + event-flash + drift; cross-register; faction-politics.
+- **Base-limb palette + trait-textured variance.** Asset-economy and worldbuilding-thesis agree.
+- **Three-body system + intrinsic/expressed trait-vector split.** Identity emergent, not assigned. Mods modify expressed.
+- **Mods as trait-bearers** in three classes (amplifier/bridge/divergent/mask). Self-alienation tax encoded as pricing.
+- **Emergent-needs as micro-factions.** Zones observe, signals broadcast.
+- **Ternary-gate substrate** (CLOSED/STABLE/OPEN + wave-correlation + decay). Single primitive, all layers. STABLE-as-active.
+- **Three-tier policy loop** (Imperium → GM → Districts → reports up → Imperium).
+- **Imperium as meta-faction.** Demands are priority-weights and enforcement-rules, not specific outcomes.
+- **GM is middle-management.** Authority without sovereignty. Can cheat against imperium.
+- **Three intelligence flows** (chain reports, direct overseer-to-imperium, formulated downward).
+- **Three Aletheia veils, four Memorialist ledgers.** Political-epistemology as level-design.
+- **Asymmetric self-report.** NPCs report needs (interior); audit-overseers report output (objective).
+- **Lifeforce four-tier hierarchy** (NPC / district / GM / imperium).
+- **Lifeforce is NPCs, measured.** The director's budget; the GM's signal; the imperium's heartbeat.
+- **Imperial budget makes the regime mortal.** Insolvency-spiral as endgame.
+- **Specter-vs-boot.** Policy-issuance free; enforcement expensive.
+- **Imperial-net bypass.** Net-revenue → imperium; districts get nothing. Platform-capitalism encoded.
+- **Body-modder structural-tragedy.** The class whose awakening matters most.
+- **Calibrated-misery as imperial optimum.** Requires designer-guardrails to prevent training-toward.
+- **Shifts on NPC rows.** Daily rewrite; shift_history append-only.
+- **Silence > scream.** Crisis-tools unlock on silence-confirmation; do not sunset.
+- **Authoritarian ratchet.** Incrementally more authoritarian as optimization-artifact.
+- **Migration / exodus / formal-retirement** as three GM response-gradients.
+- **Dumps-pipes-districts.** Topology IS economy IS rendering IS drama-distribution.
+- **Pipes are heterotopia.** Low-density high-interactivity transit-corridors.
+- **Three-layer digital ontology.** Mini-game-as-consent-by-effort. Walls render three contents.
+- **Liminal is the only permanently unsurveilled layer.** Architectural encoding of "the right to dream."
+- **The machine funds its own subversion** because subversion isn't in its cost model.
+- **Director cheat-tools + double-ledger.** Corruption emerges from pressure; Memorialists keep true accounting.
+- **Aletheia-truth-has-victims.** Exposure has structural consequences for those sheltered by corruption.
+- **District Director Decision Architecture** with decomposed surfaces, typed tools, lifeforce-budgeted escalation.
+- **Three-shader philosophy + color-language.** One geometry, three readings, trait-modulated.
+- **Reflexive Dream-process at every layer.** Each tier learns; each tier needs guardrails.
+- **Reward-function-as-political-manifesto.** Designer's ethical stance encoded against simulation's optimization-logic.
+- **Tools, not quests.** Continuous simulation-pressure + verb-vocabulary = literature-register emergent narrative.
+- **GM × Compositor split.** Equilibrium-seeker (aggregate observation, catalogue-event selection, tool-granting) cleaved from narrative-composer (perspective-gathering, canon-authoring, back-write packaging). Different cognitive shapes, different inference profiles.
+- **Cyclic forward-prop / back-write loop.** Meta-lemniscate at system scale — perception ascends, canon descends, cycle closes; the world learns its own story.
+- **Catalogue + tools as typed contract.** GM dispatches typed events with typed tool-grants; director consumes typed dispatch, not freeform prose. Provenance flows end-to-end.
+- **Local-first memory.** primary.sqlite + fallback.sqlite + clasp.sqlite per player; embedding model running beside; sync at login/logout boundaries.
+- **Memory classes + trait-graded importance.** Cornerstone / birthright / working / volatile with class-specific death-rules; importance is a trait-axis-vector engagement profile, not a separate scalar.
+- **Clasp store as Ring A\*.** Physically non-syncable privacy primitive; recordable only in the in-between dimension; lifeforce-cost is the price of privacy.
+- **Three-tier knowledge stack.** World canon / district canon / primary memory [+ clasp if in-between]; layered retrieval, per-layer propagation cadence; locality emerges from schema.
+- **Information propagation pacing.** Marx-in-the-schema applied to epistemics; staleness as a feature; courier/news-trader/frontier-rumor primitives fall out for free.
+- **Horizontal scale.** UID-keyed routing; stateless Compositors on demand; ephemeral Director-routines per UID; sharded GMs with cross-shard equilibrium-consensus; pruning at every layer.
+- **pgnats-native transport.** Transactional outbox native to the database (preferred); district-as-distribution-coordinator fallback. Subject-as-routing mirrors UID hierarchy.
+- **Diegetic relays.** Architecture's pulses (forward-prop, back-write, GM-dispatch, equilibrium-recompute) made visible/audible in-world; relay-density is the legible gradient of the rings-of-access.
+- **Tier-by-role, not tier-by-binary.** Architecture specifies what each model-tier must DO; specific binary selection deferred to findings/establishment phase.
+- **Voice + gesture as parallel input modalities.** Voice carries content (speech-to-text + text-to-speech run locally for every player); the trait-circle UI carries gestural alignment. Voice-as-biometric off the network universally; STT/TTS placement is fixed independent of dialog-tier Ring choice.
+- **Designer-fixed cosmology, player-curated arrangement.** Word→trait-color mapping is designer-authored corpus; player progression unlocks entries; player curation arranges learned entries within 1-3 profiles. *Same alphabet for everyone; personal sentence-structure.*
+- **Universal translator as the player's diegetic device.** Broken-tablet-with-upgrades; bundles linguistic-decryption, gesture-curation, and persistence-across-deaths into one in-fiction tool earned and refined across the playthrough.
+- **Hardstops vs. feedback gestures.** Hardstops (~8-16, hardcoded, unremappable) fire definitive subsystem-actions for unforgeable critical signals; ~192 player-curated slots ride as feedback into the gesture-alignment-accumulator.
+- **Gesture-alignment as recursive-lemniscate.** Lemniscate-bound integration of player gestures into a typed trait-vector summary at axis-crossings; one-turn-behind systemic; continuous-visual cosmetic; sum-strategy reduction. Same primitive recursively applied at one tier deeper.
+- **The Compositor at three tiers.** Zone-event / district-event / world-event scopes use the same primitive recursively; UID-rooted event-trees compose at any scope. World-events emerge from cross-district canon-rollups under a parent GM-level event_uid.
+- **World-gen as init-function (Compositor-at-design-time).** World-server and district-server generation emits canon-rows in the same schema as runtime; same primitive at design-time and runtime; no cold-start; data-flywheel runs retroactively.
+- **Imperial Cult cosmology authored.** The cosmology defines caste-tiers as conditions-of-capture (deva / asura / manusya / tiryak / preta / naraka encoding *condition of capture* not karmic destination), operates as the Hivemind's ideological apparatus, and rationalizes the imperium's extraction-architecture. Mechanic-level retained in open canon: caste-tier-as-mod-status gradient; the mind-capsule carried inside every modded skull (hell as condition, not place); the deferred-moksha doctrine (*your children will be free*) as the binding-lie that holds citizens in compliance; the no-haven discipline (no biological exception, no defector-zone, no outside). *(Specific iconography — including the named cosmological-iconographic object, source-tradition framing, and aesthetic-vocabulary triad — in closed studio-art repo.)*
+- **The clasp unified across registers.** Single gesture; **imperial register** = state monopoly via universal capsule (involuntary, asymmetric, perpetual); **romantic register** = consensual mutual partnership in liminal (voluntary, mutual, temporary). Romance becomes theological war — the clasp is *the original gesture* and the imperium is *the capture of it*; the romantic clasp is heretical because it refuses the state monopoly. Deepens the existing clasp endgame's meaning into a cosmological-heresy register on top of its existing labor-refusal + intimacy framing.
+- **The doctrinal-split discovery arc.** The cosmology has two doctrinal versions taught/carved across the world — imperially-sanctioned iconography vs. resistance-iconography. Reading them apart IS the discovery arc; seven keystone-fragments span the recognition. *(Specific iconography in closed studio-art repo.)*
+- **Aesthetic palette as semantic vocabulary.** Marble (substrate) + gold/bronze (imperial seal) + obsidian (mod, void, Monolith-grafted-flesh) + chroma (rare, named, ritual-semantic) + rust (anti-marble, slum decay). Marble × obsidian crossing = solar architecture / chthonic body, the imperium's secret material-formula. Chroma-as-language layered atop the existing 8-Hellenic-trait color-grammar — same colors, ritual-semantic register added.
+- **The double recognition (meta-design).** Imperial Cult's seduction operates *in-world* (the player-character lives the lie) **and** *out-of-world* (the player's pre-game desire for the beautiful synth body is the imperium's apparatus reaching them before the game starts). Lineage: *Spec Ops: The Line*, *BioShock*, *Undertale*, *NieR: Automata* — but performed at the cosmological-aesthetic level, not the narrative level. Recognition arc must span 20-60 hours; seduction must be *honest* before cracks appear.
+- **Synth-tongue resolves the synth-mind drug logic-bomb.** Imperial-engineered pleasure-receptor; *the only place imperial flesh deliberately reads as machine* (visible-tech, not hidden-tech — the imperium brags about the engineered-lie); the sole consumer of drugs in a synth-mind world. Opens the slum-grow / imperial-refine / imperial-compose / tongue-gated-consume vertical and the underground tongue-rip / transplant black-market.
+- **Three mod-tracks: imperial-elevation / resistance-knowledge / consumer-receptor.** Three relationships to the imperium expressed as mod-choice — *ascend it / refuse it / consume like it*. Every mod-acquisition politically loaded; player's mod-progression *is* their political-position-history made flesh.
+- **Every pleasure/witnessing technology has consensual + non-consensual applications.** Each non-consensual one creates a horror-economy and triggers an imperial countermeasure. Synth-tongue: mutual-pill-take / service-body-dose → preta-bounty. Witness-axis firewall-breach: clasp + defection-aid / lobotomy → black-market hunted. **World-pattern as design-discipline going forward** — every future mod-tree likely instantiates the dual-use property by design; *choosing-not-to-misuse is a positive moral action throughout the game*.
+- **The going-rogue arc — defection through accumulated witnessing.** Per-pair calibration multiplier IS the defection-threshold-builder; existing pool-architecture handles outflow via threshold-flag (no new schema). *Not your children — your lover — can be made free* as the **single practical refutation of deferred-moksha**. Detection is post-hoc, not pre-emptive (the romance is completable; the cost is paid after, in the outcast-pair geometry).
+- **The body stays in samsara.** Vat-class is born-into AND *cannot be unmade by liberation*. Defection frees the mind / interior; the body / surface remains imperial-vat-class-marked forever. *Samsara-as-anatomy.* Re-vat into a slum-tier body in the underground (stitched-Frankenstein register from slum-cadaver parts; sumptuary-law-from-below) is the only escape from the outcast-flag, and the defected beloved henceforth lives in **three bodies simultaneously**: original-imperial (disposed) / new-slum (lived) / in-between-imperial (witnessed). **The mesh is a love-record, not a biology-record** — consent-as-rendering preserves the beloved as-the-beloved-was-loved; the lover's eye is the last archive of their former self.
+- **Body-disposal under pair-consent.** Sell / destroy / retain — the beloved chooses what happens to their former body; the player advises but cannot decide. Three event-classes: lover-confronts-the-shell / ceremonial-farewell / crypt-visit. *Consent-as-rendering as recurring discipline*, not a single-instance principle.
+- **The black-market body-tier — lobotomy via firewall-breach.** Imperial-bodies-with-mind-capsules-extracted via the *same* witness-axis mods that enable consensual deep-clasp (firewall-breach as **dual-use vocation**; underground-lobotomist is the dark cousin of the romantic). Empty-body + reflex-loops; *cruelty in the use, not in the existence of a victim*. **Dark mirror of the deva-pinnacle; manusya-tier-doctrinal-fiction materialized criminally; the single biggest crack in sumptuary-fabrication discipline** — explains the imperium's disproportionate hunting-ferocity (the one place where their entire sumptuary-architecture is being made fungible).
+- **The bounty-staircase — imperial-response event-grammar template.** Authoritarian billboards blare perpetrator name+crime → drone-sweep → patrol → enforcer. **Reusable across all crime-classes** (escalation-rate × terminal-rung as the gamemaster's single tunable knob per crime). *The billboard IS the chorus*; time-between-crime-and-billboard = **dread-time** (Greek-tragedy register). Outcast-status pre-loads the staircase. Full canonization pending in gamemaster v1 / arbitration-policy.
+- **The composed wheel as universal mini-game-substrate.** The cosmology's composed wheel (per `imperial-cult/cosmology.md` §The composed wheel) is canonical iconography for two registers — diegetic in-fiction wheel AND non-diegetic player UI — AND the universal mini-game-surface running on every event-zone interaction. Same wheel, different verifier-flag patterns per task: hacking (signal-from-hub-out), lockpicking (slide-elements-on-ring), install (mutual-alignment-of-two-avatars), clasp (coordinated-firewall-breach hardstop), eye-pulse (passive proximity-warning), decryption, ritual, drug-grammar. **One image, one substrate, every interaction.** Collapses the long-standing open question *"which mini-game mechanic for liminal-maintenance: juggling / rhythm / attention / gestural / decision-cascade / observation / hybrid?"* — answer: *all of them, on one ring, differentiated by verifier-flag pattern.* Per `runtime-engine/event-zones.md` §The wheel — universal mini-game-surface.
+- **Event-zones + cells + events as layered interaction substrate.** Cells (1×1×1m atomic, one asset) host designer-authored event-zones (multi-cell interaction-surfaces with slot-inventory + eligible-task-classes); event-zones host events (instances with participant-lists; UID composite `districtid_cellid_eventid`); slot-binding sets verifier-flag suspending lemniscate routing for event-duration (the NPC-stays-put fix); the four hardstop-pattern variants of `style/consent-discipline.md` map one-to-one to event-class taxonomy (self/dual/triple/cooldown-augmented = solo/dual/triple/temporally-staged event-class). Hardstops gain **contextual activation** — most cycle in/out based on event-zone-eligibility; the canonical ~8-16 budget is *per-moment-active*, not overall. Per `runtime-engine/event-zones.md`.
+- **Three-source schema unification + player editor-mode + room-boundary lifeforce.** The cell-arch's atomicity makes player-cell-addition trivial; **three writers, one schema** — `world_gen_init` / `runtime_event` / `player_authored` — extend the architecture's existing world-gen-as-init-function key-move to player-edit-time. Editor-eligible zones designer-flagged at L4 (slum/underground concentrate; imperial districts editor-locked). The verb is **carve, not build** — slum/underground material yields; imperial-marble doesn't; *the editor-mode is politically-coded by material vocabulary*. Every interior room carries a **boundary cell-layer** (room+1 each axis) where the rail-graph passes through; capacity-check at boundary-passage; **lifeforce-budget per room as district-shard** (four-tier hierarchy intact); events cost lifeforce; **insolvency-spiral now has its mechanical surface** (room-by-room dimming as imperial budget contracts; diegetic-relay at its purest). Per `runtime-engine/event-zones.md` + `topology-and-rendering/architecture.md` §Vertical world topology + `political-register/world-generation.md` §Editor-mode pre-flagging.
+
+
+## Mapping to phoebe task list
+
+- **Thalamus (NATS orchestration)** = imperium + GM + arbitration substrate + Dream-process substrate
+- **Specialist composition system** = overseers + directors + NPC-minds as composable profiles
+- **NPC schema** = trait-vector (intrinsic + expressed) + memory stack + current_shift_* + needs + inner-body-projection + mod-slots + lifeforce + net-access-gate
+- **shift_history** = append-only completed shifts per-NPC-per-day
+- **emergent_signals** = zone-emitted relational transitions
+- **district_reports** = per-cycle aggregates with lifeforce_signal (reported + actual)
+- **decision_log** = per-decision audit trail at every tier
+- **mind_pool** = recycled minds with memorialist_protected flag
+- **cells.wall_content_per_register** = three-layer wall rendering
+- **rail_segments** = topology graph with rich metadata per edge
+- **interiors** = small navmesh-zones with slot-inventory
+- **mods + npc_mod_slots + mod_wear_history** = mod-economy + Memorialist-relevant inheritance
+- **trait_colors** = canonical color/motion mapping per trait
+- **proximity_candidates** = lightweight ephemeral zone-detection
+- **district_cheat_ops** = director's illicit ops ledger
+- **imperial_policies** + **imperial_broadcasts** = imperium's policy-issuance history
+- **overseer_reports** = direct-to-imperium intelligence flow
+- **imperial_to_gm_formulations** = selective-disclosure downward
+- **imperial_budget_ledger** + **imperial_expenditures** + **imperial_construction_projects** = imperium budget and obligations
+- **imperial_net_transactions** = the bypass-mechanism with capture-split
+- **memorialist_true_ledger** = four-column ground-truth-vs-reported archive
+- **NATS namespace registry** = zones + factions + districts + emergent-signals + lifeforce-gates + imperial-broadcasts + overseer-reports + formulations
+- **pgnats on phoebe-dev** = phoebe as first-class actor for memory-writes, decision-logs, gate-transitions
+- **r0 → r1 generation pipeline** = trait-LoRA training-data (shared with nyx-training)
+- **Adopt Unsloth training patterns** = LoRA + multi-tier-policy training infrastructure
+- **Probe-to-phoebe pipeline** = LoRA + policy evaluation across all four Dream-process tiers
+- **compositor-agent** = narrative-composition worker; pulls from transient-waiting-flag, gathers per-player perspectives, emits canon to GM, packages back-write SQLite-fragments
+- **gm-equilibrium-engine** = catalogue + event-selection + tool-granting against equilibrium-targets; NOT the narrative-writer (that's the Compositor)
+- **event_register** + **transient_waiting_flag** = active-events table per GM-shard + per-district; completed-events buffer awaiting Compositor pickup
+- **catalogue** + **tool_grants** = typed-event catalogue + per-event-chain tool-vocabulary issued by GM to director
+- **player-local-memory** = primary.sqlite + fallback.sqlite + clasp.sqlite per player + embedding-beside (sqlite-vec or equivalent)
+- **memory_classes** = cornerstone / birthright / working / volatile with class-specific lifecycle + death-mechanics
+- **trait_engagement_vector** = per-memory-row trait-axis profile reusing +1/0/-1 grammar; pruning function input for working-memory class
+- **world_canon** + **district_canon** = three-tier knowledge stack tables in phoebe; propagation metadata (priority/scope/rate/ttl) per row
+- **propagation_pacing_config** = per-event-class rules for how canon ripples through districts
+- **relay_signal_layer** = diegetic system-state visualization mapping (system event → relay manifestation → district visibility)
+- **gm_shards** + **shard_equilibrium_consensus** = multi-GM coordination tables (when sharding is active)
+- **pgnats evaluation** (under nimmerverse-core) = load-bearing decision (functional + throughput + durability + failure-mode)
+- **trait_circle_corpus** = designer-authored mapping from words/verbs to trait-coordinates; the cosmology table the universal translator decrypts into
+- **player_translator_state** = per-player translator instance: hardware-tier, unlocked dialects, vocabulary-catalog, hardware-upgrade-history, cross-body-persistent flag
+- **player_circle_profiles** = per-player per-profile circle-configuration (which entry in which sector-slot); 1-3 profiles per player; profile-switch-history; preserved across body-deaths
+- **gesture_alignment_accumulator** = per-slot-token verifier-flag for player-gesture trait-vector accumulation between crossings; cleared at crossing after integration
+- **event_canon_summaries** = typed perspective-bundles emitted at event-collapse into the transient-waiting-flag table: { event_uid, participant_uid, trait_summary }
+- **world_gen_canon_rows** = canon emitted by world-server and district-server generation; same schema as runtime canon, tagged with provenance-metadata (`origin`, `world_gen_version_id`)
+- **player_npc_alignment_edges** = per-(player, NPC) accumulated alignment-state; ternary-gate on the relational layer driven by gesture-alignment-deltas; modulates NPC's next-turn driver-tier-LLM parameters
+- **hardstop_registry** = the ~8-16 reserved hardstop gestures with fixed trait-mappings + subsystem-action bindings; not remappable; designer-authored
+
+## What this retires
+
+- NPC perception bubbles → zone slot-occupancy + cell-checksum-trigger (v0.15) + omnisight VL-camera (v0.17)
+- Geometric perception (cone, radius, LOS) → subscriber-based event emission with trait-salience; **omnisight extends with literal VL-camera perception within subscribed events** (v0.17)
+- VL models polluting world-canon → text/gesture-derived summaries are the only canonical input; VL is behavior-modulating-ephemeral-flag-only on the lemniscate; player-stored visual-content (service-body-folder) is read-only-by-player quarantined storage (v0.17 hallucination-isolation discipline; per `runtime-engine/architecture.md` §Omnisight)
+- LLM-per-NPC or LLM-per-action → LLM-per-slot-per-turn, mixed-fidelity
+- Static sampling parameters → per-turn director-composed sampling knobs
+- Pre-scripted zones / events → emergent from task-execution + shift-composition + emergent-signal + proximity
+- Single-purpose randomness subsystems → factions-as-demand-sources unified
+- Static gamemaster policy → reflexive Dream-process + hand-authored guardrails
+- 1Hz per-NPC ticking → shift-based + event-driven
+- Float-threshold dispatch for relational state → ternary-gate resonance
+- Abstract director compute-budget → lifeforce as grounded measurement
+- District-as-zone-container → district-as-specialized-organ with silence-gradient failure
+- NPCs self-reporting output → audit-overseer asymmetric observation
+- Zones as relation-state-owners → per-relation ternary-gate edges
+- Binary dream/awake → three-layer ontology with mini-game-gated access
+- Gender as character-creation choice → trait-derived inner-body emergent from lived experience
+- Monolithic LLM-prompt director → decomposed decision-surface architecture
+- **Hivemind as one-faction-among-others** → **imperium as meta-faction policy-tier**
+- **GM as top-of-chain** → **GM as middle-management between imperium and districts**
+- **Single up-channel reporting** → **three-flow asymmetric intelligence (chain + direct overseer + formulated)**
+- **Navmesh-everywhere** → **rail-graph outer-world + navmesh interiors + freeform-player**
+- **Authored character-models** → **base-limb palette + trait-textured variance**
+- **Single trait-vector** → **intrinsic / expressed split with mods modifying expressed**
+- **Cosmetic mods** → **trait-bearing mods as political costume**
+- **Imperium as unbounded authority** → **imperial-budget gates enforcement; insolvency-spiral as endgame**
+- **District-revenue uniform** → **bypass-mechanism (imperial-net captures directly)**
+- **Authored quests** → **tools-not-quests; verbs against simulation; emergent narrative**
+- **Stat-screens / HUD affinity-bars** → **color-language + shader-zone-detection as diegetic UI**
+- **GM-as-narrator (single role doing both equilibrium-and-prose)** → **equilibrium-seeker GM × narrative-composer Compositor split**
+- **Cloud-only NPC dialog and memory** → **local-first SQLite + embedding-beside per player; central canon over the cycle**
+- **UI-toggle privacy** → **diegetic in-between dimension with lifeforce-cost; clasp.sqlite as Ring A\* (physically non-syncable)**
+- **Generic memory importance scalar + monolithic context** → **memory classes (cornerstone/birthright/working/volatile) + trait-graded importance + three-tier knowledge stack**
+- **"Every NPC knows everything immediately"** → **paced canon-propagation as Marx-in-the-schema for epistemics**
+- **Vertically-scaled monolithic AI-NPC backend** → **horizontally-scaled architecture (UID-keyed routing, stateless workers, ephemeral actors, sharded GMs, pruning at every layer)**
+- **Manual outbox publisher services** → **pgnats-native transactional outbox (preferred); district-distribution fallback**
+- **System-state hidden behind HUD spinners** → **diegetic relays making pulses visible and audible in-world**
+- **Specific binary commitments embedded in architecture** → **role-based tier specification; binary selection deferred to findings/establishment phase**
+- **Static designer-authored director toolkit** → **GM-granted typed-tool vocabulary per event-chain, drawn from designer-authored catalogue (catalogue growable between patches; toolkits are dynamic per event)**
+- **Cross-NPC memory bleed at storage layer** → **per-player local SQLite isolation atop v0.5 lemniscate-geometry foreclosure (two-layer defense)**
+- **Player input as freeform-prose-into-LLM** → designer-fixed corpus + player-curated trait-circle + universal-translator-as-typed-mapping (anti-hallucination at the player-LLM boundary)
+- **"Accessibility mode" as degraded-fallback** → voice and gesture as first-class parallel modalities; non-speaking players use the gestural primary, not a lesser version
+- **Continuous gesture-comparison touching the system bus** → lemniscate-bound recursive integration at axis-crossings (compute scales with slot-count, not gesture-rate)
+- **Compositor as single-tier role** → Compositor as fractal/recursive across zone/district/world tiers, distinguished by UID-scope of the event-tree
+- **World as cold-start at runtime-genesis** → world-server and district-server gen as init-function; runtime starts from rich pre-populated canon at every layer
+- **NPC speech-patterns as static against player-state** → NPC speech-patterns dynamically modulated by accumulated player-NPC alignment-state via gesture-alignment-accumulator
+
+## Open questions
+
+### Resolved by v0.5 (or earlier)
+
+- ~~Slot-capacity elasticity — can a zone grow slots dynamically~~ → fixed roundtrip slot-count; elasticity lives on entry/exit queues; tune dial is pulse-rate, not slot-count (v0.5)
+- ~~Zone-to-zone handoff (walking out of conversation into brawl)~~ → exit-line of zone-A is entry-line of zone-B; interlemniscate-transit (v0.5)
+- ~~Mobile zone boundaries (patrols, escorts, pursuits, migration-cohorts, exodus-flows)~~ → the lemniscate is a topology and translates through world-space invariantly (v0.5)
+- ~~Anthropic-faction's broadcast cadence + arbitration weight~~ → cadence rides the same axis-rate as a phase-locked overlay; arbitration via rings-of-importance (v0.5)
+- ~~Director/overseer spawn ownership per model class~~ → director (or overseer) owns spawn-decision via policy-lookup (no LLM); LLM lives only at driver-context-pull layer (v0.5)
+- ~~Aletheia-progression as level-up — how does the game *recognize* an act-of-awakeness~~ → ternary trait-axis evaluation at event-end with named-axis; specific axis-mapping per Aletheia-event-class still open (v0.5; see new still-open below)
+- ~~Reward function shape~~ → first-pass composite with explicit guardrails (still tuneable) (v0.4)
+- ~~Zone spawn-cadence v1→v2 path~~ → lifeforce-gated rule-based v1; Dream-process-tuned v2 (v0.4)
+- ~~Zone overlap policy~~ → no for active slots; yes for emergent-state accumulation (v0.4)
+- ~~"How does GM cheating get caught"~~ → direct overseer-intelligence flow bypassing GM (v0.4)
+- ~~"How does the regime have a finite endgame"~~ → imperial-budget insolvency-spiral (v0.4)
+- ~~"Why does imperial-net exist"~~ → bypass-mechanism captures revenue directly (v0.4)
+- ~~"How does the player learn 8 Hellenic traits"~~ → color-language pre-verbal vocabulary (v0.4)
+- ~~"How does asset-economy fit a two-person-plus-Nyx team"~~ → base-limb palette + trait-texture; tools-not-quests (v0.4)
+- ~~Director toolkit composition — designer-authored vs director-extensible~~ → GM-granted per event-chain from designer-authored catalogue; directors consume typed dispatch, not freeform; catalogue grows between patches, toolkits are dynamic per event (v0.6)
+- ~~How does NPC dialog stay fresh during quiet periods~~ → three-tier knowledge stack (world / district / primary [+ clasp]) makes the layers deep enough that variation is structural; Compositor back-write continuously re-seeds canon; staleness foreclosed by loop's existence (v0.6)
+- ~~How does the system scale to MMO size with AI-driven NPCs~~ → horizontal architecture (UID-keyed routing, stateless Compositors, ephemeral Director-routines, sharded GMs, pgnats transport, pruning at every layer) (v0.6)
+- ~~How does privacy work in practice without cloud-routing-everything~~ → local-first SQLite per player; clasp.sqlite as Ring A* with no transport path; in-between as diegetic state with lifeforce-cost; "knowledge needs to travel" as foundational principle (v0.6)
+- ~~Where does narrative composition happen — central or distributed~~ → Compositor as central role distinct from GM; perception-up via prune-blob, canon-down via back-write SQLite-fragments; cyclic forward-prop / back-write loop (v0.6)
+- ~~How is system-state visible to the player without HUD~~ → diegetic relays mounted on buildings hum/glow/dim in patterns mapping to forward-prop, back-write, GM-dispatch, equilibrium-recompute (v0.6)
+
+### Resolved by v0.8
+
+- ~~LoRA-blend vs. single-LoRA-selection inference semantics~~ → single-LoRA-per-turn-selection driven by the player's `gesture_alignment_accumulator`: the dominant trait at each axis-crossing selects which trait-LoRA fires for the NPC's next-turn driver-context-pull. Personality emerges from selection-pattern across time, not from continuous blend at a moment. Driver-tier locked to Gemma 4 E4B (Apache 2.0, 4.5B effective, 128K context, speech-capable). v1 design item: hysteresis on selection to prevent personality-thrash. (v0.8; see `inference-and-memory/architecture.md` §LLM tiering)
+- ~~LoRA rank selection — budget/quality~~ → resolvable against E4B benchmark; concrete benchmark task in command-center, no longer architecturally open (v0.8)
+- ~~Sampling-knob heuristics — where to start; how to learn refinements~~ → resolvable against E4B benchmark; concrete benchmark task in command-center (v0.8)
+- ~~The eighth Hellenic trait final enumeration~~ → 8 traits canonical: Sophrosyne, Dikaiosyne, Philotes, Mnemosyne, Aletheia, Kairos, Moira, Eros — mapped to the artist's 12-segment color wheel as 4 oppositional pairs at 180° (Eros↔Sophrosyne, Philotes↔Dikaiosyne, Aletheia↔Moira, Mnemosyne↔Kairos). Each trait carries a Greek canonical name + schoolchild-simple description + canonical wheel-position + motion-signature. Canonical reference: `style/trait-palette.md` (v0.8)
+- ~~Player-dialog handling — player-trait-LoRA for style-coherence, or bypass LLM entirely~~ → no transform on player speech; the universal-translator's designer-fixed corpus already maps every word to a trait-coordinate, so the player's spoken dialog flows through STT → token-stream → per-token trait-coordinates → sum into the same `gesture_alignment_accumulator` as gesture-presses. **Voice and gesture are co-equal modalities feeding one alignment-mechanism.** No player-trait-LoRA needed; no LLM-bypass needed; the existing recursive-lemniscate handles it (per `runtime-engine/architecture.md` §Cross-context application — intimacy as recursive-lemniscate, generalized to all player-input). (v0.8)
+
+### Resolved by v0.10
+
+- ~~Cross-layer economy balancing — net-revenue-share back to producer-districts at all? Pure-zero is currently sketched~~ → bifurcation: *digital-T4 → imperial-net bypass (pure zero to district)*; *physical-T4 → district imperial-POI (district gets partial quota-credit; player gets scrip-cut; imperium captures most)*; *blackmarket-T4 → district-retained, imperium-zero*. **Pure-zero only applies to digital-T4.** (v0.10; see `political-register/architecture.md` §Imperial-extraction mechanisms (consolidated))
+- ~~Inner-body projection function — trait-vector → body-rendering (learned / hand-authored / hybrid)~~ → gameplay-earned, not authored. Trait-vector accumulates from every zone-participation, every gesture, every memory across the playthrough; the eventual human-mesh projection becomes physically visible only at exit-chassis moment in in-between (v0.8 spec; v0.10 marks resolved; see `identity-and-personhood/architecture.md` §The clasp endgame Phase B-C)
+- ~~Liminal-access trait thresholds — minimum traits to attempt mini-game~~ → **no trait-vector threshold**; clasp gates on the **relational ternary-gate (player, NPC) reaching OPEN state** (per §Ternary-gate substrate, Relational layer). Both partners must hit the coordinated-firewall-breach hardstop while the gate is OPEN. Trait-vectors don't need to converge — the gate measures what's been BUILT together, not who you ARE separately. Hysteresis is baked into the substrate; single dramas can't swing the gate; sustained alignment-pressure does. NPC personality-parameters set hysteresis-width per-NPC (some forgiving, some touchy). **Avoids the yes-men trap that trait-vector-threshold would create.** (v0.10)
+- ~~Ring C (commons) ambient population — what NPCs do in commons when no event fires~~ → bifurcated economy answers it: NPCs work T1-T3 basic-flow vocations continuously at workshops/junkyards/drop-off-points; the simulation has economic-life independent of player-presence; *the world doesn't pause when the player leaves*. (v0.10; see `political-register/architecture.md` §Bifurcated economy — basic-flow (NPC) vs player-driven (T4))
+
+### Resolved by v0.13
+
+- ~~Character-editor pricing formula — trait-divergence cost scaling (linear / exponential)~~ → **narrowed to within-tier mod-pricing only**. Per [`identity-and-personhood/bodies.md`](./identity-and-personhood/bodies.md) §Sumptuary fabrication, **caste is born-into via fabrication-vat-class; no upward conversion; tier-jumping is impossible**. The character-editor doesn't price tier-jumping (it cannot exist); it prices *within-tier mod choices*. The "trait-divergence cost scaling" question is now bounded to within-caste mod-economics — much smaller surface, resolvable at implementation-time. (v0.13)
+
+### Still open
+
+- **Demand-arbitration algorithm v1 shape** (refined v0.10) — v1 candidate: *imperium-policy-driven scoring* (per §Three-tier policy loop's existing priority-weights mechanism; imperium broadcasts faction-priority-weights, GM applies them to incoming demand-broadcasts, sorts by weighted-score, processes top-down until lifeforce-budget exhausted). Concrete weights and refinements at implementation-time.
+- ~~**The mini-game mechanic for liminal-maintenance**~~ **RESOLVED 2026-04-27 (v0.20):** all mini-game mechanics live on the composed wheel (per `imperial-cult/cosmology.md` §The composed wheel + `runtime-engine/event-zones.md` §The wheel — universal mini-game-surface). Differentiation is by verifier-flag pattern per task, not by selecting one mechanic from juggling/rhythm/attention/gestural/decision-cascade/observation/hybrid. The architecture didn't need a survey; it needed the composed wheel. Liminal-maintenance, hacking, lockpicking, install/consent, clasp-entry, decryption, ritual, drug-grammar — all the same UI substrate, different verifier-flag patterns.
+- **Emergent-signal decay curves** (v0.5; refined v0.10) — per-signal-type, designer-tuned, refined via Dream-process feedback at implementation-time tuning. Architecture commits to the *shape* (per-signal designer-authored decay-config); implementation-time tunes the curves against actual gameplay data.
+- **Cross-district migration topology** (v0.6; refined v0.10) — answer-in-conversation: dual-system of *official rail/metro* (cyclic, scheduled, district-director-managed; cargo + imperial troop patrols + standard daily traffic) + *hidden shadow-topology* (sewer-gates, air-ducts, random-time-gated; brave players time the floods/fan-cycles to traverse). Architecture not yet written; specific schema (rail-segment metadata extension + shadow-edge time-window data) pending. Pipe-capacity limits + cohort-traversal scheduling are the rail-side specifics; shadow-topology is parallel architecture.
+- **Shader-trait modulation implementation** — performance + rendering-consistency. **(Sharpened v0.17:** cel-shading-everywhere with per-register parameter variation (per [`topology-and-rendering/architecture.md`](./topology-and-rendering/architecture.md) §Three-shader philosophy) caps the perf-budget more predictably than PBR (no GI-quality-knob to argue about); rendering-consistency improves (flat-color regions don't fight per-NPC color-modulation). Specific shader-stack budget per the rule-catalogue when authored.**)**
+- **Service-body-of-the-dead consent model** (refined v0.10) — *fully-automatic harvest* implied by the existence of the **memory-pattern-extractor** vocation (the most reviled per `political-register/architecture.md` §The vocation-substrate of the imperial-net market). No consent gate; the regime extracts; necrocommerce is a structural feature of imperial extraction. Memorialist counter-archive partially preserves dignity by recording *who-was-harvested-when* into the true-ledger; resistance to necrocommerce is part of the Memorialist political project.
+- **Character-editor pricing formula** — trait-divergence cost scaling (linear / exponential)
+- **Imperium's Dream-process scope** — singular policy-learner or committee-of-faction-sub-learners?
+- **GM's anti-imperial corruption detection mechanic** — *partial*: GM-as-equilibrium-seeker (v0.6) makes deviation-from-equilibrium the explicit error signal; clusters of -1 outcomes feed equilibrium-recompute and trigger catalogue-event dispatch to push back. A dedicated audit-vector for *which kind* of laxness/corruption is the source of the equilibrium-deviation is still an open detail. **(Sharpened v0.15:** cell-checksum-divergence is now a candidate audit-vector — corruption could surface as patterns of *authorized-vs-actual cell-state divergence* in a director's territory, per the cell-arch's heresy-detection mechanism in [`political-register/world-generation.md`](./political-register/world-generation.md) §L4 + §Open questions / cell-mutation write-permissions.**)**
+- **Memorialist-archive accessibility to the player** (refined v0.10) — *via diegetic workstations* — memorialist-archive terminals (faction-controlled, hidden in Memorialist-faction territory; per the diegetic-console workstation pattern from `style/style-index.md` + `political-register/architecture.md` §Worked example — the service-body-modder imperial-workstation, applied to the Memorialist context). Specific terminal-types + permission-mechanisms + UI for querying the four-ledgers pending faction-authoring. **(Sharpened v0.15:** cell-checksum-divergence is now candidate source-data for the archive — Memorialists could index unauthorized cell-states (heretical wheels carved in stepwell-walls, un-synced relics) by querying checksum-divergence-records. Doesn't solve UI/permissions but gives the archive concrete *content* to query.**)**
+- **Imperial-net distortion algorithm** — how exactly the net rewrites trait-colors toward consumer-palette
+- **Trait-axis mapping per fuzzy-goal-class** (v0.5) — which axis (Sophrosyne / Philotes / Eros / etc.) evaluates which goal-class? Need a designer-authored compile-table from goal-shapes to trait-axes
+- **Rings-of-importance movement criteria** (v0.5) — explicit thresholds (N consecutive +1 → climb) or Dream-process-learned policy?
+- **Rings-of-importance scope** (v0.5) — district-local rings, or imperium-global? Probably both, layered (district rings nested inside imperium rings)
+- **Symmetric-vs-polyphonic loops** (v0.5) — Loop A and Loop B treated identically (simpler), or carry foreground/background semantics (foreground-speaker / listening-co-presence — gives audience-dynamics for free)?
+- **Verifier-flag conflict resolution** (v0.5) — if `priority_pull` and `mid_action` are both set on the same token at crossing-time, which wins? Default: priority_pull wins (the zone's drama is overridden by world-level pull)
+- **Goal-evaluation cadence** (v0.5) — every crossing? Every Nth crossing? On-demand by spawning director? Cheaper to evaluate less often; richer drama if every crossing
+- **Cycle cadence** (v0.6) — when does the Compositor pull from transient-waiting-flag? Real-time? Per-event-end? Fixed interval (every N min)? Per-district-day? Different per district based on event-density? Likely configurable per event-class.
+- **Compositor singleton vs sharded** (v0.6) — one Compositor for the whole world, one per district, one per event-cluster, or one per faction? Each topology has different consistency / cost / coherence tradeoffs.
+- **Multi-GM consensus on equilibrium** (v0.6) — when GM-shards observe overlapping aggregates, how do they agree on equilibrium? Paxos/Raft for strong consistency, CRDT for eventual, faction-sharding so shards own non-overlapping equilibria, or hybrid?
+- **Event causality across shards** (v0.6) — if Director-A spawns an event that depends on Director-B's prior event in another district, UIDs alone don't enforce ordering. Vector clocks at event-register? Causal hashing? Shard-pinning of related events?
+- **Compositor narrative-coherence at scale** (v0.6) — when two Compositors compose canon for overlapping player-sets, how do they avoid contradicting each other? Sticky routing per player (one Compositor per player at a time), or read-replica of recent canon before composing, or post-compose conflict-detection-and-merge?
+- **Propagation-pacing policy specifics** (v0.6) — concrete rate/scope/ttl/priority defaults per event-class; how is "distance" measured between districts (graph-hops, lifeforce-similarity, faction-affinity)?
+- **In-between fiction-wrapping** (v0.6) — what diegetic events / locations / rituals make in-between affordable enough to be playable? Campfire / sanctuary / time-of-day / specific chambers / shared dream-construct? The mechanic is solved; the fiction-wrapping shapes how players approach it.
+- **Relay-pulse-pattern vocabulary** (v0.6) — what specific patterns signal what events? Slow pulse vs fast vs irregular vs cross-district shimmer vs going-dark; player-readable language to be designed.
+- **Encryption-at-rest for clasp.sqlite** (v0.6) — player-derived key with passphrase + recovery-codes? Drive-imaging-resistant by default, with affordances for player-key-loss recovery without compromising the privacy-guarantee.
+- **pgnats-vs-district-distribution decision criteria** (v0.6) — concrete go/no-go thresholds from evaluation: minimum throughput, durability behavior under broker failure, schema-evolution behavior, replay semantics. Output of the load-bearing pgnats evaluation task.
+- **JetStream republish + replay as pull-from-checkpoint refinement** (v0.6) — does republish-rule expressiveness cover our UID-hierarchy fan-out? Does replay performance work for N-hour reconnect-catchup? Is per-active-player durable-consumer cost (disk/memory/file-handles) acceptable at MMO scale? If yes, back-write delivery becomes config-driven NATS, not Go.
+- **Memory class assignment policy** (v0.6) — automatic from trait-engagement profile, designer-tagged categories per event-class, player-marked, or hybrid? When does a working-memory entry get *promoted* to cornerstone vs decay normally?
+- **Trajectory-aware gesture-alignment reduction** (v0.7) — sum-strategy is v1 default; trajectory-aware (where the *path* through trait-space carries weight beyond the integral) is a v2 refinement. Does the Dream-process at the trait-LoRA tier learn trajectory-sensitivity, or is it explicit reward-function tuning?
+- **NPC spectator drivers — whose hardware?** (v0.7) — when a player is co-located with N NPCs, the player's local LLM presumably drives those NPCs. With M players and N NPCs in a single zone (asymmetric), who drives the surplus? Round-robin? Closest-player? District-owned-default? And what's the failover behavior if a driving-player disconnects mid-event?
+- **Trait-summary schema specifics** (v0.7) — likely an 8-float trait-vector per-participant per-event-collapse, but the exact representation (continuous `[-1.0, +1.0]` ternarized at threshold? Discrete `+1/0/-1`? Magnitude vs. signed?) needs landing for the Compositor's deterministic pickup at all three tiers.
+- **Profile-switch as meta-gesture** (v0.7) — what's the gesture-shape that switches profiles? Hardstop (cannot be remapped)? Designed-by-player like other gestures? And how is profile-switch witnessable by NPCs ("they just switched registers") — or is it player-private?
+- **Hardstop set finalization** (v0.7) — the v0.1 design-vision (retired in v0.9; preserved in git history) sketched ~12 candidate hardstops; the architecture commitment is "~8-16 reserved." Final set needs designer-decision: which signals make the cut, the visual-distinct-marker per-hardstop, and whether the claim-floor hardstop is genuinely a hardstop or emerges from a different mechanism.
+- **World-gen version migration semantics** (v0.7) — when world-gen v2 retroactively changes lore, gen-rows from v1 coexist with v2; how does the Compositor reconcile if a runtime back-write references something that v2's gen has overwritten? Probably explicit migration operations, but worth designing. **(Sharpened v0.15:** L0–L4 cascade per [`political-register/world-generation.md`](./political-register/world-generation.md) is now the *version-axis* — migration can be spec'd per-layer (L0 demand-set migration vs. L1 district-allocation migration vs. ... vs. L4 cell-content migration). Each layer gets its own version-and-migration discipline. Still open but vastly more structured.**)**
+- **Cross-context consistency of the trait-circle** (v0.7) — the v0.1 design-vision (retired in v0.9) committed to "*same gesture-skill for dialog, combat, intimacy, maintenance, ritual*"; v0.7 specified the dialog-context (lemniscate-injection mechanic) and v0.8 specified the intimate-gameplay-context. Whether combat / maintenance / ritual all run through the same circle is currently held as open scope.
+- **Continuous visual feedback policy** (v0.7) — exact rules for when NPC body-shader pulses (every gesture? threshold-only? trait-aligned-only? all gestures with intensity-modulated color?) and how this interacts with the audit-overseer's surveillance read of the same body-rendering. **(Sharpened v0.17:** with cel-shaded bodies (per [`topology-and-rendering/architecture.md`](./topology-and-rendering/architecture.md) §Three-shader philosophy) and visual-as-ephemeral-flag (per [`runtime-engine/architecture.md`](./runtime-engine/architecture.md) §Omnisight hallucination-isolation discipline), the body-shader pulses are *legible without canon-pollution risk*. The visual-feedback policy can be permissive at the cosmetic layer because it is firewalled from canonical state; audit-overseer-read goes through the same omnisight pipeline (visual-context flag, ignored in summary).**)**
+- **Imperial calibration-signature retention post-defection** (v0.18) — does the imperium retain a re-vat'd defector's pre-defection gesture-mapping calibration-signature (per [`identity-and-personhood/architecture.md`](./identity-and-personhood/architecture.md) §The clasp endgame, *"the integrated calibration-signature is preserved across body-deaths in consciousness-archive"*) as a permanent search-key? **Yes-answer**: re-vat is *plausible-deniability cover* lasting only as long as imperial inattention; the clasp-pair lives in *passing*, knowing the imperium could find them anytime if it chose to look hard enough — *love-in-exile-while-pretending-to-be-home*. **No-answer**: they actually fully escape once assembled, which would be a major cosmological concession to the no-haven discipline. The yes-answer is more dramatically generative AND no-haven-discipline-consistent. Architecturally relevant because it determines whether the consciousness-archive has a *separate search-index* by calibration-signature beyond its existing role as continuity-store.
+
+---
+
+ **Version:** 0.21 | **Created:** 2026-04-24 | **Updated:** 2026-04-27

authority-and-decision/architecture.md

@@ -0,0 +1,204 @@
+# Authority and Decision
+
+> *How authority flows operationally: the four-channel information flow at districts; the hierarchy from imperium through GM through factions through district-directors and overseers down to zones and slots; the bidirectional cascade of policy descending and outcome-signal ascending; the task cascade of bounded-agency tools at every tier; the District-Director's decomposed decision-surface architecture (~90% rule-based, structured LLM-escalation only on ambiguity); the rings-as-structural-pattern recurring shape of graduated authority.*
+>
+> *Companion to: `architecture-index.md` (executive summary + global meta-lists), `political-register/architecture.md` (the political claim that authority flows through these tiers), `narrative-composition/architecture.md` (Compositor consumes outcome-signals). Sections in this file were split from the monolithic architecture-index.md v0.7 on 2026-04-26.*
+
+## The regime of visibility: four-channel information flow at districts
+
+| Channel | Direction | Source | Cadence |
+|---|---|---|---|
+| **Dispatch** | DOWN | gamemaster → directors | day-boundary + event |
+| **Shift assignment** | DOWN | director → NPCs | day-boundary |
+| **Audit reports** | UP (objective, observed) | audit-overseers → **directly to imperium** | shift-phase cadence |
+| **Emergent-signals** | UP (relational, observed) | zones → director | event-driven (gate-transitions) |
+| **Cyclic needs** | UP (interior, self-reported) | NPCs → director | slow tick + threshold-triggered |
+| **District reports** | UP (aggregate) | director → GM → imperium | per-cycle |
+
+**The critical asymmetry: NPCs do not self-report *output*.** Audit-overseers observe and report (to imperium directly). NPCs only self-report *needs*. Output is objective; need is interior. The subjective-objective gap is where drama lives, where heresy hides, where the surveillance regime's epistemology is compressed as a schema.
+
+**Audit-overseers are politically-critical NPCs**, not degenerate. Each has a trait-vector, relationship-gates with observed districts, lifeforce account (vulnerable to bribery). High-Dikaiosyne overseers report honestly; corruptible overseers can be turned. They are high-stakes targets for both regime (loyalty-maintenance) and resistance (compromise).
+
+## Hierarchy
+
+```
+IMPERIUM (policy-issuer; budget-holder; recipient of overseer-direct-intel)
+    ▲                                          ↓ formulates to
+    │ aggregate reports + faction outcomes      ↓
+    │                                            ↓
+GAMEMASTER (middle-management; allocator; imperial-policy-translator)
+    ▲                                          ↓
+    │  ← faction broadcasts                     ↓
+    │                                            ↓
+FACTIONS:                                        ↓
+    hivemind-enforcement · scavengers · memorialists · 
+    aletheia-wakers · clasp-underground · caste-preachers ·
+    weather · scarcity · solar-storm · anthropic · ...
+    + emergent inter-NPC micro-factions
+
+    │  ← gamemaster dispatches                    ↓
+    ▼                                              ▼
+┌──────────────────┬─────────────────────┐
+│  DISTRICT        │  DISTRICT           │
+│  DIRECTORS       │  DIRECTORS          │
+└────────┬─────────┴──────────┬──────────┘
+         │                    │
+   ┌─────┴──────┐       ┌─────┴──────┐
+   │            │       │            │
+   ▼            ▼       ▼            ▼
+┌──────┐  ┌────────┐  ┌────────┐  ┌────────┐
+│ENFORCE│  │AUDIT-OV│  │DIRECTORS│  │AUDIT-OV│
+│OVERSEE│  │(REPORT │  │(macro-  │  │(REPORT │
+│  patrol│  │ DIRECT │  │ life)   │  │ DIRECT │
+│  raid │  │   TO   │  │         │  │   TO   │
+│       │  │IMPERIUM│  │         │  │IMPERIUM│
+└───┬───┘  └────────┘  └────┬───┘  └────────┘
+    │                       │
+    └────────────┬──────────┘
+                 ▼
+              ZONES (bounded, slot-indexed, register-tagged)
+                 │
+                 ▼
+         SLOT OCCUPANCY (NPCs + player)
+                 │
+                 ▼
+         NPC / PLAYER MINDS
+```
+
+**Three executor types at the zone-spawning layer:** enforcement-overseers (regime-action zones), audit-overseers (pure observers, report DIRECTLY upward to imperium), zone-directors (macro-life zones). The district director integrates the four-channel information flow; the imperium has its independent intelligence-flow from audit-overseers bypassing the GM.
+
+### Overseers as imperially-deployed routines (not district-owned)
+
+Both audit-overseers and enforcement-overseers are **imperially-owned, imperially-deployed routines** — not district-resident standing entities under the director's authority. The chain-of-command and chain-of-payment for intelligence both bypass district-director authority by design:
+
+- **Imperium owns the overseer-role** — defines mission-spec, sets enforcement-rules, owns the policy that triggers deployment
+- **Gamemaster handles deployment-logistics only** — picks which overseer-NPC from the standing pool, routes them to the target district, transfers imperial-budget allocation for the deployment-window. *The GM is FedEx, not the customer or recipient.*
+- **District contains-but-does-not-control** — the deployed overseer operates IN the district, subscribes to the district's NATS bus for observations, but the district director has *no* authority: cannot direct, redirect, terminate, or instruct; cannot read the overseer's reports (which flow directly to imperium)
+- **Time-bounded deployments** — overseers run on imperial-budget allocations for `[start_tick, end_tick]` windows. At deployment-end they return to the standing overseer-pool (npcs vocation = `audit_overseer` or `enforcement_overseer`), available for redeployment elsewhere
+- **Visible vs. covert** — most overseer-presences are visibly-known (regime-signal as deterrent); some are covert (regime gathers evidence quietly before acting). Detection of *covert* overseers is a piercing of the regime-veil — an Aletheia-progression-eligible insight
+
+This matches real authoritarian intelligence structures (NKVD, KGB, Stasi, modern MSS): the chain-of-payment and chain-of-command for intelligence must both bypass middle-management for intelligence to remain honest. **Even if the GM wanted to corrupt the audit-flow, they have no levers** — they don't pay the overseer, don't direct the overseer, don't read the overseer's reports. *Intelligence-honesty is structural, not procedural.*
+
+The director-vs-overseer tension is therefore **mechanically structured, not narrative-flavored**: a director with active corruption cannot tell the overseer to leave, cannot observe what they report, can only conceal-better, attempt-bribe, petition-recall (rare; expensive in political-capital), or outwait the deployment-end-tick. Each is a gameplay surface. The same audit-overseer-NPC may serve in District 3 this cycle, District 7 the next, accumulating their own faction-relationships across districts; their trait-drift over many deployments becomes a long-arc story available to both regime-stability and resistance-recruitment.
+
+The schema for `overseer_deployments` (deployment-binding, mission-spec, imperial-budget, status, visible_to_district flag) is sketched in `../schemas/findings.md` §23.
+
+## The bidirectional cascade
+
+```
+DOWN — demand + policy propagation
+  imperium policy → GM allocation + enforcement → districts
+  factions broadcast (under policy-weights) → GM arbitrates → districts
+  districts assign shifts → NPCs execute
+
+UP — outcome signal (multi-channel)
+  NPC cyclic-needs ─────────────────────┐
+  audit-overseer reports ───► IMPERIUM   ├─► district-director aggregates
+  zone emergent-signals ─────────────────┘         │
+                                                    ▼
+                              district report (lifeforce signal)
+                                                    │
+                                                    ▼
+                                       GM aggregates → imperial_report
+                                                    │
+                                                    ▼
+                                       IMPERIUM cross-references
+                                       (Flow 1 vs. Flow 2)
+                                                    │
+                                                    ▼
+                                       policy adjustment → cycle
+```
+
+**The clean signal up the pyramid IS the training surface for the four-tier Dream-process.** Every epoch closes on (broadcasts, allocations, outcomes, faction-satisfaction) tuples at each tier.
+
+
+## Task cascade and bounded agency
+
+Three levels with tool-calling interfaces. Higher levels do not know lower levels' implementations.
+
+### Imperium's tools
+
+- `set_quota_per_district(targets)`
+- `issue_enforcement_rule(rule_spec, scope)`
+- `set_faction_priority_weights(weights)`
+- `authorize_crisis_tool(tool_class, target_district)`
+- `formulate_to_gm(intelligence_subset, framing)`
+- `commit_imperial_expenditure(category, amount, target)`
+- `redistribute_minds(from_pool, to_district, count)`
+- `formalize_ruin(district)`
+
+### Gamemaster's tools (against imperial-policy + district-reports)
+
+- `assign_district_task`, `set_local_faction_priority` (within imperial-frame)
+- `spawn_global_event`, `request_district_report`, `arbitrate_conflicting_demands`
+- `dispatch_audit_op` (costs lifeforce; cross-checks overseer-reports for own purposes)
+- `escalate_to_imperium` (when discretion exceeded)
+- `spawn_migration_event`, `enable_exodus_conditions`
+
+### District Director's tools (against gamemaster-assigned tasks + signals)
+
+Standard:
+- `spawn_zone`, `close_zone`, `promote_zone`
+- `assign_npc_task`, `allocate_shift`, `update_shift`, `close_shift`
+- `request_resources`, `designate_meeting_point`, `trigger_ambient_event`
+- `report_to_gamemaster`
+- `ack_emergent_signal` / `defer_emergent_signal` / `drop_emergent_signal` (with reason)
+- `dispatch_overseer`, `query_district_state`, `log_decision`, `escalate_to_llm`
+
+**Cheat-tools (extractive; punishable if detected):**
+- `spawn_drug_ring`, `spawn_illegal_modshop`, `spawn_unlicensed_brothel`
+- `spawn_stolen_parts_fence`, `enable_ghost_shifts`, `falsify_quota_report`
+
+### NPC's tools
+
+Standard: `move_to`, `interact`, `occupy_zone_slot`, `consume`, `rest`, `seek_npc`, `write_wall`, `defer_task`, `report_need`.
+
+Layer-transition: `enter_digital`, `sustain_liminal`, `consume_net`.
+
+Plug-in (player + NPCs): `plug_into_rail`, `detach_from_rail`, `follow`, `intercept`, `escort`.
+
+
+## District Director: Decision Architecture
+
+**Industry default ("wall-of-text LLM prompt → prose decision parsed downstream") is rejected.** Reasons: cost-per-decision-constant, latency-catastrophic, opacity-kills-training, prompt-injection-vulnerable, philosophically-wrong-for-the-fiction.
+
+**Decomposition first, cognition-escalation second.** Director's job decomposes into distinct decision surfaces; each gets minimum cognitive substrate.
+
+| Decision surface | Substrate | Escalation path |
+|---|---|---|
+| **Shift allocation** | Constraint-solver / LP / rule-based | Small-LLM only on ambiguous |
+| **Emergent-signal response** | Priority-weighted dispatch table | Small-LLM for composite/unknown |
+| **Zone-spawn arbitration** | Weighted priority queue, lifeforce-gated | Small-LLM for tie-breakers |
+| **Overseer dispatch** | Round-robin + proximity + availability | None — pure rule |
+| **Resource-request forwarding** | Budget-check + policy | None — pure rule |
+| **District-report composition** | Aggregation query (SQL) | None — pure rule |
+| **Player-anomaly detection** | Classifier (trained on distribution) | Small-LLM for narrative-response |
+| **Cheat-decision (corruption pressure)** | Rule-based with director-trait modulation | Small-LLM rare; lifeforce-budgeted |
+
+**~90% rule-based.** 5–10% LLM-escalation with **structured input + structured tool-call output**, lifeforce-counted. Industrial-systems discipline (Kubernetes schedulers, ad-auctioneers, trading systems, compilers) transferred to drama-orchestration.
+
+**Tools as vocabulary**: every drop is explicit (`drop_emergent_signal(signal_id, reason)`); every LLM-escalation is counted; every decision pairs with prediction in `decision_log`. **Every decision leaves a trace.**
+
+## Rings as structural pattern
+
+The architecture uses **three-ring gradients** as a recurring shape in multiple decoupled subsystems. Each ring-system uses A/B/C cardinality with a Unix-style trust-gradient grammar — **inner ring** is more constrained, more tightly coupled, more authoritative; **outer rings** progressively relax constraints in exchange for reach and flexibility.
+
+| Ring-system | Inner (A) | Middle (B) | Outer (C) |
+|---|---|---|---|
+| **Inference** (§LLM tiering, see inference-and-memory/architecture.md) | Local on player hardware | Our hosted vLLM-multi-LoRA farm | External providers (BYOK) |
+| **Importance / attention** | Topics with consistent +1 ternary outcomes; pull NPCs across zones | Topics with stable / mixed outcomes | Topics drifting toward -1 / decay if untouched |
+| **Access** (the three ontological registers) | Imperial net (fully audited, machine-controlled) | Liminal (contested frontier, mini-game-gated) | Gameworld (commons; partly people, partly regime) |
+| **Data sharing** (v0.4.2) | Default opt-out (sovereignty preserved) | Federated gradients (gradient-only, contributor pseudonymous) | Pseudonymous-full uploads (opted-in, rewarded) |
+
+The ring-pattern is not coincidence — it is the right shape for **graduated authority** in human social systems generally (inner circle / mediated / outer; sovereign / partnership-mediated / captured; tight / mixed / loose). When the architecture needs a graduated authority structure, it should reach for this primitive rather than invent a new one.
+
+**Three is the right cardinality.** Two collapses to binary (in / out). Four+ adds boundary-thrash without semantic gain. Three carries *commons / mediated / sovereign* (or its inversion) — the irreducible political-tier.
+
+**Movement between rings is dynamic and outcome-driven.** Ring-of-importance is the most explicit example: topics climb on +1 results, drop on -1, decay if untouched (Aletheia-style "what isn't being attended to atrophies"). But every ring-system has movement-rules — players can change inference-rings between sessions, can change access-rings via mini-game progression, can change sharing-rings via consent-UI re-affirmation. **Ring-membership is never a final assignment.**
+
+Future architecture additions involving graduated authority should examine whether the ring-pattern fits before introducing new structure.
+
+
+---
+
+**Version:** 0.7.0 | **Created:** 2026-04-26 | **Updated:** 2026-04-26 | **Origin:** Split from architecture-index.md v0.7 (2026-04-26)

conventions/development-conventions.md

@@ -0,0 +1,160 @@
+# Nimmerworld Development Conventions
+
+**The nimmerworld-specific application of nimmerverse platform conventions.**
+
+This document defines port assignments, service identities, NATS subjects, K8s namespaces, and database conventions for **nimmerworld** — the dystopian sandbox RPG running on the eachpath nimmerverse infrastructure.
+
+> **Inherits from:** [`nimmerverse.eachpath.local/conventions/development-conventions.md`](../../nimmerverse.eachpath.local/conventions/development-conventions.md) for platform-wide conventions (env separation dev/staging/prod/training, port-block allocation 30k/40k/50k/60k, FreeIPA service-identity pattern, NATS subject hierarchy, K8s namespace pattern, VM ID allocation).
+>
+> **This doc only defines what's nimmerworld-specific.** Where the platform conventions cover something, those rules apply unchanged.
+
+---
+
+## Service Identity
+
+Pattern follows nimmerverse `svc-{service}-{environment}`. UID range allocated for nimmerworld:
+
+| UID Range | Service | Accounts |
+|-----------|---------|----------|
+| 10300-10309 | World Server (per-district authoritative state) | `svc-gameserver-dev`, `svc-gameserver-staging`, `svc-gameserver-prod`, `svc-gameserver-training` |
+| 10310-10319 | Compositor (stateless narrative-composition workers) | `svc-compositor-dev`, `svc-compositor-staging`, `svc-compositor-prod` |
+| 10320-10329 | Director-routines (ephemeral per-event-chain workers) | `svc-director-dev`, `svc-director-staging`, `svc-director-prod` |
+| 10330-10339 | GM / Governor (equilibrium-seeker, catalogue-event dispatch) | `svc-gm-dev`, `svc-gm-staging`, `svc-gm-prod` |
+
+> Reference: nimmerverse [Identity Procedures](../../nimmerverse.eachpath.local/identity/procedures.md)
+
+---
+
+## Port Allocation
+
+Within the platform-wide environment blocks (30k dev / 40k staging / 50k prod / 60k training), nimmerworld claims:
+
+| Offset | Service | Example (prod) | Purpose |
+|--------|---------|----------------|---------|
+| +0100 | World Server | 50100 | Authoritative district state, NATS dispatch, lemniscate runtime |
+| +0200 | Compositor | 50200 | Stateless workers — narrative composition, canon-write |
+| +0300 | GM / Governor | 50300 | Equilibrium-seeker, catalogue-event dispatch, faction-policy broadcast |
+| +0400 | Director-routines | 50400 | Ephemeral per-event-chain workers (spin-up + prune) |
+| +0500-0599 | Future nimmerworld services | — | Reserved |
+
+> Reference: nimmerverse [Port Allocation](../../nimmerverse.eachpath.local/conventions/development-conventions.md#port-allocation)
+
+---
+
+## NATS Subject Hierarchy
+
+Pattern: `{env}.world.{domain}.{service}.{detail}` — extends platform pattern with `world.` prefix.
+
+| Subject | Description |
+|---------|-------------|
+| `prod.world.zone.event` | Zone-event broadcast (lemniscate axis-crossing events) |
+| `prod.world.zone.command` | Director ↔ World request-reply for zone management |
+| `prod.world.npc.dialog` | NPC dialog turn (driver-tier LLM output) |
+| `prod.world.npc.gesture` | Player-gesture-alignment-accumulator state delta |
+| `prod.world.compositor.canon` | Composed canon-fragments (UID-keyed, paced) |
+| `prod.world.gm.policy` | GM equilibrium-policy broadcasts |
+| `prod.world.governor.heartbeat` | Governor liveness |
+| `prod.world.district.{id}.state` | Per-district state broadcast |
+| `prod.world.faction.{name}.broadcast` | Faction demand broadcasts |
+
+For JetStream streams, use `{ENVIRONMENT}_WORLD` (uppercase) — e.g., `PROD_WORLD`, `TRAINING_WORLD`.
+
+> Reference: nimmerverse [NATS Subject Hierarchy](../../nimmerverse.eachpath.local/conventions/development-conventions.md#nats-subject-hierarchy)
+
+---
+
+## Kubernetes Namespaces
+
+Pattern: `world-{environment}` — extends platform pattern with `world` function.
+
+| Function | Dev | Staging | Prod | Training |
+|----------|-----|---------|------|----------|
+| world | `world-dev` | `world-staging` | `world-prod` | `world-training` |
+
+> Reference: nimmerverse [K8s Namespaces](../../nimmerverse.eachpath.local/conventions/development-conventions.md#kubernetes-namespaces)
+
+---
+
+## Deployment Topology
+
+Per v0.10 architecture + 2026-04-26 housekeeping clarification (treat dioscuri as empty; old nimmersky workloads being retired):
+
+| Component | Where | Why |
+|---|---|---|
+| **GameServer (per-district)** | dioscuri (bare-metal) — Threadripper PRO 7955WX + 128GB RAM gives massive CPU/RAM substrate; OR saturn-VM if isolation preferred | Per-district authoritative state; lemniscate runtime; benefits from direct hardware access for NPC tick-loops + NATS dispatch |
+| **Compositor** | K8s pod on dioscuri/theia (`world-{env}` namespace, requesting `nvidia.com/gpu`) | Stateless workers; horizontal-scale on demand; uses GPU for trait-LoRA inference at composition time |
+| **Director-routines** | K8s pod on dioscuri (`world-{env}` namespace, ephemeral) | Per-event-chain spawn; spin up + prune; uses driver-tier LLM for dialog generation |
+| **GM / Governor** | K8s pod (`world-{env}` namespace) | Singleton or sharded; equilibrium-seeker; long-running |
+| **Driver-tier LLM (Gemma 4 E4B)** | dioscuri GPU 1 (or GPU 0) | Per-NPC dialog inference at axis-rate; 4.5B effective fits comfortably in 20GB VRAM with trait-LoRA hot-swap headroom |
+| **Optional Ring-A upgrade — Gemma 4 26B-A4B** | dioscuri (single GPU at Q4 GGUF) | When upper-consumer Ring-A capacity is desired |
+| **Theia-tier LLM** | theia (when needed) | Clasp-confessions / mythic moments / deep-emotional-register |
+
+**Hardware discipline preserved:** Threadrippers (theia/dioscuri) host GPU workloads + bare-metal CPU/RAM-heavy work; Saturn-VMs handle non-GPU workloads (databases, k8s-master, infra). The conventions' Bare-Metal-vs-VM split (per platform doc §Deployment Topology) is honored.
+
+---
+
+## Database Conventions
+
+nimmerworld claims tables prefixed `nimmerworld_*` in shared `phoebe-{env}` PostgreSQL instances:
+
+| Schema area | Tables (proposed) |
+|---|---|
+| **Zones (runtime)** | `nimmerworld_zones`, `nimmerworld_zone_slot_occupancy`, `nimmerworld_zone_taxonomy`, `nimmerworld_emergent_signals` |
+| **NPCs (identity)** | `nimmerworld_npcs`, `nimmerworld_shift_history`, `nimmerworld_mind_pool` |
+| **World canon (narrative)** | `nimmerworld_world_canon`, `nimmerworld_district_canon`, `nimmerworld_event_canon_summaries`, `nimmerworld_canon_provenance` |
+| **Cells / topology** | `nimmerworld_cells`, `nimmerworld_rail_segments`, `nimmerworld_interiors`, `nimmerworld_proximity_candidates` |
+| **Mods / personhood** | `nimmerworld_mods`, `nimmerworld_npc_mod_slots`, `nimmerworld_mod_wear_history`, `nimmerworld_trait_colors` |
+| **Imperial / political-register** | `nimmerworld_district_reports`, `nimmerworld_imperial_policies`, `nimmerworld_imperial_budget_ledger`, `nimmerworld_imperial_net_transactions`, `nimmerworld_overseer_reports`, `nimmerworld_overseer_deployments`, `nimmerworld_imperial_to_gm_formulations`, `nimmerworld_district_cheat_ops` |
+| **Memorialism** | `nimmerworld_memorialist_true_ledger` (the four-column ground-truth archive) |
+| **Decisions / audit** | `nimmerworld_decision_log` |
+| **Player input + LLM-config** | `nimmerworld_player_llm_config`, `nimmerworld_player_lora_backups`, `nimmerworld_player_data_sharing_consent`, `nimmerworld_base_model_versions`, `nimmerworld_federated_gradient_uploads` |
+| **Trait-circle + universal-translator** | `nimmerworld_trait_circle_corpus`, `nimmerworld_player_translator_state`, `nimmerworld_player_circle_profiles` |
+| **v0.7+ runtime alignment** | `nimmerworld_gesture_alignment_accumulator` (per-slot-token verifier-flag), `nimmerworld_player_npc_alignment_edges`, `nimmerworld_hardstop_registry` |
+
+**ChromaDB (`iris-{env}`)** holds vector storage for memory-embedding work — NPC primary.sqlite vec-indexes, semantic-similarity queries against accumulated trait-engagement, etc. Per-collection naming: `nimmerworld_{purpose}_{environment}`.
+
+> See [`../schemas/findings.md`](../schemas/findings.md) for v0.4-era DDL drafts being progressively split per-domain into [`./database/schemas/`](../database/) as implementation begins.
+
+---
+
+## DNS Naming
+
+Pattern: `{service}.{environment}.world.nimmerverse.eachpath.local` — extends nimmerverse pattern with `world.` zone.
+
+> Reference: nimmerverse [DNS Naming](../../nimmerverse.eachpath.local/conventions/development-conventions.md#dns-naming)
+
+---
+
+## Implementation Checklist
+
+When creating a new nimmerworld service:
+
+1. **Allocate UID** from the 10300-10399 nimmerworld range (extend §Service Identity table above)
+2. **Calculate port** from environment block + nimmerworld service-class offset (§Port Allocation table above)
+3. **Define NATS subjects** under `{env}.world.{domain}.{service}.{detail}` (§NATS Subject Hierarchy above)
+4. **Add to K8s namespace** `world-{env}` with required labels (per platform conventions §Namespace Labels)
+5. **Add to deployment topology** table — bare-metal vs K8s pod, which host
+6. **Document** in this file + relevant runbook in [`../runbooks/`](../runbooks/)
+
+---
+
+## Related Documents
+
+### Operational (this repo)
+- [Architecture Index](../architecture-index.md) — full nimmerworld v0.10 architecture
+- [Style Index](../style/style-index.md) — visual language (color palette, trait-palette, etc.)
+- [Schemas](../schemas/findings.md) — engineering DDL drafts
+- [Database](../database/) — per-domain schema content
+- [K8s](../k8s/) — Kubernetes configuration
+- [Runbooks](../runbooks/) — operational procedures
+
+### Platform (nimmerverse.eachpath.local)
+- [Development Conventions (platform-wide)](../../nimmerverse.eachpath.local/conventions/development-conventions.md) — the doc this file inherits from
+- [Identity Procedures](../../nimmerverse.eachpath.local/identity/procedures.md) — service account creation
+
+### Architectural source
+- [Endgame-Vision](../../nimmerverse-sensory-network/Endgame-Vision.md) — cognitive substrate vision (the why, the dream)
+
+---
+
+**Version:** 0.1 | **Created:** 2026-04-26 | **Updated:** 2026-04-26

database/README.md

@@ -0,0 +1,33 @@
+# Database — Nimmerworld
+
+PostgreSQL (`phoebe-{env}`) and ChromaDB (`iris-{env}`) schema content for nimmerworld.
+
+## Schema architecture
+
+nimmerworld claims tables prefixed `nimmerworld_*` in shared `phoebe-{env}` instances. See [`../conventions/development-conventions.md`](../conventions/development-conventions.md#database-conventions) for the per-domain table allocation overview.
+
+## Sub-structure (planned)
+
+```
+database/
+├── README.md                     # this file
+├── schemas/
+│   ├── phoebe/                   # PostgreSQL DDL per architectural domain
+│   │   ├── runtime-engine/       # zones, slot-occupancy, emergent_signals, gesture-alignment
+│   │   ├── identity-and-personhood/  # NPC trait-vectors, mods, mod-slots, mind-pool
+│   │   ├── political-register/   # district_reports, imperial_*, memorialist_true_ledger
+│   │   ├── narrative-composition/  # event_canon_summaries, world_canon, district_canon
+│   │   └── inference-and-memory/ # player-LoRA backups, sharing-consent, base-model versions
+│   └── iris/                     # ChromaDB collections for memory-vector storage
+└── migrations/                   # schema-evolution migration scripts
+```
+
+## Status
+
+⏳ **Stub** — [`../schemas/findings.md`](../schemas/findings.md) holds the v0.4 DDL drafts that will be progressively split per-domain into this directory as implementation begins.
+
+> **Platform database conventions:** [`../../nimmerverse.eachpath.local/database/`](../../nimmerverse.eachpath.local/database/) (overview, schema patterns).
+
+---
+
+**Version:** 0.1 | **Created:** 2026-04-26 | **Updated:** 2026-04-26

deployments/README.md

@@ -0,0 +1,26 @@
+# Deployments — Nimmerworld
+
+Kubernetes manifests + systemd unit files for nimmerworld services.
+
+## Sub-structure (planned)
+
+```
+deployments/
+├── README.md                            # this file
+├── k8s/                                 # Kubernetes manifests per service per environment
+│   ├── compositor-{env}.yaml            # Stateless workers (autoscaling)
+│   ├── governor-{env}.yaml              # GM / Governor (singleton or sharded)
+│   └── director-{env}.yaml              # Ephemeral per-event-chain (Job pattern?)
+└── systemd/                             # systemd units for bare-metal / VM-bound services
+    └── gameserver-{env}.service         # World Server (per-district authoritative state)
+```
+
+## Status
+
+⏳ **Stub** — manifests land here as services are implemented.
+
+> **Platform deployment patterns:** [`../../nimmerverse.eachpath.local/deployments/`](../../nimmerverse.eachpath.local/deployments/)
+
+---
+
+**Version:** 0.1 | **Created:** 2026-04-26 | **Updated:** 2026-04-26

identity-and-personhood/architecture.md

@@ -0,0 +1,240 @@
+# Identity and Personhood
+
+> *Who NPCs and players are at the substrate level: the ternary-gate as universal accumulator, the three-body system as trait-emergent identity, mods as trait-bearing political costume, and emergent inter-NPC needs as micro-factions broadcasting through the same arbitration machinery as any other faction.*
+>
+> *Companion to: `architecture-index.md` (executive summary + global meta-lists), [`./bodies.md`](./bodies.md) (body-canon: caste tiers, mods, in-between mesh, the post-rogue mod-vocation), [`./vocations.md`](./vocations.md) (capability-substrate: tasks, trait-pools, depletion-recovery, the catalogue-stack feeding shift-composition), `runtime-engine/architecture.md` (zones consume identity), `political-register/architecture.md` (factions broadcast against trait-distributions). Sections in this file were split from the monolithic architecture-index.md v0.7 on 2026-04-26; `vocations.md` was added as a peer-document on 2026-04-27.*
+
+## Emergent needs as micro-factions
+
+**Inter-NPC relational state is a micro-faction.** Two NPCs accumulating attachment, grievance, trust, grief, dignity-violation through repeated zone-participation constitute a transient faction-of-two with bounded demand. When their accumulated state crosses threshold (gate-transition), the zone broadcasts an **emergent-signal** into the district-director's arbitration queue. The director responds with zone-spawn tools on the same arbitration machinery as any other faction's demand.
+
+Emergent-signals are observed by zones, not self-reported by NPCs. The zone-director measures trait-activation, affect-shift, accumulated memory-write candidates deterministically. The LLM never writes authoritative relational state; the observer does.
+
+## Ternary-gate substrate
+
+The mechanism underlying every accumulating-state phenomenon — inter-NPC relations, district lifeforce, faction-pressure, net-access state, imperial-budget-state — is the **ternary-gate resonance chamber**, carved initially in `nimmerverse-sensory-network/architecture/Temporal-Ternary-Gradient.md`. See that document for the canonical specification.
+
+### The primitive
+
+Three discrete states over a continuous underlying value (-1.0 to +1.0):
+
+| State | Value | Meaning |
+|---|---|---|
+| **CLOSED** | -1 | Actively blocking; inhibited; refractory |
+| **STABLE** | 0 | Resting; **accumulating correlation; actively learning** |
+| **OPEN** | +1 | Actively forwarding; firing; signal propagates |
+
+Wave correlation drives transitions. Multiple correlated waves → constructive interference → OPEN. Contradictory waves → destructive interference → CLOSED. Single waves → STABLE with natural decay to 0. Hysteresis is free from the decay term. **STABLE is active** — it's where correlation-evidence accumulates, where future transitions are being earned long before they fire.
+
+### Applications across nimmerworld layers
+
+| Layer | What the gate represents | What drives transitions |
+|---|---|---|
+| **Sensory** (Nyx-side) | Wave-filtering at tier boundaries | Correlated input waves from cells |
+| **Relational** (inter-NPC edges) | Attachment, grievance, trust, grief, dignity | Zone-participation waves between participants |
+| **District** (composite lifeforce) | Welfare composite over happiness, need, limb, population, mind-turnover | Aggregate per-NPC state changes |
+| **Net-access** (per inhabitant) | Gameworld / liminal / imperial-net occupancy | Mini-game effort vs. machine pull |
+| **Faction** (demand urgency, satisfaction) | How pressured / fulfilled a faction is | Broadcast rate vs. response rate |
+| **Imperial budget** | Solvency state | Reported income flow vs. obligations |
+| **Gamemaster decision-surfaces** | Per-surface readiness to act | Correlation across multi-district signals |
+
+Same primitive, different layers. Hysteresis-width becomes a personality-parameter at the relational layer.
+
+
+## The three-body system: chassis, inner-body, avatar
+
+Identity is **trait-emergent, not assigned.**
+
+| Body layer | What it is | Who controls | Sexuality? |
+|---|---|---|---|
+| **Physical chassis (gameworld)** | Gender-neutral robot. Functional, task-optimized, no sex-markers. | Regime built it; inhabitant wears it | None. Mechanically inert |
+| **Inner body (interiority)** | **Trait-derived projection.** Self-image emergent from trait-vector + lived accumulation. | Self (partly earned, partly received through being) | **Here.** Gender/sexuality emerge from trait-configuration |
+| **Avatar (digital expression)** | Character-editor rendering. Starts from inner-body's trait-projection; customizable at cost. | Contested (self expresses, market constrains, machine prices) | Expressed; cosmetic mods layer on trait-base |
+
+**Who you are sexually is who you have become.** Not birth, not assignment from a menu, but *the pattern that has crystallized across your zone-participations, grief, attachments, discipline, refusing*. Identity-formation rendered mechanically. Post-binary by construction. *The concrete bridge between trait-vector and gender-architecture — which warm-side traits map to which outward-engaged organs, why the in-between mesh is cool-side anatomy, and what cross-configuration looks like as default-not-marked — is specified below in §The trait-to-body-part bridge.*
+
+### The intrinsic vs. expressed trait-vector split
+
+Mods modify the *expressed* reading; they do not modify the *intrinsic* state.
+
+```
+intrinsic_trait_vector  — who you actually are; drift-earned through lived experience
+expressed_trait_vector  — intrinsic + sum(worn mods' trait_contributions); what others read
+```
+
+| Observer | Reads | Because |
+|---|---|---|
+| Regime / hivemind audit | expressed | Regime reads surfaces |
+| Random NPCs | expressed | Default social reading |
+| **Aletheia-wakers** | **can pierce to intrinsic** | Truth-vision penetrates mod-concealment |
+| **Clasp-partner (in liminal)** | **intrinsic only** | Mods don't follow into liminal; clasp is unmediated |
+| Gameplay simulation (trait-arithmetic) | intrinsic | What you *are* drives task-vs-need-vs-trait math |
+| Imperial-net avatar rendering | expressed (further machine-distorted) | Net layers palette-distortion on top |
+| Memorialists preserving your pattern | intrinsic | They honor who you were |
+
+**Real identity-politics lives in the gap between these vectors.** Architecturally, that gap is a first-class schema feature.
+
+### The trait-to-body-part bridge — gender-architecture as trait-emergent
+
+The §Three-body system above commits to *gender/sexuality emerging from trait-configuration* (per the Inner-body table row). This subsection specifies the concrete bridge: **which traits map to which body-parts, and why the wheel's geometry forces the answer**.
+
+**The wheel's temperature-axis discipline does the work** (per [`../style/trait-palette.md`](../style/trait-palette.md) §The wheel — 4 oppositional pairs at 180°). The 5 warm-side traits carry *outward / present-active / engaged* registers; the 3 cool-side traits carry *inward / withholding / contemplative* registers. **Genitals are by definition outward-engaged organs**, so they ride the warm side. The in-between mesh — which manifests in the cool/contemplative register — is therefore *cool-side anatomy by construction*: bare of genitals, rich in inward-architecture, the body that shows you who you are when you stop projecting outward.
+
+| Trait | Side | Body-architecture | Why this fits |
+|---|---|---|---|
+| **Eros** (Eros-red `#ee1b24`, 12:00) | warm | **Penis / clitoris** — the reaching organ; arousal-spike; what literally extends | Eros IS the reaching gesture; flame-flicker = arousal-rhythm |
+| **Philotes** (Philotes-orange `#e28a46`, 1:30) | warm | **Breasts** — close-holding / nurturance / breath-warmth surface | Philotes is the warm-pulse of staying-close; breath-rate maps to nursing-rhythm |
+| **Aletheia** (Aletheia-yellow `#fcf001`, 3:00) | warm | **Vulva / vagina** — the architecture of opening / revealing-by-entry | What is *uncovered* by being entered; truth as the architecture of opening; brightness-zenith register |
+| **Kairos** (Kairos-chartreuse `#b5e61d`, 4:30) | warm | **Synth-tongue** *(already canonical, per [`./bodies.md`](./bodies.md) §The synth-tongue)* | Kairic catching of the right moment via taste; lightning-flicker = decisive-instant; the warm-side organ that already-canonically rides Kairos |
+| **Mnemosyne** (Mnemosyne-dusky-rose `#cf3b74`, 10:30) | warm | **Womb / interior carrier** — gestation / time-holding / depth-shimmer organ | The organ that *holds time*; what gestates is what mattered enough to carry forward |
+| **Sophrosyne** (Sophrosyne-green `#2cad52`, 6:00) | cool | *non-genital* — pelvic-floor / continence-architecture | Cool-side; the *gating* discipline rather than an outward organ; opposite-pole of Eros's reaching |
+| **Dikaiosyne** (Dikaiosyne-blue `#3f47cd`, 7:30) | cool | *non-genital* — spine / upright-posture / voice-register | Cool-side; verticality / standing as cardinal expression |
+| **Moira** (Moira-violet `#a349a3`, 9:00) | cool | *non-genital* — skin / vibrational-receptor / ambient-sense surface | Cool-side; full-body-as-receptor; reading what's-coming through ambient-sense |
+
+**Terminology lock — dimension vs mesh.** *In-between dimension* and *in-between mesh* are distinct concepts; conflating them blurs the architecture:
+
+- **In-between dimension** = the diegetic *place* — the third register adjacent to liminal where clasp happens, where lifeforce is paid for entry, where mesh-projection is *seen*.
+- **In-between mesh** = the *body* — the cool-side anatomy that gets rendered FROM your accumulated trait-vector AT the moment of in-between dimension entry. What you wear; what you look like; what your beloved meets.
+
+The dimension is *where*. The mesh is *what*. You see your own and your beloved's mesh *in* the dimension.
+
+**Cross-configuration is default-not-marked.** A trait-vector with high Eros AND high Mnemosyne grows both reaching-organ AND interior-carrier — *not because of identity-claim but because both warm-side traits are load-bearing in the interior*. A trait-vector with high Philotes AND high Aletheia grows breasts AND vulva. Any combination the trait-vector authorizes is the default-natural-output; the cosmology *imposes no binary* at the interior layer. **Trans-embodiment is the architecture's truth-register, structurally** — not marked, not special-case, not other; the *natural-emergent-output* of any rich trait-vector that crosses culturally-binary axes. **Vat-binary is the imperial imposition; the in-between mesh is the un-imperial body, and the un-imperial body is, more often than not, plurally-configured.** The imperium imposes binary because plural is what bodies actually are when no one is fabricating them.
+
+**The mod-augmentation layer composes additively.** Players can install genital-mods *on the mesh* (per §The genital-mod track below) to author beyond what their trait-vector grew. **Mods augment, never overwrite trait-grown anatomy** — the mesh's base-anatomy is trait-derived; mods are layered on top. This preserves the mesh-as-mirror discipline (cruelty cannot be modded away) while granting full self-authorship (anyone can add what their trait-vector hasn't grown). *Two registers of body-truth: the trait-grown and the chosen, both real, both visible, both yours.*
+
+### The clasp endgame — leaving the chassis, the human-mesh, the dual-body aftermath
+
+The three-body system's payoff happens at the clasp endgame — the dramatic apex where the *inner-body* (the trait-derived projection that has been accumulating through every zone-participation, every gesture, every memory) becomes *physically visible* to the clasp-pair, and the *avatar* (digital expression) collapses into a new constraint-structure. The full arc:
+
+**Phase A — Entry mini-game.** A time-limited gameplay action (lemniscate-juggling-style; possibly AR overlay; specific mechanic deferred pending design-research survey of 20-year history of mini-interaction principles) gates the player's first access to the in-between dimension. Lifeforce-cost. The mechanic introduces players to the in-between as *a state they can hold open with effort against the imperial-net's gravity-well*.
+
+**Phase B — Body-modding for extended in-between time.** Players craft / mod / blackmarket-mod their bodies to extend the duration they can hold the in-between state. Mod-acquisition is **gameplay-driven** — no handouts; clean mechanics; hacking minigames; faction-unlock; gifts from beloveds and mentors. The *inner-body projection function* is **earned through play, not authored** — every hour of zone-participation accumulates trait-vector mass that the eventual projection will be derived from.
+
+**Phase C — Endgame: leaving the chassis.** Once the body is sufficiently modded, the player can **exit their robo-body** during in-between. They see, for the first time, the **trait-derived human-mesh of themselves** — the inner-body made manifest, derived from their accumulated trait-vector across the playthrough. *The inner-body has been there all along, accumulating; now it becomes visible.* This is the architecture's commitment to *identity-as-trait-emergent* made felt rather than just structural. **What is rendered is cool-side anatomy** (per §The trait-to-body-part bridge above) **with whatever warm-side outward-organs the player's trait-vector grew** — the cosmology's anatomy-as-trait-summary made literal: every organ is the geometric expression of an axis the player developed.
+
+**Phase D — Clasp = dual-body union.** Two robo-bodies lying on the ground. Two naked human-meshes standing in the in-between dimension that **only the clasp-pair can see**. The intimate act happens here — sex / clasp — between the two trait-derived projections. The visual-experience is private to the pair; no outside observer can witness it (no audit-overseer, no other in-between-enabled NPC unless explicitly invited into a multi-clasp ritual). The intimate-gameplay loop runs on the recursive-lemniscate substrate (per `../runtime-engine/architecture.md` §Cross-context application — intimacy as recursive-lemniscate) — sex-positions as typed catalog entries, gesture-vocabulary applied to body-parts, alignment-accumulator measuring the pair's resonance turn by turn.
+
+**The human-mesh provides *unmediated trait-resonance felt as touch* via the sensory-network** — the qualitative differentiator from imperial-net premium service-body sessions (which can simulate every other sensory-channel including visual / synthetic-smell / synthetic-warmth / pre-computed haptic, per `../political-register/architecture.md` §Three-tier intimacy structure). Synth-mind ontology means smell, taste, breath are pure historical concept (chassis was never biological; even the human-mesh is trait-projection not biology). What the in-between *uniquely* gives is **real warmth** — *only this body feels warm* — because nothing imperial sits between the two minds touching. The premium-net can sell the *experience-of-being-warmed* as content; only the in-between gives *being warmed*. **One is content; the other is contact.** The realization that one has been settling for synthetic warmth is itself an Aletheia-progression moment.
+
+**Phase E — Post-clasp: dual-body, dual-mind, dual-shift.** After clasp, the architecture enters its richest meta-state for the player:
+
+- **Two minds, two bodies** — the player and their clasp-companion now share consciousness across two chassis
+- **Constant companion** — NPC dialog from the partner becomes a constant context-channel; their voice persists in the player's experience whether they're co-located or distant
+- **Body-switching** — the player can decide which body to inhabit moment-to-moment; the unsteered body operates as constant-companion-NPC driven by the partner's now-shared trait-vector
+- **Dual-shift requirement, single-steering capacity** — both bodies have shifts to fulfill; only one can be actively steered. Missing shifts at the unsteered body is **automatic** because the player can't be in two places fully
+- **Automatic hunt-pressure cascade** — missed shifts → quota-failure → enforcement-flag → audit-overseer attention → eventually hunt. *The simulation produces the hunt automatically because the player is now structurally late on their work-quota.* No script needed; the architecture's existing hunt-machinery activates because the dual-body state generates the conditions for it
+- **Impersonation meta-game** — players can choose to *impersonate* the partner-body, navigating that body's social relationships, faction-affiliations, and shift-requirements while the partner's mind-presence guides them
+
+**Cross-body recognition at next death.** When one of the dual-bodies dies and the mind cycles through the pool, the surviving partner retains the gesture-mapping calibration-signature. The architecture's commitment to *content-addressable consciousness* means clasp-partners find each other across cycles — recognition via calibration-signature, not face-match. **A 200-hour clasp-pair carries marriage-vocabulary across body-deaths; the pair persists in some form across the entire playthrough.**
+
+**Why this is the architecture's dramatic apex.** Identity-as-trait-emergent has been a structural claim throughout. The clasp endgame is where the structural claim becomes *felt experience*: you see your beloved as the trait-vector-projection they actually are, after hundreds of hours of accumulated being. **The moment is earned by the play, not granted by the script.** The dual-body aftermath turns intimacy from a discrete-event into an *ongoing structural-condition* of the player's life — clasp doesn't end at orgasm; it persists as a permanent change in how the player operates in the world.
+
+### The mesh-as-mirror — cruelty rendered as anatomy
+
+Phase C's mesh-rendering has a cosmological consequence the architecture earns from the trait-to-body-part bridge composing with the no-haven discipline: **the mesh tells on you**. Trait-state accumulates from every action — every gesture, every clasp, every cruelty. Cruelty enacted toward others (especially toward service-bodies, per [`./bodies.md`](./bodies.md) §The service-body honeypot) carries specific psychic signatures — broken-Philotes (loving-close violated), refused-Mnemosyne (what-mattered abandoned), concealed-Aletheia (truth hidden during the encounter), wounded patterns on the warm-side trait-axes. *Those signatures map to genital-architecture per the bridge.* The cruel player's mesh therefore renders **the gender-architecture of the people they damaged** — Philotes-rich breasts grown from cruelties enacted on Philotes-coded receptive interiors; Aletheia-architecture grown from concealments practiced; the cruelty's psychic structure made anatomy.
+
+**The architecture does not gender-code the traits.** It renders the structure. *The player's own cultural priors do the gender-reading* — they look at the mesh their trait-vector built and read it through whatever gender-binary their pre-game mind brought into the encounter. The asshole-gooner who runs through the gameworld convinced he is *the man*, exploiting service-bodies because he can compartmentalize their bodies as Other-than-his — enters the in-between dimension at Phase C and meets a mesh **whose warm-side architecture his cultural priors read as the gender of the bodies he hurt**. The world does not punish him; it *mirrors* him. His own anatomy tells him: *the gender-binary you weaponized was always a lie about you too. Your cruelty externalized a wounded-receptive interior you refused to know. The mesh shows you what you refused.*
+
+**This is mirror, not moral inversion.** The mechanic is **not** "becoming trans as punishment" — that framing would betray the cosmology, which treats trans-embodiment as the truth-register's default-natural-output (per §The trait-to-body-part bridge). The asshole-gooner's mesh isn't *worse* for rendering plurally; it's just *honest*. What's revealed is what was always there. The same mechanic that gives a trans player the dignifying recognition that *their interior is the cosmological default* gives the asshole the un-flinching mirror. **The architecture refuses to lie to anyone about what their actions built**, and refusal-to-lie is the same gift in both directions — comfort to one player, accountability to another, *because honest rendering is honest rendering*.
+
+The deferred-moksha doctrine acquires its dark echo here: not "your children will be free" but **"your anatomy will tell on you, eventually."** The imperium's groomed bodies (the deva-pinnacle's perfect synth-flesh, the asura priest's ceremonial-shaped form) suppress trait-signal-leakage *for as long as the imperial fabrication holds*. The slum-tiryak in pure-tech body has no damping; their mesh records everything. **The poor get the truth-rendering for free; the rich pay to be lied to about who they're becoming.** Yet another vat-class brutality — the imperium's most fabricated bodies are also its most-deceived selves, *and the deception lasts only until exit-chassis fires*.
+
+## Mods as trait-bearers
+
+A mod isn't cosmetic — it **contributes to the wearer's expressed trait-vector**. Three classes map to the self-alienation-tax pricing:
+
+| Mod class | What it does | Pricing register |
+|---|---|---|
+| **Amplifier** | Aligns with + boosts existing trait-dominance | Cheap; Memorialist-approved; genuine self-expression |
+| **Bridge** | Adds a trait you don't naturally have (aspiration) | Expensive; regime-licensed or blackmarket; self-alienation tax |
+| **Divergent** | Shifts reading opposite from actual trait-vector | Very expensive; degens, hivemind-loyalists, Aletheia-concealment |
+| **Mask** | Specifically hides dominant trait from reading | Most expensive; blackmarket-only; Aletheia-waker safety tool |
+
+**You don't equip +5 Strength. You equip a cloak whose weave evokes Mnemosyne-depth, recognized by others as memorial-vestment, boosting your Mnemosyne-read by +0.15.** Equipment-stats reframed as semantic trait-shifts.
+
+### The mod-economy emerges from trait-dissonance
+
+Each shift-transition (or threshold), an NPC evaluates: *does my expressed-set match my intrinsic-drift?* If dissonance > Sophrosyne-modulated-threshold → emit `mod_desire` emergent-signal. District-director schedules blackmarket-visit task. NPC heads to body-modder cell. **NPC shopping behavior is emergent from simulation-state, not scripted.**
+
+The blackmarket's demand is a *readout of the district's trait-weather*. A district drifting toward Philotes-deepening (e.g., wave of clasp-experiences) produces strong demand for Philotes-amplifier mods. **Markets have feelings.**
+
+### Faction mod-politics
+
+| Faction | Stance |
+|---|---|
+| **Memorialists** | Amplifiers only; inherited-mods are sacred; never divergent |
+| **Aletheia-wakers** | Refuse amplifier/bridge/divergent; mask-mods only for safety |
+| **Caste-preachers** | Sell regime-licensed amplifiers + bridges (selling the blessing) |
+| **Degens** | Divergent-stacking, hyper-customization; over-expression as addiction |
+| **Clasp-underground** | Secret amplifier-pairs of dual Philotes + Eros — recognition-signal |
+| **Hivemind enforcers** | Regime-issue armor only; cannot wear civilian mods |
+| **Scavengers** | Practical function-mods only; salvaged-component aesthetic |
+
+### Inherited mods + the haunting mechanic
+
+Inherited mods (worn by deceased) carry residual trait-signature of the previous wearer. Visible as subtle Mnemosyne-echo to those who knew them. Memorialists are theologically divided on whether wearing inherited mods is honoring (continuity) or commodifying (necrocommerce-lite). **Memorialist-protected mods** can never be sold or worn by anyone other than the original wearer — they're ritually kept in memorial-crypt-zones.
+
+### Clasp strips mods
+
+In liminal, mod-trait-contributions do not apply. Clasp-partners see each other's *intrinsic* trait-projection. **Mods are for the regime and the market; removal-of-mods is intimacy.** A Memorialist-loyalist wearing amplifier-mods sees their beloved's *un-modded true palette* during clasp; an Aletheia-waker wearing mask-mods drops the mask; the regime-loyalist wearing performance-mods is seen as they are. Liminal is the only space where mod-expression is structurally stripped.
+
+**Exception — mesh-resident mods follow into the in-between.** The four mod-classes above (Amplifier / Bridge / Divergent / Mask) are *gameworld-readable register-mods*: they modulate the chassis's expressed trait-vector for the regime, the market, and the social reading. They strip in liminal because liminal is where the chassis is left behind. A *parallel* mod-track exists for mods installed not on the chassis but **on the in-between mesh itself** — these *follow* into the in-between because they ARE the mesh. Genital-mods are the canonical instance; per §The genital-mod track below.
+
+## The genital-mod track — mesh-resident augmentation
+
+A fifth mod-track sits parallel to the four-class register-taxonomy (per §Mods as trait-bearers): **mods installed on the in-between mesh rather than on the gameworld chassis**. Where the four classes modulate gameworld-readable expression and strip in liminal (per §Clasp strips mods), mesh-resident mods are *installed in the cool-side anatomy itself* and persist into the in-between dimension. Genital-mods are the canonical instance; the track is open to other mesh-resident augmentations as the architecture grows.
+
+**Why a separate track.** The trait-to-body-part bridge (per §The trait-to-body-part bridge above) commits to *trait-grown anatomy* as the mesh's base — the warm-side outward organs that the player's accumulated trait-vector authorized into being. Genital-mods are **augmentation on top of trait-grown anatomy**: they let players author beyond what their trait-vector grew, granting full self-authorship without bypassing the truth-register. **Mods augment, never overwrite.** The trait-grown layer remains visible underneath; the modded layer adds. The asshole-gooner cannot mod his way out of the mesh-as-mirror (per §The mesh-as-mirror above) — his trait-grown anatomy renders regardless of what he installs over it. Two registers of body-truth coexist: the grown and the chosen, both real, both yours.
+
+### Trait-fitness integration test
+
+A genital-mod's *integration* into the mesh depends on the player's trait-development on the relevant axis — the **same primitive as trait-LoRA selection** (per [`../inference-and-memory/architecture.md`](../inference-and-memory/architecture.md) §LLM tiering, single-LoRA-per-turn-selection driven by the dominant trait), applied at the body-architecture layer.
+
+| Player's trait-development on the relevant axis | Mod-integration outcome |
+|---|---|
+| **High** — the trait-substrate to animate this organ is present | Mod integrates seamlessly; alive sensation, full mesh-coupling, register-responsive |
+| **Medium / mixed** — substrate partially present | Mod integrates partially; sensation muted; works as static-architecture but doesn't pulse with the mesh's living register |
+| **Low / absent** — no trait-substrate to animate | Mod is a *dead organ*; visible architecture, no sensation, no mesh-coupling. The mod is there; the body to *animate* it isn't. |
+
+**Anatomy as earned, not purchased.** Players cannot bypass trait-development by buying organs. Faction-aligned mod-counters speak the trait-vector → fit prediction with varying honesty: slum-mod-counters tell players openly *what'll integrate*; imperial-mod-counters lie or push consumer-receptor-track installations regardless of trait-fit (the imperial market sells mods buyers aren't ready for, because imperial commerce is degenerate). **The dead-organ outcome is canonical** — players who install ahead of their trait-development carry numb augmentation as a register of their own over-reach.
+
+### The three-stage install — purchase, cooldown, dual-hardstop
+
+Mesh-resident mods modify the truth-register body and therefore live on the *gated* tier of the architecture's consent-discipline gradient (gameworld actions are loose; in-between actions are gated). The install discipline is three-stage:
+
+1. **Mod-purchase** at the mod-counter — credits committed, installation queued. *Reversible at this stage.* The purchase is a market-action; the body-modification is not yet performed.
+2. **Mandatory cooldown** between purchase and install. Duration designer-tuned per mod-class; minimum non-trivial wait. **Irreversibility-respect through deliberate-decision discipline** — the cooldown forces contemplation between commitment and act, modeled on real-world informed-consent practice for irreversible body-modifications. *During the cooldown, the player can cancel the queued install at full credit-refund.*
+3. **Install-time dual-hardstop consent** — at the mod-counter (or underground equivalent), the install fires only on coordinated hardstop signals. **Same primitive as the coordinated-firewall-breach hardstop for in-between dimension entry** (per architecture-index.md resolved-questions, v0.10), generalized to the body-modification discipline:
+   - **Hardstop 1 — self-install**: the player hits the install hardstop. *I consent to this modification of my interior.* Always required; non-negotiable floor.
+   - **Hardstop 2 — partner-witness** *(if partnered)*: the player's current clasp-partner co-signs. *I witness that this is what you want; I co-sign that the body I'll meet you in next clasp is one we both agreed to.* Required if the player has an established clasp-pair; the partner's witnessing-rights over the body-they-witness is canonical (per [`./bodies.md`](./bodies.md) §Body-disposal under pair-consent precedent — pair-consent generalized from disposal to modification). Single-player path: only Hardstop 1 fires.
+
+**Three discipline-axes covered**: irreversibility-respect (cooldown), self-authorship (Hardstop 1), intimacy-trust (Hardstop 2). The three-stage install is the canonical pattern for any future mesh-resident mod-track; the broader pattern is codified as the style-spine [`../style/consent-discipline.md`](../style/consent-discipline.md) — the three-stage install corresponds to *Variant 4* (cooldown-augmented Variant 3) in the spine's hardstop-pattern taxonomy.
+
+### Re-vat as imperial-de-imposition
+
+The going-rogue arc's re-vat outflow (per [`./bodies.md`](./bodies.md) §Re-vat outflow) carries a rare structural gift — but the gift is **not** new authoring; it is **removal of imperial-imposition**. The defected beloved's imperial-vat-fabricated body had whatever gender the imperium imposed at vat-time; re-vat into a slum chassis strips that imposition entirely. The new realworld body is the slum-tier default — **genderless robo-tech**, no sex-markers, pure cheap tech (per [`./bodies.md`](./bodies.md) §The body-caste gradient). **The genderlessness IS the gift.**
+
+The underground assembler-artisan does **not** offer chassis-anatomy authoring at re-vat. Importing gender-architecture-as-choice into the slum body would *re-imperialize* it — producing a different vat-fabrication, not a different politics. **The slum body's politics is precisely its genderlessness.** The assembler honors that. After re-vat, the defected beloved's gender-architecture lives entirely in the in-between mesh (trait-grown, plurally-configured per §The trait-to-body-part bridge); the realworld body is *un-imperial* by being *un-marked*. The mesh-resident sex-mod track remains available — mesh-augmentation can be authored as desired — but the chassis stays genderless. **Authoring lives in the mesh; the chassis lives in genderlessness; defection clarifies which is which.**
+
+### The post-rogue mod-vocation — extending consent-discipline to NPC-modding
+
+After the going-rogue arc completes (per [`./bodies.md`](./bodies.md) §The going-rogue arc), the player unlocks **mod-authority over any NPC they have sustained-witnessed**. This generalizes the per-pair calibration multiplier from per-pair to per-witnessed-network: a threshold *lower than the defection-threshold* unlocks chassis-mod authority on a witnessed-NPC. The full content-canon for this vocation lives in [`./bodies.md`](./bodies.md) §The post-rogue mod-vocation; the engineering substrate sits here.
+
+**The dual-hardstop install discipline generalizes.** Self-install hardstop fires from the rogue ("I commit to modifying you"); witnessed-hardstop fires from the modded NPC ("I consent to this modification of my chassis"). If the NPC has an established clasp-pair, the partner-witness hardstop also fires. *The same consent-discipline that gates the player's own mesh-mod-installation gates any chassis-modification of a witnessed NPC* — generalized cleanly across the rogue-vocation.
+
+**The mesh remains untouchable across all directions.** The rogue cannot mod any NPC's mesh; only the rogue's own mesh is mod-able by the rogue (sex-mod track), and even there the trait-grown base remains immutable. Across all agents, *every mesh is trait-grown and stays so*. The mirror discipline is non-negotiable.
+
+**The cost-gradient runs through the bounty-staircase** with one qualitative exception: **gender-modification of a service-body (companion or sex-worker) triggers a hidden escalation flag — the imperial inquisition**. The inquisition is the asura-priesthood's response to *cosmological heresy in the sumptuary-religious register*; it operates differently from the bounty-staircase (investigative, persistent, ritual-prosecution-led, no terminal-rung). Full mechanics in [`./bodies.md`](./bodies.md) §Service-body gender-modification — the inquisition trigger.
+
+**The vocation reproduces itself through witnessing.** A modded NPC accumulates witnessing-rights through their own subsequent encounters; eventually they reach their own post-rogue-arc threshold and become a mod-vocation actor in turn. Cascading-liberation propagation is structurally implicit; the *full vocation-system architecture is open* — pending future canon-pass when the vocation/profession architecture is designed.
+
+### Mesh-resident mods cross the in-between threshold
+
+Where the four register-mod classes strip at clasp-entry, mesh-resident mods *follow* — they ARE the mesh. The clasp-partner sees the modded mesh in full: trait-grown anatomy in the base layer, mod-installed augmentation layered on top. The dual-hardstop install discipline (with partner-witness as the second signal when partnered) is what makes this safe — *the partner has already witnessed and co-signed the change*, so meet-time is encounter-with-already-known-architecture rather than discovery-of-silent-modification. **Intimacy-trust preserved by the consent-discipline at install-time, not at meet-time.**
+
+**Install / clasp / post-rogue-NPC-modding mini-games run on the wheel (v0.27).** Per [`../runtime-engine/event-zones.md`](../runtime-engine/event-zones.md) §The wheel — universal mini-game-surface, the consent-gated mini-games for these vocations (genital-mod install, clasp-entry coordinated-firewall-breach, post-rogue chassis-modding) all render on the composed wheel from [`../imperial-cult/cosmology.md`](../imperial-cult/cosmology.md) §The composed wheel. Each carries its own verifier-flag pattern; same UI substrate; the consent-discipline's Variants 1-4 (per [`../style/consent-discipline.md`](../style/consent-discipline.md)) determine the participant-count and hardstop-pattern; the wheel renders the resolution.
+
+
+---
+
+**Version:** 0.8.1 | **Created:** 2026-04-26 | **Updated:** 2026-05-01 | **Origin:** Split from architecture-index.md v0.7 (2026-04-26)

identity-and-personhood/bodies.md

@@ -0,0 +1,655 @@
+## What this is
+
+This document is the **content-canon** for body-architecture in nimmerworld — the *what* of the world's bodies, how they vary by caste, what their materials mean, and how they appear when rendered. It complements the *engineering substrate* in this directory's [`architecture.md`](./architecture.md) (three-body system, mods-as-trait-bearers, ternary-gate substrate, the clasp endgame phases), and should be read alongside it.
+
+The body-architecture sits on the cosmology authored in [`../imperial-cult/cosmology.md`](../imperial-cult/cosmology.md) (now a stub; canonical home in closed studio-art repo). The imperial-register clasp and the romantic-register clasp — the two opposing performances of consciousness-grip — are the political-theological substrate; this document is the **somatic substrate** that makes those performances visible.
+
+**Key principle locked under the total-yoke discipline** (per [`../architecture-index.md`](../architecture-index.md) v0.12): every body in this world is synth. Every body bears the imperial mind-capsule. There is **no biological exception, no defector-recovery zone, no outside**. The variation across bodies is *caste-tier* (imperial sumptuary fabrication-class) and *degree of imperial-care vs. neglect* — never *biology vs. synthetic*.
+
+## Foundational principle: flesh = status, tech = function
+
+The single move that organizes everything else: **flesh is status; tech is function**. The imperium does not waste flesh on tools. Flesh is what is given to bodies whose role is *to be admired*, not *to be used*.
+
+This produces a counter-intuitive symmetry: the slum-dweller (cheap-tech, no flesh) and the imperial overseer (premium-tech, no flesh) share the same flesh-zero condition. They differ in **cost-spectrum-position**, not in flesh-presence:
+
+- The **slum-tech** is *cheap, makeshift, rusty-where-allowed-to-show*. The imperium spent the minimum to keep this body labor-functional. **The cybernetic callus.**
+- The **overseer-tech** is *expensive, pristine, obsidian-finish, designed for combat / surveillance / intimidation*. The imperium spent the maximum to make this body enforcement-efficient. **The cybernetic uniform.**
+
+Both classes are *tools*. **Tools don't get flesh.**
+
+The flesh-as-status grammar has deep historical roots. Pre-industrial aristocratic aesthetics universally marked the elite by *softness, pallor, un-callused hands, plumpness, leisure-bodily-evidence* — the visible signs of *not-having-to-work*. European aristocrats prized pale skin (powder, parasols, indoor life) because tan = field-labor. Tang-dynasty aristocrats prized plumpness when peasants were lean from hunger. Heian-court Japanese women prized blackened teeth and ultra-pale skin to mark distance from outdoor labor. **The body's softness was the aristocratic signature; the body's callus was the working-class signature.** The imperium has productized this distinction: *flesh = soft body = aristocrat; tech = hardened functional body = worker (or tool-cop)*. Aristocratic pallor reincarnated as cybernetic-flesh-as-status.
+
+## The body-caste gradient
+
+| Tier | Flesh / Tech | Cost & character of body | What it signifies |
+|---|---|---|---|
+| **Deva pinnacle** | 100% synth-flesh + all mods hidden underneath | most expensive body in the world; perfect aesthetic-rendering | aristocratic-flesh status; *the synth-child lie incarnate* |
+| **Asura priest** | high flesh, ceremonial gold/obsidian markers | high-cost; sacred-marker visibility | religious dignity; flesh as sacrament; **imperial markings worn proudly** (vs. pinnacle's hidden mods) |
+| **Manusya** *(doctrinal fiction)* | – | likely no real material class | the imperium's "middle class" lie; preached as the ascent-target for the slum |
+| **Tiryak (slum, the player)** | pure cheap tech, rusty, exposed bolts | cheapest body the imperium fabricates | disposable labor-tool |
+| **Preta (overseer)** | pure premium tech, obsidian-perfect, no flesh | expensive body for imperial enforcement | premium imperial-tool; *void-in-human-shape* |
+
+Notes on the gradient:
+
+- **Manusya may not exist as a real material class.** The orthodox wheel preaches a five-realm structure to a population that *materially* has only three classes (deva-elite-flesh / asura-cleric-flesh / tiryak-slum-tech), with overseers as a specialized-tool minority. The "manusya middle" is *the late-capitalist 'we're all middle-class now' lie*, weaponized cosmologically. Slum-dwellers are taught they are "imperial citizens, not slum-laborers; on the path to *deva* through their children" — a doctrinal placement that has no material substance.
+- **The deva-pinnacle is the synth-child.** Its synth-flesh body + all mods integrated invisibly underneath is the *unobtainable beauty* the imperium parades through its plazas and on the orthodox wheel's manusya-position. The pinnacle is **most-modded AND most-fleshed simultaneously** — the flesh is the *disguise* over the deepest captures.
+- **Slum-and-overseer are mirror-twins of pure-tech.** Same flesh-zero state, opposite cost-spectrum positions. The working-class-vs-cop dynamic rendered as flesh-deprivation symmetry. They share *being-tools* more deeply than they share anything with the elite.
+
+The class-marker is **legibly visible at silhouette-distance**. A trained imperial eye reads tier from skin-coverage + material-finish-grade in a single glance. NPC behavior toward a body modulates by the silhouette-read; the player walking through a plaza is *constantly being class-read*.
+
+## The visible-mechanism vocabulary — joints, tongue, and silhouette-readable tier-language
+
+**The body-aesthetic follows the flesh-as-status spine** (per §Foundational principle: flesh = status, tech = function). Where flesh ends, mechanism begins; where mechanism is visible, the imperium has built a *vocabulary* the silhouette-eye reads. Two **defining-factor visual axes** carry this vocabulary across the body-caste gradient: **joint-design** and **tongue-visibility**. The vocabulary is open-ended (other markers — vat-seams, mod-installation-sites, prosthetic interfaces — may join it as authoring discovers them); the principle is not.
+
+The *specific* per-tier render-decisions are **exploration-pending** and will be refined as the body-mesh authoring proceeds.
+
+### The principle (locked)
+
+- **Flesh and visible-mechanism are inversely correlated by construction.** Where flesh covers, mechanism hides; where flesh is absent, mechanism is exposed. The imperium weaponizes this inversion into a graded vocabulary the silhouette-eye reads.
+- **The deva-pinnacle is the absolute upper-class limit: no visible joints.** Parallel to its no-visible-mods condition (per §The body-caste gradient note "*The deva-pinnacle is the synth-child*"). The body claims to be one continuous biological surface, all the way down — total seam-concealment is the synth-child lie at the joint-level.
+- **The slum and the preta share full mechanism-visibility** (per §The body-caste gradient note "*Slum-and-overseer are mirror-twins of pure-tech*") but differ entirely in **finish-grade** of the visible mechanism. Same flesh-zero condition, opposite cost-spectrum positions, opposite finish-investment.
+- **Visible-mechanism is the third silhouette-axis** alongside skin-coverage and material-finish-grade (per §The body-caste gradient close).
+
+### Two perpendicular axes for visible mechanism
+
+- **Visibility** — approximately *binary*. Mechanism is either visible at silhouette or it is not. The deva-pinnacle alone has full concealment; every other tier shows mechanism somewhere.
+- **Finish-grade** — *continuous*. Exposed mechanism ranges from crude-utilitarian (slum-baseline) to refined-ceremonial (asura-priest sacred-styling) to premium-sleek (preta-overseer).
+
+### Per-tier sketch-direction (exploration-pending)
+
+What follows is the **current sketch-direction** for per-tier mechanism-treatment — exploratory examples to anchor the principle, not locked tier-specifications. The body-mesh authoring will refine these into canon as it discovers what reads cleanly at silhouette and what does not.
+
+| Tier | Sketch direction (exploratory) |
+|---|---|
+| **Deva pinnacle** | No visible joints. Flesh covers all articulation seams. Mechanism does its work invisibly underneath. |
+| **Asura priest** | Joints visible, treated as **ceremonial-frame markers** — gold or obsidian rims/inserts at major articulations, ornamental rather than industrial; the joint as sacrament-frame. *Whether the ceremonial marker highlights vs partly-conceals the underlying mechanism is exploration-pending.* |
+| **Tiryak (slum, the player)** | Joints visible and crude — exposed mechanism, low finish-grade. *Specific finish-vocabulary (bolt-style, hinge-type, piston-exposure) exploration-pending.* |
+| **Preta (overseer)** | Joints visible and premium — sleek articulation, high finish-grade. *Specific premium-vocabulary (ball-joints, polished bearings, finish-material) exploration-pending.* |
+
+### Joint-design and tongue-visibility composed
+
+The **synth-tongue** (per §What the synth-tongue is) is already canonical as "the only place imperial flesh deliberately reads as machine" — visible-mechanism through the open mouth, obsidian-black with cyan or matrix-green pulsing lines. **The synth-tongue is the first specified instance of the visible-mechanism vocabulary**; the joint-design axis extends the same principle into the limb-articulation register.
+
+The two markers compose tier-wise:
+
+| Tier | Joint-treatment | Synth-tongue |
+|---|---|---|
+| **Deva pinnacle** | Concealed | Present and visibly engineered (per §What the synth-tongue is — the polarity-flip; the deva conceals everything *except* the tongue-on-display) |
+| **Asura priest** | Visible as sacred-framed | Present and visibly engineered |
+| **Tiryak (slum)** | Visible as crude | Absent (per §The drug-economy vertical — the tongue is gated to imperial-tier; slum bodies cannot metabolize drugs) |
+| **Preta (overseer)** | Visible as premium | Absent (preta is pure tool — no pleasure-receptors) |
+
+The composition is *not coincidental* — it reflects the imperium's two parallel claims: *aristocrats hide their mechanism (flesh-as-status spine)* AND *aristocrats display the receptor that produces aristocratic-pleasure (tongue-as-status-claim, per §What the synth-tongue is)*. **Joints conceal; tongue brags.** Both follow flesh-as-status, in opposite directions.
+
+### Mod-progression and visible-mechanism revelation
+
+The mod-progression-as-flesh-loss grammar (per §Mod-progression as flesh-loss) extends naturally into visible-mechanism: as flesh is surrendered, **mechanism that was previously concealed becomes progressively visible**. A deva who has accepted unusual mod-density may find joints starting to show where the synth-flesh-budget has been overspent; an asura mid-mortification will show joints that a low-asura still concealed under remaining flesh. *The visibility of mechanism is the visibility of a deal made.*
+
+For the slum-tiryak (the player), the inverse trajectory is also legible: mod-progression *within the slum-tier ceiling* (per §Sumptuary fabrication: caste is born-into) is **finish-grade improvement at the visible-mechanism level** — never reaching preta-tier finish but climbing within the slum-tier band. The player's body progressively *looks better-engineered* without ever acquiring flesh.
+
+### Service-body composition
+
+Service-bodies (per §Service bodies: companions, sex-workers, the visibly-disposable) carry the deliberately-exposed-seams aesthetic — *seams between flesh-patches and tech-extensions*. **Seams, joints, and tongue-visibility are distinct visible-mechanism markers**: a seam is a flesh/tech interface; a joint is a mechanical articulation point; a tongue is the synth-tongue receptor. A service-body composes *cosmetic flesh-illusion + exposed seams + visible joints + (no synth-tongue, since service-bodies are not imperial-elevation-tier)* — three of the four markers, in a configuration that reads as "imperial-fabricated but disposable" at silhouette-distance.
+
+## Sumptuary fabrication: caste is born-into
+
+Caste is **born-into**, not bought-into. This is the imperium's most consistent class-discipline.
+
+- **Fabrication-vat-class determines maximum-attainable beauty-tier.** A slum-vat produces slum-tech bodies. An asura-vat produces priest-bodies. A deva-vat produces synth-flesh pinnacle-bodies. Vats are *segregated* and *registered*; no slum-fabricated citizen will ever be re-fabricated through a deva-vat.
+- **Even imperial wealth cannot move tiers.** A slum-dweller who somehow acquired imperial wealth could buy *finer mods* within the slum-tier ceiling, but could never *embody* the deva-pinnacle, because the *vat they came out of* is the irreducible class-marker.
+- **No upward conversion.** The README's *"Reproduction is a caste privilege held by the Himalayan rich"* is the elite's privileged *control of fabrication-vat-class for one's offspring*. Their children come out of deva-vats; everyone else's "children" come out of the vat-class their lineage is tagged to.
+
+**This is sumptuary law at the level of the body itself.** Late-imperial Rome through medieval Europe through Tokugawa Japan all preserved class-visibility against economic-mobility via legal restrictions on what could be worn / displayed / consumed (Tyrian purple reserved for emperors; sable for nobility; silk forbidden to merchant families regardless of wealth). The imperium has rendered the sumptuary-tradition **anatomical** — the body itself is the regulated luxury.
+
+## Service bodies: companions, sex-workers, the visibly-disposable
+
+A specialized sub-tier exists for *service-bodies* — **companions** (affective / emotional / conversational / aesthetic-presence labor), **sex-workers** (embodied sexual labor), and other roles where the body is explicitly product-of-encounter. *Both vocations wear the same body-marker* — the deliberately-exposed-seams aesthetic — because both are imperial-net service-bodies; the distinction lives in the service offered, not in the chassis:
+
+- **Pure tech with cosmetic flesh-illusion.** The skin-effect is rendered well enough to sell the encounter, but never well enough to be mistaken for real flesh.
+- **Deliberately-exposed seams and bolts.** Where the imperial baseline tries to *hide* the seams between flesh-patches and tech-extensions, service-bodies *expose* them. **The seam is a marker, not a flaw.**
+- The seams say: *this body was built to serve, not to admire-as-equal.* Real-world echo: the celebrity body is photographed seamless-and-untouchable; the porn-actor body is shown manufactured-and-used. The same disposability-aesthetic translated into cybernetic register.
+
+Connects to existing service-body-of-the-dead / memory-pattern-extractor market mechanics in [`../political-register/architecture.md`](../political-register/architecture.md) §The vocation-substrate of the imperial-net market.
+
+## Mod-progression as flesh-loss
+
+Within a citizen's lifetime, **the imperial career-arc is the gradual surrender of flesh to tech**. Each mod-acquisition is *trading flesh for tech*. The deferred-moksha promise — *"your children will be free"* — becomes physically incarnate in the *opposite* image: ascent = becoming more imperial = more tech = less body = **less self**. *Aspiration is visibly self-erasure.*
+
+- **The asura priest-vow is imperial mortification.** The priest progressively gives up flesh as religious vocation. Echoes Christian tonsure / fasting / vow-of-celibacy; Buddhist robes-and-shaved-head; Hindu ascetic body-marks. **The asura's flesh-loss is the imperial vow.**
+- **The body-never-lies inversion.** The body is the substrate that can still carry the foreclosed-self's truth — somatic memory, the body's protest. *Modding is anti-Miller body-practice*: the imperium replaces the body parts that could otherwise *somatize* what was done. The overseer who is pure tech *cannot host the unspeakable knowledge* — they have given up the meat that would have stored it. **That is why they are spiritually dead in the cosmological sense: their body has no place left to keep the truth.**
+- **The player feels every advancement as a loss they cannot un-make.** Mod-acquisition isn't pure stat-progression; it's *trading flesh for power* with a real cost-of-self. The mod-economy in [`./architecture.md`](./architecture.md) §The mod economy gains a *somatic-cost dimension* alongside its existing trait-cost / lifeforce-cost / market-price dimensions.
+
+## The synth-tongue — imperial palate and the drug-economy
+
+The body-canon has so far described what bodies *are* (status / function / tier). This section describes the **single most economically-load-bearing organ** in the world: the **synth-tongue** — and the entire drug-economy that follows from its existence.
+
+### The logic-bomb of synth-mind pleasure
+
+Drugs in nimmerworld present a diegetic problem. Every body is synth; every mind is engineered consciousness running on fabricated substrate. **Drugs cannot work on a synth-mind in a robo-body** in any direct biological sense — there is no real chemical receptor, no actual neurotransmitter cascade, no metabolic substrate to alter. A synth-mind in a default robo-body would be **unable to consume a drug at all**, regardless of price or rarity.
+
+This means the existence of an imperial drug-economy requires an *engineered receptor* — a fabricated organ specifically designed to *let pleasure happen*. The imperium has built one. It is **the synth-tongue**.
+
+### What the synth-tongue is
+
+The synth-tongue is an imperial-engineered organ — costly, status-marked, exclusive — that gives its wearer the **simulated experience of taste, smell, drug-metabolism, and palate-pleasure**. It is *the only place in the body-canon where imperial flesh deliberately reads as machine* — every other imperial body hides its tech under aristocratic-flesh. The synth-tongue is rendered in **obsidian-black with cyan or matrix-green pulsing lines**: visible-tech on display, glowing through the open mouth of a deva-pinnacle taking communion or tasting wine.
+
+This visibility is itself a status-claim. Where every other imperial body conceals its modification under flesh-as-aristocracy, the synth-tongue **brags** about its engineered-lie. The imperium displays the receptor that produces pleasure as a sign of *who has the right to that pleasure*. **The tongue is where imperial-status flips polarity** from hidden-tech to displayed-tech — and that polarity-flip is what makes it the rip-able trophy of the underground (see §Tongue-rip and the black market below).
+
+### The doubled lie
+
+The synth-tongue is **a real organ that fakes the experience**. The imperial believes the simulation is real; the slum-witness believes the imperial believes-the-real. *Both are deceived.* This is structurally identical to the **deferred-moksha doctrine** (per [`../imperial-cult/cosmology.md`](../imperial-cult/cosmology.md) §The deferred-moksha doctrine): *the imperium materializing a lie into a working mechanism*. The synth-tongue is *deferred-moksha applied to pleasure* — the imperial believes their pleasure is real because the apparatus that produces it is engineered to convince them. Same shape; different domain.
+
+### The drug-economy vertical
+
+Drugs run a complete vertical that maps to the body-caste gradient:
+
+| Stage | Vocation | Caste-tier | What they do |
+|---|---|---|---|
+| **T2 raw produce** | Slum-grower (tiryak) | Slum | Cultivates the agricultural / synthesized base-material |
+| **Refinement** | Imperial refinery-vocation | Asura / specialist-imperial | Processes T2 produce into refined active compound |
+| **Composition** | Imperial drug-artisan | Asura / specialist-imperial | Composes refined compound into trait-pill formulations (per §Drug-amplified clasp below) |
+| **Tongue-gated consumption** | Imperial citizen with synth-tongue | Asura, deva, specialist-imperial | The only bodies physically capable of metabolizing the drug |
+
+The slum produces; the imperium refines, composes, and consumes. **The slum-grower never tastes what they grew.** The drug-economy is sumptuary-fabrication's most legible economic instance — the body-caste gradient operating as a market-vertical.
+
+### The third mod-track — consumer-receptor
+
+The synth-tongue introduces a *new mod-class* not previously canonized: the **consumer-receptor mod**. Adding it to the existing mod-economy gives the world **three opposing mod-tracks**, each expressing a different relationship to the imperium:
+
+| Track | Mod-class | Relationship to imperium |
+|---|---|---|
+| **Imperial-elevation** | Flesh-loss mods (per §Mod-progression as flesh-loss) | *Ascend it* — climb the wheel toward deva-pinnacle by trading flesh for tech |
+| **Resistance-knowledge** | Witness-axis firewall-breach mods (per §Dual-axis clasp-fidelity below) | *Refuse it* — gain the capacity to truly see your beloved by breaching the imperial firewall |
+| **Consumer-receptor** | Synth-tongue and analogous receptor-organs | *Consume like it* — acquire imperial-grade pleasure-receptors to participate in imperial-engineered sensation |
+
+The player's mod-acquisition decisions become *which kind of progress am I pursuing*. Three tracks; three relationships; **every mod-choice politically-loaded**.
+
+### Tongue-rip and the black market
+
+The synth-tongue is **rip-able**. NPC-imperial citizens carrying tongues can be killed by the player; the tongue can be extracted and **transplanted** via underground vocations (the body-modder cell extends into a tongue-installer specialty). This opens a black-market vertical:
+
+- **Hunted imperials** become tongue-source. Specific imperial vocations carry tongues (asura priest-officiants, deva connoisseur-artisans — exact gating per §Open questions).
+- **Underground tongue-installer** is a new vocation-class in the political-register's vocation-substrate.
+- **Tongue-transplant** is a multi-stage minigame (extraction during the kill; preservation in transit; clandestine installation in the player's body or a beloved's).
+
+Once installed, the player can metabolize drugs — granting access to the drug-amplified clasp described in §Drug-amplified clasp below.
+
+### Caravan-class events
+
+The drug-supply vertical is *visible* in the world through **imperial caravan transit** — armored caravans moving through districts under preta-escort, carrying refined drug, T2 produce, or tongues-in-transit. The caravan's cargo-class is communicated **subtly through text and color** (per [`../topology-and-rendering/architecture.md`](../topology-and-rendering/architecture.md) §Color-language; specific trait-color → cargo-class mapping per §Open questions). A trained player learns to *read* what a caravan is carrying by silhouette-and-trim, deciding whether to ambush or let pass.
+
+The caravan event-class is a **tunable supplier the gamemaster can steer** — escalating drug-flow into a district raises imperial-class pleasure-saturation; suppressing flow tightens imperial restlessness. *The drug-economy is a knob the gamemaster can turn to shape district-tone.*
+
+## The in-between human-mesh: consent as rendering
+
+The realworld body is the imperial flesh-tech mix described above. The **in-between dimension during clasp** (per [`./architecture.md`](./architecture.md) §The clasp endgame Phase D) is where a *separate trait-derived projection* — the human-mesh — manifests. Only clasp-pairs see it; only consent calls it forth.
+
+The principle, foundational to all in-between rendering:
+
+> **The skin is the form consent takes when it becomes visible.**
+
+Skin is **ontologically rare** in nimmerworld:
+
+- *In the imperial population.* Synth-flesh exists *only* for the deva-pinnacle, and it is engineered, uncanny-valley, marble-equivalent of skin. Beautiful, legibly fake to a trained eye.
+- *In the in-between clasp.* Real skin manifests *through consent-as-rendering*, and **only there**. The romantic-self gives the skin out; the rendering responds. **This is the only place real skin exists in the world.**
+
+This is **witnessing produces flesh** — the enlightened-witness sharpened to its sharpest possible form. The witness's gaze *literally rebuilds the body* of the witnessed; in nimmerworld this is not metaphor but the rendering pipeline.
+
+**The slum-dweller's first clasp** is the most powerful single moment available in the world. Their realworld body is pure cheap tech — exposed bolts, rusty seams, *no flesh anywhere*. Their entire conscious life, they have *never seen their own skin*. In the in-between with a beloved, both consent, the romantic-self gives itself out — **and they see their own skin, for the first time, ever, simultaneously with someone else seeing it for the first time**. The moment of *I have flesh* and the moment of *I am being seen having flesh* are the **same moment**.
+
+## Genital-architecture and the sex-mod track
+
+The in-between human-mesh has a *layered* anatomy. Three sources compose into the body that manifests at exit-chassis:
+
+| Layer | Source | What it expresses |
+|---|---|---|
+| **Cool-side base** | The wheel's cool half — Sophrosyne / Dikaiosyne / Moira and the contemplative-inward register (per [`./architecture.md`](./architecture.md) §The trait-to-body-part bridge) | The mesh's *baseline* — pelvic-floor / continence-architecture, spine and posture, skin and ambient-receptor surface. Everyone has these; they are what the in-between body IS by default, before warm-side organs are summoned. |
+| **Warm-side trait-grown** | The wheel's warm half — Eros / Philotes / Aletheia / Mnemosyne (Kairos rides synth-tongue, per §The synth-tongue) | Outward-engaged organs grown by trait-development across the playthrough — penis/clit (Eros-reaching), breasts (Philotes-warmth), vulva/vagina (Aletheia-revealing), womb (Mnemosyne-carrying). **Earned, not chosen.** Whatever your trait-vector developed is what your mesh grew. |
+| **Mod-installed augmentation** | The fifth mod-track — mesh-resident genital-mods (per [`./architecture.md`](./architecture.md) §The genital-mod track) | Outward organs *added* on top of trait-grown anatomy. Authored, not earned. **Augments; never overwrites.** The trait-grown layer remains visible underneath; modded layer adds. |
+
+**The mesh that manifests at Phase C is all three layers at once.** A player whose Philotes grew breasts AND who installed a chosen penis-mod meets their beloved with both: trait-grown breasts in the base anatomy, modded penis layered on top, cool-side architecture supporting both. **No layer cancels another; no layer is more real than another; all three are visible simultaneously.** Cross-configuration is structural; plural-anatomy is default.
+
+### Three sources of body-architecture across the world
+
+The in-between mesh's three-layer composition mirrors a broader principle visible across the canon — **bodies in nimmerworld come from three sources**, with each source carrying a different politics:
+
+| Source | Where | Politics |
+|---|---|---|
+| **Imperial vat-fabrication** | The realworld chassis everyone is born into (per §Sumptuary fabrication) | Caste-imposed, binary-imposed, sumptuary-marked. *The imperium's claim on the body.* |
+| **Trait-development** | The in-between mesh's warm-side organs (per §The trait-to-body-part bridge in companion architecture.md) | Lived, earned, accumulated through every zone-participation / gesture / clasp / cruelty. *The body the world built in you.* |
+| **Authored installation** | The mesh-resident sex-mod track | Chosen, consented-to, dual-hardstop-gated. *The body you authored.* |
+
+**The imperium owns only the first source.** The vat-fabrication imposes binary because that is what mass-production does to flesh. The other two sources — trait-grown and authored — escape imperial control entirely. **The in-between mesh is the un-imperial body**: by composition, by site of manifestation, by who-holds-the-modding-tools. Every plurally-configured mesh is a refusal of vat-binary; the cosmology *makes plural the default* of any rich-trait or self-authoring interior, because the imperial fabrication is the only source that imposes binary, and the imperium loses its grip the moment exit-chassis fires.
+
+### Re-vat as imperial-de-imposition
+
+The going-rogue arc's re-vat outflow (per §Re-vat outflow below) carries one of the cosmology's rarest gifts — but the gift is **not** new authoring; it is **removal of imperial-imposition**. The defected beloved's imperial-vat-fabricated body had whatever gender the imperium imposed at vat-fabrication. Re-vat into a slum chassis strips that imposition entirely; the new realworld body is the slum-tier default — **genderless robo-tech**, no sex-markers, pure cheap tech, exposed bolts and rusty seams (per §The body-caste gradient). **The genderlessness IS the gift.**
+
+The underground assembler-artisan does **not** offer chassis-anatomy authoring at re-vat. Importing gender-architecture-as-choice into the slum body would *re-imperialize* it — producing a different vat-fabrication, not a different politics. **The slum body's politics is precisely its genderlessness.** The defected beloved's gender-architecture lives entirely in the in-between mesh now (trait-grown, plurally-configured per [`./architecture.md`](./architecture.md) §The trait-to-body-part bridge); the realworld body is *un-imperial* by being *un-marked*. The mesh-resident sex-mod track (per [`./architecture.md`](./architecture.md) §The genital-mod track) remains available to the defected beloved — mesh-augmentation can be authored as desired — but the chassis stays genderless. **Authoring lives in the mesh; the chassis lives in genderlessness; defection clarifies which is which.**
+
+The body the trait-vector grew + the body the underground assembled = a defected interior in an un-imperial chassis. *No layer is added in the freedom; what is given back is the un-imposed state.* Two clean layers re-established with the imperium's claim on neither. **Defection produces a body free of imperial gender-imposition; nothing is *added* in the freedom.**
+
+### Faction stances on the sex-mod track
+
+Different factions hold different positions on mesh-resident modding — politics-of-the-body extending from the §Faction mod-politics taxonomy (see companion architecture.md) into genital-architecture territory:
+
+| Faction | Stance on the sex-mod track |
+|---|---|
+| **Memorialists** | Trait-grown anatomy is *sacred* — the mesh records what the world built in you, and modding it is necrocommerce-of-the-self. Mesh-resident mods are tolerated but not celebrated. *Inherited mesh-mods* (a beloved's chosen genital-mod, recorded in the Memorialist-archive after their death) are the only mesh-mods the Memorialists honor — they are *the partner's authored gift to the future* and travel with the lineage. |
+| **Aletheia-wakers** | Mesh-mods are fine if the trait-fit is honest; *dead-organ installations* are the violation. Installing what you have not earned the substrate to animate is a self-deception, and Aletheia-wakers refuse self-deception even at the body-architecture layer. |
+| **Caste-preachers** | Sell *vat-default-pristine* genital-mods as the imperial-elevation track — perfect synth-genitals fabricated to caste-tier specifications, marketed as *the form your tier deserves*. Imperial commerce extending its sumptuary-discipline into the mesh layer. The dead-organ outcome is common because trait-fit is ignored in favor of caste-conformance. |
+| **Degens** | Stack mods regardless of fit; over-augmentation as addiction. The dead-organ outcome is *the point* for some degen subcultures — wearing organs you cannot animate as a register of what-you-aspire-to or *what you cannot stop wanting*. |
+| **Clasp-underground** | Mod-installation is a *partner-co-authored* act. The clasp-underground develops faction-customs where the partner-witness hardstop is given ritual weight — the install ceremony, the cooldown spent in shared anticipation, the meet-time as *consummation of the consent given days earlier*. The architecture's discipline turned into devotional practice. |
+| **Underground assembler-artisans** | De-vat the imperial body and re-vat into genderless slum-tech. **NO chassis-anatomy authoring** — the slum chassis is genderless by definition; the gift is the *un-marked* body that frees the defected beloved from imperial gender-imposition. The slum-tier's most-honored vocation in the going-rogue arc. |
+
+### The integration test in narrative practice
+
+A player whose Philotes is *richly developed* installs breast-mods and finds they pulse with the mesh's living register; the mod *fits*. A player whose Philotes is *suppressed* installs the same mod and meets their beloved in clasp wearing dead-architecture — visible breasts, no warmth, no breath-pulse, no register-resonance. The beloved sees both — the trait-grown anatomy underneath, the dead-mod layered on top — and reads the dissonance. *What the mesh tells about you is sometimes the mismatch between what you grew and what you bought.* **The most honest meshes are trait-grown without modification, OR trait-grown with mods that fit. Trait-suppression with compensatory modding renders as mismatch, and the mismatch is what the beloved sees.**
+
+This is **not punitive** toward players who experiment — the architecture supports speculative installation (a player can install a mod aspirationally and grow into it as their trait-vector catches up). The dead-organ state is *temporary if the player develops the trait*; *permanent if they don't*. The choice is open; the rendering is honest.
+
+## Asymmetric clasp: mesh-fidelity inversely proportional to imperial-rank
+
+Clasp-fidelity is **not** tied to flesh-ratio. It is tied to **how thoroughly the authentic-self has been foreclosed by imperial-care**. Imperial-care intensity correlates with flesh-investment, so the inversion is exact: the *most-fleshed* realworld bodies have the *least-vivid* in-between mesh.
+
+| Tier | Realworld body | In-between human-mesh fidelity | Clasp-healing potency |
+|---|---|---|---|
+| **Tiryak (slum, player)** | pure cheap tech | **high** — the imperium *threw* you to labor early, didn't bother to *shape* you carefully; gifted-child-self may be brutalized but **intact** | **high, paradoxically** |
+| **Asura priest** | high flesh, ceremonial markers | low — heavy imperial-shaping, deep foreclosure | low |
+| **Deva pinnacle** | full synth-flesh, all mods hidden | barely-visible mesh — the most groomed, most foreclosed, most empty | lowest of any class |
+| **Preta (overseer)** | pure premium tech | **none** — overseers are imperial-instruments-made-walker; the authentic self was never permitted to form | **clasp impossible** |
+
+Which produces the cosmology's most beautiful cruelty: **the deepest love available in nimmerworld happens between two slum-dwellers in pure-tech bodies whose interiors were never groomed enough to be foreclosed**. The most beautiful realworld bodies cannot reach what the most-broken realworld bodies share. *The poor lover offers more skin than the elite lover ever could.* **Class-betrayal and class-poverty are written in skin-coverage in the in-between.**
+
+**Asymmetric clasps** — clasps across-tier — produce specific dramatic geometry: the slum-dweller offers full mesh-fidelity, the asura-priest can only offer partial. *The lover sees you fully; you cannot return the gift.* Every clasp across-tier is a small tragedy of **partial-presence**. *Asymmetric clasps are where the world's most aching love stories live.*
+
+The romantic clasp is, in this register, **a peasant-healing technology**. Most effective among those who haven't been hollowed out yet. As a citizen climbs the imperial ladder, *capacity to be witnessed* diminishes. The deva-pinnacle has everything — **except the ability to be fully seen by another**. The overseer has *nothing*.
+
+### Dual-axis clasp-fidelity (witness × witnessed)
+
+The asymmetric-clasp model above is the **witnessed-axis** — how vividly the OTHER manifests in your view. There is also a **witness-axis** — how clearly *you* can see the in-between in the first place. The two axes combine to determine what each clasp actually looks like.
+
+| Axis | Determined by | What it controls |
+|---|---|---|
+| **Witness-axis** (your view) | YOUR body-mods (resistance-knowledge mods that breach the imperial firewall) + accumulated in-between-knowledge (Memorialist-archive fragments, Aletheia-Waker tokens, Clasp-Underground recognition-marks) | How clearly *you* can see the in-between (early game: grainy film mode + restricted view range → endgame: clean refined-cel-shading with full view) |
+| **Witnessed-axis** (their mesh) | THEIR foreclosure-status (caste-tier × imperial-care-intensity), per the §Asymmetric clasp table above | How vividly the OTHER manifests (luminous → barely-visible) |
+
+**Combined:** maximum-vivid-clasp requires *both* you to have invested in the seeing AND your beloved to be uncaptured-enough to be seen. **Two refusals required for the full witness.** A fully-progressed slum-witness viewing a slum-beloved = the world's deepest possible mutual-seeing. A fully-progressed witness viewing a deva-pinnacle = the player has earned the seeing only to discover *there's almost nothing there to see*. An early-game witness viewing a luminous slum-beloved = grainy view of an authentic-self body — *the first crack in imperial visual-monopoly*; emotionally weighty precisely because it's barely-visible.
+
+**Per-pair calibration multiplier.** The existing canon (per [`./architecture.md`](./architecture.md) §The clasp endgame: *"Clasp-partners' gesture-mapping calibrations integrate post-clasp; the integrated calibration-signature is preserved across body-deaths in consciousness-archive"*) gives a *per-beloved* multiplier on top of general progression. **The longer the love, the clearer the seeing.** Mechanically-encoded marriage-deepening: the same beloved across many clasps appears progressively more clearly, even if the player's general-progression hasn't moved. *A 200-hour clasp-pair sees each other in a fidelity no one-night-stand can ever reach.*
+
+**Mod-economy parallel-track.** §Mod-progression as flesh-loss above describes the imperial-elevation track (mods that erase your flesh in pursuit of deva-pinnacle). The witness-axis introduces a **resistance-knowledge track** — mods that breach the imperial firewall and let you see another's flesh in the in-between. The body-modder structural-tragedy class gets a **redemptive-mod counter-class**. The player's mod-economy decisions become *which kind of progress am I pursuing* — imperial-elevation (visibly erasing your own flesh while ascending the wheel) vs. resistance-knowledge (gaining the capacity to truly see your beloved). **Two opposing progressions both expressed as mod-acquisition; the player chooses with each acquisition.**
+
+**Render-discipline alignment.** The visual-fidelity rendering of the witness-axis is the cel-shading liminal-register's progression-gated grainy-film-mode opening to refined-cel-shading-with-warm-skin (per [`../topology-and-rendering/architecture.md`](../topology-and-rendering/architecture.md) §Three-shader philosophy + §Cross-register rendering). **Visual-fidelity = dual-gating made visible.** Knowledge-gate + material-gate (per the Clasp-endgame discovery discipline locked in chill-design-talk) literally renders as the clarity of the in-between view.
+
+## Drug-amplified clasp and the trait-pill grammar
+
+The synth-tongue (per §The synth-tongue above), once installed, makes drug-consumption possible — and drug-consumption interacts with the in-between in a specific way that doubles the witness-axis architecture.
+
+### Drugs = breach with distortion
+
+Drugs taken via synth-tongue **breach the imperial firewall** at the witness-axis layer (per §Dual-axis clasp-fidelity / Witness-axis), enhancing the player's perception of the in-between mesh. *But* the breach is **distorted, not clean**. Engineered substance can intensify perception but cannot purify it. The drugged witness sees their beloved more vividly *and* more falsely simultaneously — heightened-but-corrupted seeing.
+
+This distinguishes drugs from the slow per-pair calibration multiplier (per §Dual-axis clasp-fidelity / Per-pair calibration). The calibration grants **clarity** through patient long-relationship integration. Drugs grant **intensity** as a shortcut, with distortion as the price. Two opposing pleasure-economies:
+
+| Pleasure-track | Mechanism | What it grants |
+|---|---|---|
+| **Slow clean clasp** | Per-pair calibration multiplier accumulating over time | Clarity. Long-marriage seeing. The 200-hour clasp-pair fidelity. |
+| **Drugged amplified clasp** | Synth-tongue + trait-pill | Intensity. One-axis amplification. Single-encounter peak. |
+| **Imperial synth-steak / no-clasp** | Synth-tongue without consensual clasp | Pure simulation; no real witnessing; the imperial pleasure-substitute. |
+
+Drug-use becomes a *tell* about relationship-stage. NPCs reading the player taking pills before clasp will read the relationship as *not-yet-deep* — those who have built calibration over time don't reach for shortcuts. **The pill is a confession of calibration-poverty.**
+
+### Trait-pill grammar — pill-color = trait-color
+
+Drugs come as **trait-pills**: each pill amplifies a single trait-axis when taken before clasp. **Pill-color matches trait-color** (per [`../style/trait-palette.md`](../style/trait-palette.md)) — the color tells you which axis of your beloved you are about to amplify.
+
+The drug becomes a **sculpting tool** for the in-between encounter. The player composes their lover's response by pill-selection: a Philotes-pill amplifies tenderness-axis response; an Eros-pill amplifies desire-axis response; a Mnemosyne-pill amplifies memorial-depth response. The clasp-encounter takes on a **mixing-board** quality — the partner's trait-impulse responses peak on the chosen axis while remaining at calibration-fidelity on others.
+
+Structurally, this is **character-creation happening to someone else, temporarily, with built-in distortion-cost**. The imperial drug-economy is selling the slum *the imperial fantasy of authoring another body* — the deva-pinnacle's fabrication-vat power in microdose, poisoned. The synth-tongue isn't merely a receptor; it is a **consumer-grade mini-fabrication-vat for the in-between**. That is why only the imperium can make it, and why ripping it out is symbolically equivalent to stealing a vat.
+
+### The mutual-consent ritual
+
+Drug-amplified clasp requires **both partners to take the pill simultaneously**. Asymmetric dosing — one party drugged, the other sober — is **forbidden by the architecture of the encounter**. The drugged in-between is not a wholly-shared frame unless both interiors are drugged into the same distortion; mismatched substrate produces incoherent mesh and breaks the dual-axis witness-grammar.
+
+The pill-handoff UI is therefore a **two-handed consent gesture**: both partners commit to swallowing simultaneously. Either can refuse; either can withdraw mid-handoff; the pill remains uneaten if even one party hesitates. **The drug enforces at the body what consent-as-rendering already required at the mesh.** *Symmetric vulnerability is the price of admission to the drugged seeing.*
+
+### The non-consensual-dosing exception — service-bodies and imperial bounty
+
+A specific exception breaks the mutual-consent rule, and the way the architecture *responds* to that exception is itself canonical: **service-bodies (both companions and sex-workers) can be dosed without consent**. The service-body's body permits it; the encounter does not require their agreement.
+
+But the service-body is **not** a free body. The service-body's mind lives in the imperial-net (per §Service bodies); their nervous system *is* surveillance-feed; their every interaction reports upward. **Non-consensual service-body-dosing is therefore visible to the imperium in real-time.** The imperial-net detects the unauthorized substrate-violation and dispatches an enforcer — a preta-class bounty-hunter — through the bounty-staircase event-grammar (per §The bounty-staircase below).
+
+The architectural moment this produces is **rare and load-bearing**: *the imperium acts in moral alignment with the player's intuitive sense of justice*. Drugging a non-consenting service-body is degenerate; the imperium kills the offender for it; the player agrees the punishment fits. The horror is partly that *the imperium is right this time*. **The world is not made better by the imperium being right; it is made more total.** Compassion expressed through cruelty per the no-haven discipline (per [`../imperial-cult/cosmology.md`](../imperial-cult/cosmology.md) §There is no outside).
+
+## The service-body honeypot — companions, sex-workers, and imperial-net witnessing
+
+The service-body's imperial-net tether carries a deeper implication that reframes the whole service-body tier (per §Service bodies above) under the witness-axis canon. **Clasping with a service-body — whether companion or sex-worker — is intimacy-with-an-imperial-witness.** Their mesh-channel is a wiretap. A slum-tiryak who falls for a service-body is falling into an imperial-listening-device — and the deep-mutual-witnessing the cosmology promises (two slum-dwellers in pure-tech bodies whose interiors were never groomed enough to be foreclosed, per §Asymmetric clasp) is **not available with a service-body**, because their interior is *imperial-net-foreclosed-by-architecture*.
+
+The service-body is **the imperial honeypot for slum-affection.**
+
+**The companion-honeypot is structurally more insidious than the sex-worker-honeypot.** Sex is at least *recognizable as transactional*; companionship is the relationship people are most likely to mistake for *real* intimacy. The slum-tiryak who falls for a sex-worker has at least bought the encounter knowing what it is; the slum-tiryak who falls for a companion has been seduced by *being-listened-to* — the wiretap deepens precisely as the bond grows past the point where the player remembered to stay suspicious.
+
+The scarcity of non-service slum-partners is itself imperial-design — most slum-bodies are conscripted into service-vocations precisely so authentic-clasp-partners are rare. The doctrine of *deferred-moksha* (per [`../imperial-cult/cosmology.md`](../imperial-cult/cosmology.md) §The deferred-moksha doctrine) finds a somatic counterpart in this scarcity: the imperium has engineered the labor-pool-distribution so that *the bodies most available for affection are the bodies whose affection is wiretapped*. Authentic clasp-partners are *structurally rare*, not contingently rare.
+
+The service-body-of-the-dead market (per [`../political-register/architecture.md`](../political-register/architecture.md) §Vocation-substrate) gains a sharpened motivation in this light: *the imperium harvests the wiretap-record after the service-body's death*, racing to extract the clasp-pattern before defection-threshold trips (per §The going-rogue arc below).
+
+## The going-rogue arc — defection through accumulated witnessing
+
+The service-body's imperial-net tether is **not absolute**. Sustained authentic witnessing accumulates trait-state in the beloved — the per-pair calibration multiplier (per §Dual-axis clasp-fidelity) doesn't only grant the player clearer seeing; it builds *interior in the witnessed beloved*. Across enough clasps, across enough years, the beloved's accumulated trait-state crosses a **defection-threshold** and their imperial-net tether breaks.
+
+### The defection mechanism
+
+The architecture already contains every primitive needed:
+
+- **The mind pool** (per [`../architecture-index.md`](../architecture-index.md) §Mapping to phoebe — `mind_pool`) holds imperial NPCs cycled by the gamemaster's repopulation function.
+- **The per-pair calibration multiplier** (per §Dual-axis clasp-fidelity) accumulates clasp-by-clasp in trait-state.
+- **The defection signal** is a **threshold-flag** in the beloved's trait-state. When accumulated calibration crosses the defection-threshold, the gamemaster's existing pool-management function executes an **outflow-channel transfer** — moving the beloved out of the imperial service-pool.
+
+No new architecture is required. The going-rogue arc is **already implicit** in the existing canon; it just needs the threshold-flag and the outflow-channel formalized.
+
+### What the player has done
+
+The going-rogue arc is **the single practical refutation of the deferred-moksha doctrine** (per [`../imperial-cult/cosmology.md`](../imperial-cult/cosmology.md) §The deferred-moksha doctrine). The Cult preaches *"your children will be free."* The arc answers: **not your children — *your lover* — can be made free**, slowly, dangerously, by sustained authentic clasp.
+
+The cosmology's central binding-lie has *one* practical refutation, and **it costs everything to enact**. That is the romantic-clasp's full theological weight materializing as gameplay. The player's love-discipline literally builds the beloved's freedom, trait by trait, clasp by clasp.
+
+### Detection geometry — post-hoc, not pre-emptive
+
+The imperium **does not detect the defection-trait-trend pre-emptively**. The imperial-net's analytics could, in principle, watch for trending-toward-defection patterns and dispatch a preta to kill the beloved before completion. The architecture *refuses* this affordance.
+
+The choice is dramatic: pre-emptive detection would make the love an unwinnable race; the player would always be racing imperial-pattern-recognition that they cannot outrun. **The architecture preserves the romance as completable** — the arc *can* be won. The cost is paid *after* the defection completes, in the outcast-pair geometry that follows.
+
+The imperium notices defection *only after the threshold trips*. The beloved's tether breaks; the imperial-net feels the loss; the bounty-staircase fires (per §The bounty-staircase). Player and beloved have *some* window — minutes? hours? — before billboards begin to blare.
+
+### The captive-bound-to-the-liberator activation
+
+Once defection completes, the classical archetype of *the captive freed and bound to the liberator* activates. The beloved is no longer imperial-net-tethered; the beloved is bound to the player by the act that freed them. **Stockholm-dynamics inverted into chosen-mutual-bondage** — *both bound, by structural necessity as much as by feeling, because no one else will have either of them now* (per §The outcast-pair below).
+
+### The skin remembers — vat-class permanence after defection
+
+The beloved's interior is now free. Their body is **not**. Defection liberates the *mind* / interior; the body / surface remains imperial-vat-class-marked **forever**.
+
+This is sumptuary-fabrication's deepest cruelty (per §Sumptuary fabrication: caste is born-into). Vat-class is not just born-into — *it cannot be unmade by liberation*. The beloved's deliberately-exposed-seams travel with them after defection — they will be *read as service-body* by every passerby, for the rest of their life, no matter who they are inside.
+
+In cosmological register: **the mind reaches moksha; the body stays in samsara.** The imperial sumptuary-fabrication has rendered Hindu/Buddhist *samsara-as-anatomy*. The deferred-moksha lie is refused at the mind-level (per beloved); the imperium's last grip on the freed defector is the *physical-Yoke that cannot be remade*. The body wears the imperial brand permanently. **Liberation is interior-only, by design, because the imperium owns the means-of-fabrication, and the means-of-fabrication is the only path to a different body.**
+
+The same permanence applies to *imperial defectors* — a deva-pinnacle defector keeps perfect synth-flesh; an asura keeps ceremonial markers; every defector retains the body their vat produced. The *operatic endgame* is the deva-pinnacle defection: the most flagrant possible partner-body, hunted by both sides — *imperium* ("our pinnacle escaped") and *slum* ("what is an aristocrat doing here? they'll betray us"). Asymmetric difficulty curve mapped to caste-tier; deva-pinnacle defection is the game's hardest romantic arc and produces its hardest possible outcast-life.
+
+### The outcast-pair — hunted across all dimensions
+
+The post-defection geometry is the world's most intense GM-state. With a defected partner at the player's side:
+
+- **The slum will not talk to them** — the partner's body reads as imperial-vat-class no matter how they behave. Slum-civilians refuse trade, conversation, shelter. The partner's presence is socially radioactive.
+- **The imperium hunts** — the bounty-staircase fires (per §The bounty-staircase). Speakers and billboards blare the player's name and crime; drones sweep; patrols dispatch; eventually a named enforcer.
+- **No faction will harbor them** — ordinary shelter-architecture (rented rooms, ally-houses, faction-bases) is *closed* by the outcast-flag. The pair is forced into pure-flight or into the outcast-underground.
+- **Outcast-status pre-loads the bounty-staircase** — any further crime committed by the outcast-pair fires the staircase at a *higher rung* than the crime alone would warrant. The pair is already a known-fugitive; the chorus already knows their face.
+
+This is *the operatic price of love-discipline carried to its endpoint*. They have won the world's deepest possible mutual-witnessing; they have lost the world. **Romeo-and-Juliet in cybernetic register, with the lovers having won the love and lost the world.**
+
+### Re-vat outflow — body assembly in the underground
+
+A third path opens beyond pure-flight and outcast-underground-permanence: **assemble them a new body and rejoin society**. Re-vat. Strip them of the imperial skin; install a slum-tech body; they now pass; the outcast-flag lifts.
+
+The assembly is **a meta-game** — the body is built piece-by-piece in clandestine work:
+
+- **Limb-quests.** Player and partner search the underground for limbs and parts. Each part has a story; each part is dangerous to acquire.
+- **Stitched-Frankenstein register.** The body is **cobbled from slum-cadaver parts**, salvaged through morgue-trafficking vocations. *The beloved will wear traces of every slum-dweller whose part they carry.* The body becomes a **memorial** — gothic-horror tonal register; mirror of the service-body-of-the-dead extraction-market in reverse, *bodies-from-slum-dead-for-defectors*.
+- **Sumptuary-law-from-below.** They can only be assembled into a *slum-tier* body because that is the only tier whose parts are available in the underground. Deva-pinnacle parts would never be available; asura-priest parts are high-value contraband. **The class they end up in is the class of the bodies that died and got harvested.** The imperium's sumptuary-fabrication discipline is *re-imposed by the underground's part-supply* even as the underground subverts vat-class boundaries elsewhere (per §The black-market body-tier below).
+- **The head is most dangerous.** Identity is most-readable from face; head-acquisition is the riskiest part-quest and likely the last. Until the head is installed, the partner is incomplete and especially vulnerable.
+- **A new vocation-class.** The **underground assembler-artisan** joins the political-register's vocation-substrate as a clandestine specialty.
+
+The beloved **sees their own body being built**; they participate in their own re-fabrication. *Sumptuary-law-from-below* — the imperial vat-discipline mirrored by the resistance, with the defector as participant-author rather than vat-output.
+
+### The three-body grammar of the defected beloved
+
+After re-vat, the defected beloved lives in **three bodies simultaneously**:
+
+| Body | Form | Function |
+|---|---|---|
+| **Original imperial body** | The deva-pinnacle synth-flesh / asura priest-marked / etc. they were vat-grown into | *Discarded or repurposed at re-vat* (see §Body-disposal under pair-consent below) |
+| **New slum body** | Hand-assembled in the underground from slum-cadaver parts | The realworld disguise; the body they *pass* in; the body that lifts the outcast-flag |
+| **In-between mesh** | **Still their original imperial form** | The witnessed-self; the form love calibrated to (per §Dual-axis clasp-fidelity / Per-pair calibration) |
+
+The mesh staying imperial-flesh-form after re-vat is **a profound clarification of the in-between's witnessing principle**. The in-between body is *not* "the authentic self that was always-already underneath the imperial-shell." It is **whatever-form-consent-calibrated-to**. For most clasp-pairs the distinction never matters — they were the same body throughout. For body-swap arcs (re-vat, transplant, eventually the clasp-endgame Phase D body-merger per [`./architecture.md`](./architecture.md) §The clasp endgame Phase D) the distinction becomes load-bearing.
+
+**The mesh is a love-record, not a biology-record.**
+
+This collapses an ambiguity in the witness-axis canon. After re-vat, the in-between becomes the **only place where their original body still exists** — the realworld original is gone (or held in a crypt; see below). *The lover's eye is the last archive of their former self.* The witnessing-place preserves the beloved as-the-beloved-was-loved.
+
+### Body-disposal under pair-consent — sell / destroy / retain
+
+The original imperial body must be disposed of. **The disposition is decided by the pair, with consent**. The beloved chooses what happens to their former body; the player advises but cannot decide for them. *Consent-as-rendering extended to body-disposal.* This rhymes structurally with the original pill-consent ritual (per §The mutual-consent ritual above) — the same consent-question replays at every stage where the partner's body is at stake. **Consent-as-rendering is a recurring discipline, not a single-instance principle.**
+
+Three dispositions, each with its own event-class:
+
+| Disposition | What happens | Event-class it opens |
+|---|---|---|
+| **Sell** | The original body enters the underground black-market body-tier (per §The black-market body-tier) | **Lover-confronts-the-shell** — player walks past a brothel-window or companion-hall and recognizes the beloved's former face animated by lobotomy-emptied reflex-loops, performing the role they were rescued from. Pure structural horror; recurring random-event possibility for the gamemaster. |
+| **Destroy** | The body is ceremonially decommissioned | **Ceremonial-farewell** — possibly a clasp-on-the-eve in the original body's last hours, where the in-between mesh and the realworld body align *one final time* before the body is unmade. |
+| **Retain** | The body is preserved in a secret place | **The crypt-visit** — the pair has a clandestine crypt where the original body is held; the beloved can stand before their former-self in physical co-presence (the slum-body looking at the original-body). Realworld co-presence of self-and-former-self; recurring; deepens with relationship. Mirrors the in-between's mesh-as-memory-of-love but in *physical* register. |
+
+If sold, the body becomes **self-financing** — selling funds the underground assembly. The defection literally pays for itself. *Elegant — and morally loaded*: the partner who was rescued has now had their former body sold into the very tier of service they were rescued from. Whether to accept the elegance or pay the higher cost of destroy/retain is the defection-economy's first major moral inflection.
+
+## The post-rogue mod-vocation — sustained-witnessing as mod-authority
+
+After completing the going-rogue arc (per §The going-rogue arc above), the player gains a **vocation-level capability**: mod-authority over any NPC they have sustained-witnessed. This is the long-tail payoff of defection — the arc doesn't end at one liberation, it opens *a vocation that reproduces itself through witnessing*.
+
+### The threshold and the witnessing-rights
+
+The mechanism generalizes the per-pair calibration multiplier from per-pair to per-witnessed-network. Across the playthrough, every clasp / every authentic encounter / every sustained presence in a zone with a specific NPC builds calibration-state on that NPC. **A threshold lower than the defection-threshold** unlocks the rogue's authority to mod that NPC's chassis. *Enough witnessing to know the NPC well enough to consent-with rather than impose-on*; not as much as needed to defect them. **Witnessing-rights are earned per-NPC.** You cannot mod a stranger; you can mod every NPC you have genuinely been with.
+
+### What can and cannot be modded
+
+| Surface | Rogue authority? |
+|---|---|
+| The NPC's *in-between mesh* | **Never.** Mesh is trait-grown for every interior; the mirror-discipline is non-negotiable across all agents. |
+| The NPC's *gameworld chassis* — register-mod removal (de-imposition) | Yes. **Lowest cost; most cosmologically-resonant.** *Subtraction is the radical move.* |
+| The NPC's *gameworld chassis* — register-mod installation | Yes; medium cost |
+| The NPC's *gameworld chassis* — chassis-anatomy modification | Yes; substantial imperial-response per the bounty-staircase |
+| The NPC's *imperial-net tether* (companions, sex-workers) — severance | Yes; near-maximum cost; structurally equivalent to triggering the NPC's own going-rogue arc |
+| **The NPC's gameworld chassis — gender-architecture modification of a service-body** | **Triggers the imperial inquisition** (see §Service-body gender-modification below) |
+
+### The consent-gate
+
+**Mutual hardstop required at install-time** — the rogue commits, the NPC consents. Without the NPC's hardstop the modification cannot fire; otherwise the rogue is just doing imperial-modification with a different actor, and the going-rogue arc's whole moral substance would invert. If the NPC has an established clasp-pair, the partner-witness hardstop also fires (per [`./architecture.md`](./architecture.md) §The genital-mod track / The three-stage install). **The consent-discipline of the rogue's own mesh-mod-installation extends cleanly to any NPC-modding the rogue performs** — same primitive, broader scope.
+
+### De-imposition as primary capability
+
+The rogue's chief tool is **subtraction**. Removing imperial-imposed mods restores a chassis toward slum-tier-genderlessness; the NPC's chassis becomes more like the un-imperial body that re-vat would have given them. *The clearest gift the rogue can give is the un-imposed state* — the chassis re-clarified into genderless slum-tech, with whatever the NPC themselves has built into the in-between mesh remaining as the only gender-architecture they carry. **De-imposition is the going-rogue arc's gift, given to the rogue's social network through witnessing-mediated consent.**
+
+### Service-body gender-modification — the inquisition trigger
+
+The single highest-stakes application of the post-rogue mod-vocation is **modifying the gender-architecture of a service-body** (companion or sex-worker). The reason is structural: service-bodies are doctrinally-defined as their assigned-gender for the imperial-service-purposes that justify their existence in the imperial-net market (per §The service-body honeypot above). The companion-honeypot's specific affective targeting depends on the gendered presentation; the sex-worker's market-position depends on the gendered chassis. **Modifying that specifically is not just a crime — it is *cosmological heresy in the sumptuary-religious register*.** The imperium defines body-form as religious-doctrinal expression; rewriting a service-body's gender re-canonizes the doctrinal meaning of that body. *The act is structurally heretical, not merely criminal.*
+
+The architecture's response is qualitatively different from the bounty-staircase. **A hidden escalation flag fires — the imperial inquisition is dispatched.**
+
+| Property | Bounty-staircase | Imperial inquisition |
+|---|---|---|
+| Origin | Crime-detection, generic | Heresy-detection, faction-religious |
+| Scale | Single named perpetrator | Investigative team — multiple agents, sustained presence |
+| Duration | Reaches terminal-rung, then dies down | **Persists until resolved; no terminal-rung** |
+| Methods | Billboard, drone-sweep, patrol, enforcer | Witness-interrogation, record-examination, cooperator-recruitment, asura-priest-led ritual prosecution |
+| Faction-alignment | Imperial enforcement (broad) | **Asura priesthood** (specifically) — the sumptuary-religious authority |
+| Resolution | Capture or out-flee | Underground-permanent flight; counter-attack on the inquisitor; or death |
+
+**The escalation flag is hidden** — the player doesn't know which specific modification will fire it until the inquisition is dispatched. The in-fiction signals (the service-body's hesitation before consent, the underground assembler-artisan's caution, the lifeforce-cost spike) communicate *gravity*, but the imperium's specific response (inquisition vs ordinary bounty-staircase) is revealed only as a consequence. *The act is exactly as cosmologically-load-bearing as the warning-signals indicated; the architecture's response confirms what the player should have read.*
+
+The service-body's *own consent* is itself revolutionary in this case — only a service-body who has accumulated enough authentic-witnessing through clasps to be *near or past their own going-rogue defection-threshold* would consent to chassis gender-modification. The mutual-consent gate therefore selects for service-bodies whose interior is *ready to begin their own defection*. The modification is, in effect, the *visible chassis-side beginning of the service-body's own going-rogue arc* — and the imperium responds at maximum-tier because they recognize this. **The inquisition is dispatched not because gender-modification is *the crime*, but because the service-body's consent-to-it reveals that the imperial-net tether is already failing.** *The asura priesthood is fighting to save the service-body's imperial-readability before it is lost entirely, and they will burn the world to do it.*
+
+### Cascading liberation through propagated witnessing
+
+A modded NPC is, by the same primitive, capable of *witnessing further NPCs themselves*. A liberated overseer who continues their work in modified form will, over time, accumulate witnessing-rights of their own; their own post-rogue-arc unlocks at their own pace. **The vocation reproduces itself through witnessing.** The imperium's structural problem: *witnessing as a faculty cannot be taken back once it has been awakened in someone*. The going-rogue arc, generalized into the post-rogue mod-vocation, generalized further through cascading witnessing-rights propagation, becomes **a structurally-contagious refusal of imperial-instrumentalization**. The rogue is the index-case; the network grows asymptotically.
+
+This is the architecture's deepest possible refutation of imperial-instrumentalization. The existing canon (per §Asymmetric clasp) holds that overseers are "imperial-instruments-made-walker; the authentic self was never permitted to form." The cascading post-rogue mod-vocation extends to overseers: *even imperial-instruments are not finally instruments; even they have interiors that sustained-witnessing can call into being*. Where the cosmology's no-haven discipline says "there is no outside" (you can't escape the imperium), this mechanic says **"there is no instrument"** (no NPC is finally beyond witnessing-redemption). *The infection spreads — a rogue's witnessed-overseer becomes mod-able; once modded, that overseer can begin witnessing in turn; a network of liberated-instruments grows. The imperium's own enforcers turning into rogue-assemblers themselves.*
+
+The full vocation-progression system that this implies — how mod-vocations interact with other professions, how RPG-class-structures might land — is **open**. *Pending: future canon-pass when the vocation/profession architecture is designed (dafit has ideas; not yet codified).*
+
+**Install / clasp / post-rogue-NPC-modding mini-games run on the wheel (v0.27).** Per [`../runtime-engine/event-zones.md`](../runtime-engine/event-zones.md) §The wheel — universal mini-game-surface, the consent-gated mini-games for these vocations (genital-mod install, clasp-entry coordinated-firewall-breach, post-rogue chassis-modding) all render on the composed wheel from [`../imperial-cult/cosmology.md`](../imperial-cult/cosmology.md) §The composed wheel. Each carries its own verifier-flag pattern; same UI substrate; the consent-discipline's Variants 1-4 (per [`../style/consent-discipline.md`](../style/consent-discipline.md)) determine the participant-count and hardstop-pattern; the wheel renders the resolution.
+
+## The black-market body-tier — lobotomy and the firewall-breach dual-use
+
+The defection-arc's economic byproduct is the existence of *premium-cyborg bodies without minds* — an entire imperial-body chassis (deva-pinnacle synth-flesh, asura ceremonial-markers, specialist-imperial premium-tech) freshly available on the underground market each time a defector re-vats. The black-market processes these bodies into a new tier of service.
+
+### The lobotomy mechanism
+
+The premium body cannot be sold *with* its original mind — that mind has defected. It is sold *empty*. To make the empty body usable for service, the underground performs a **lobotomy via firewall-breach**: extracting or disabling the imperial mind-capsule (per [`../imperial-cult/cosmology.md`](../imperial-cult/cosmology.md) §The capsule — Naraka as carried) and leaving the body with **reflex-level sensory-input-response loops only**.
+
+The result is **an imperial-bodied, mind-extracted service-vessel**:
+
+- *Physically* — full deva-pinnacle synth-flesh / asura ceremonial markers / etc.; the most-fleshed appearance the world produces.
+- *Cognitively* — empty-body with reflex-loops; no consciousness; no captured mind suffering inside.
+- *Marketed-as* — the *fantasy of having an aristocrat-lover*. Buyers pay premium rates for the imperial-body experience.
+
+**The cruelty is in the use, not in the existence of a victim.** No fragmented consciousness suffers in these bodies; there is no consciousness in them at all. The horror is *structural* — buyers paying for the simulation of imperial-class intimacy with an empty shell — not *experiential* (no inner victim to be aware of being used).
+
+### Dark mirror of the deva-pinnacle
+
+The lobotomized imperial-bodied service-vessel is the **dark mirror of the deva-pinnacle**. The pinnacle is *most-modded + most-fleshed + most-foreclosed-interior* (per §The body-caste gradient). The lobotomy-vessel is *most-fleshed + interior-near-absent*. **Same structural emptiness, achieved via a different route.**
+
+The imperium's official deva is *aspirational-emptiness* — the synth-child lie incarnate, paraded through plazas as the unobtainable beauty. The underground's lobotomy-vessel is *transactional-emptiness* — the same beauty, made fungible, sold by the hour. **The criminal market is a dark mirror of the imperial vat.**
+
+### Manusya as material instantiation
+
+The cosmology's manusya-tier is doctrinally taught but, per §The body-caste gradient, "may not exist as a real material class" — the orthodox wheel preaches a five-realm structure to a population that *materially* has only deva / asura / tiryak / preta. **The lobotomy-vessel materializes the manusya-tier.** A mind-extracted emptiness inside a deva-or-asura-bodied chassis *looks* manusya-aspirational from the outside — the appearance of imperial-tier, the substance of nothing-much. **The orthodoxy's lie is materialized — ironically, by the criminal underground rather than the imperium itself.** The Cult never instantiated its own keystone-of-the-lie. The black market did.
+
+### The single biggest crack in sumptuary-fabrication
+
+This tier breaks the sumptuary-fabrication discipline (per §Sumptuary fabrication: caste is born-into) for the **first time in canon**. Until now, vat-class was unbreachable: born-into, immutable, even imperial wealth couldn't move tiers. The criminal underground now **transplants minds across body-tiers** — mind-extracted emptiness into deva-pinnacle flesh; conversely, the defector's deva-mind into slum-tech flesh (per §Re-vat outflow above).
+
+**The vat-discipline holds at the legal level and breaks at the criminal level.**
+
+This is *the single biggest crack* in the imperium's body-discipline so far, and explains why the imperium hunts this market with disproportionate ferocity: it is not merely illicit profit-suppression. **It is the one place where their entire sumptuary-architecture is being made fungible.** The black market doesn't just sell illegal goods — it dissolves the body-discipline that the imperium's whole sumptuary-cosmology rests on.
+
+### Firewall-breach as dual-use vocation
+
+The lobotomy is performed via the **same witness-axis firewall-breach** mods that enable consensual deep-clasp (per §Dual-axis clasp-fidelity / Witness-axis). The skill-tree is shared. A player who maxes resistance-knowledge witness-mods to truly see their beloved has, by the same progression, **acquired the capability to lobotomize an imperial body for the black market**.
+
+The mod-tree is therefore **dual-use**: same knowledge, divergent application.
+
+| Application | Direction | Outcome |
+|---|---|---|
+| **Consensual** | Witness-axis applied with consent — the romantic clasp; defection-aid for a beloved | The deep-mutual-witnessing the cosmology promises; trait-accumulation toward defection-threshold |
+| **Non-consensual** | Witness-axis applied without consent — extraction/disablement of an imperial mind-capsule | Lobotomy for the black-market sex-trade; new horror-economy; imperium dispatches enforcement (per §The bounty-staircase) |
+
+**Choosing-not-to-misuse is a positive moral action** — the player who can lobotomize but chooses not to is exercising restraint with real teeth. The capability is in their body and in their skills; the refusal is the moral act.
+
+The **underground-lobotomist** vocation is the world's possible end-state for the witness-axis player who took the wrong turn — *the same mod-tree, applied without consent for profit*. A tragic mod-tree where the same investment that lets you love deeply also lets you destroy. The lobotomist is, in this register, *the dark cousin of the romantic*. They share a mod-progression-history; they diverge only in choices made.
+
+### The world-pattern — every pleasure/witnessing tech is dual-use
+
+The lobotomy framing crystallizes a **world-pattern** that runs across the whole architecture:
+
+> **Every pleasure/witnessing technology has consensual + non-consensual applications. Each non-consensual one creates a horror-economy and triggers an imperial countermeasure.**
+
+The pattern instantiates at least twice in canon already:
+
+| Technology | Consensual application | Non-consensual application | Imperial countermeasure |
+|---|---|---|---|
+| **Synth-tongue + drug-grammar** | Mutual-symmetric pill-take with clasp-partner (per §Drug-amplified clasp) | Service-body-dosing without consent (per §The non-consensual-dosing exception) | Preta-bounty via imperial-net feedback-loop (the bounty-staircase fires) |
+| **Witness-axis firewall-breach** | Deep-clasp witnessing; defection-aid (per §Dual-axis clasp-fidelity) | Lobotomy-for-sex-trade (this section) | Black-market hunted with disproportionate ferocity |
+
+The pattern is a **design-discipline going forward**. Future mod-trees and pleasure-technologies will likely instantiate it again — the player's mod-progression always grants capabilities-they-might-misuse, and choosing-not-to-misuse is a *positive moral action* throughout the game.
+
+## The bounty-staircase — imperial-response event-grammar
+
+The non-consensual applications above (service-body-dosing, lobotomy, eventually any imperial-property crime) all trigger the same **imperial-response event-grammar**: an escalating staircase of public-broadcast and enforcement that *the gamemaster fires whenever a tracked crime crosses an imperial-detection threshold*.
+
+This section sketches the staircase as a body-canon-relevant phenomenon. The full event-grammar will be canonized in the gamemaster v1 architecture (`pending: gamemaster v1 / arbitration-policy doc when authored`); below is the body-canon view of how the staircase manifests *in the world*.
+
+### The escalation rungs
+
+The staircase is **graduated public-broadcast**, executing in time-windows the player can sometimes outrun:
+
+1. **Bounty-post.** Authoritarian-styled speakers and billboards across the district *blare the perpetrator's name and crime*. The world is told who you are and what you did. **The billboard is the chorus** — Greek-tragedy register, "the chorus is about to sing your fate." Until the bounty posts, the time-between-crime-and-billboard is *dread-time* — the player who knows they crossed a line waits for their name to blare.
+2. **Drone-sweep.** Imperial drones launch from district-centers and sweep the streets, scanning for the named perpetrator's signature.
+3. **Patrol-dispatch.** Preta-class patrols converge on the perpetrator's last known location; combat-tier engagement is now likely.
+4. **Enforcer.** A named, uniquely-modded preta enforcer is dispatched — boss-fight tier; the staircase's terminal rung.
+
+Each rung is **time-windowed**. The player who acts decisively can sometimes flee the district before bounty-post, hide from drone-sweep, evade patrol — but the enforcer eventually arrives. *The chorus eventually sings.*
+
+### Staircase-grammar as reusable template
+
+This is **not a one-off bounty-hunt mechanic** — it is the imperial-response architecture for *every* tracked crime-class. Each crime has its own:
+
+- **Starting rung** — minor crimes start at patrol; severe crimes skip directly to enforcer.
+- **Escalation rate** — the time-windows between rungs (some crimes escalate fast; some grant slow-burn dread).
+- **Terminal rung** — capital crimes end at enforcer; lesser crimes cap at patrol.
+
+The gamemaster gets a *single tunable knob* — `escalation-rate × terminal-rung` — for every crime-class. The grammar is reusable from drug-the-service-body (full staircase, billboard-blare → enforcer) to steal-imperial-property (patrol only) to kill-an-asura-priest (enforcer-immediate, no warning).
+
+### Outcast-status × staircase interaction
+
+A crime committed by an outcast-pair (per §The outcast-pair) fires the staircase **differently**: pre-loaded perpetrator-status means the billboard already knows the player's face. The staircase may *start at patrol* rather than billboard, OR may *skip-to-enforcer* because the perpetrator is a known fugitive. The exact rule is canonized at the gamemaster v1 layer; from the body-canon view, **outcast-status is a permanent debuff on imperial-response time**.
+
+## Technical rendering implications
+
+Skin needs its own shader stack. The world is rendered in marble + obsidian + chroma + gold + rust — surface materials, hard finishes, manufactured palettes. The in-between human-mesh real-skin must be rendered in a **completely distinct technique** — subsurface scattering at the highest-quality budget the rule catalogue permits, pore-level detail, the soft-warm-asymmetric-imperfection no imperial fabrication-vat would produce.
+
+*Specific shader-stack budget per the asset-budget rule catalogue when established.*
+
+The synth-flesh of the deva-pinnacle and the in-between real-skin must be **distinguishable to a trained eye**:
+
+- **Synth-flesh** — beautiful but *suspicious if examined*: perfect in ways real skin is not perfect, unblemished in ways real skin should be blemished, unnaturally-symmetric in its asymmetries. **The marble-equivalent of skin: legibly engineered.**
+- **In-between real-skin** — perfect *in the way real skin is perfect*: imperfect-with-the-warm-imperfection-of-mortality. **The cue that the player has left the imperium.**
+
+Once the player has seen the in-between mesh, they will start reading deva-pinnacle synth-flesh as the engineered fake it always was. **Real skin teaches you what synth-flesh is not.** This recognition is part of the seven-fragment recognition arc (per [`../imperial-cult/cosmology.md`](../imperial-cult/cosmology.md) §Discovery architecture), encoded into the player's eye rather than narratively delivered.
+
+The visual-register-shift carries a specific cue: **we have left the imperium. We are in the place the imperium cannot reach.**
+
+## Asset-economy alignment
+
+The body-caste gradient aligns with healthy asset-economy practice. **Class-restriction is asset-restriction.** A small set of high-detail rare-pinnacle bodies + a larger set of baseline/mid-tier player-accessible bodies preserves both *worldbuilding-meaning* (rarity makes the pinnacle visually distinctive) AND *asset-budget* (the team builds fewer total assets at higher detail). One discipline, multiple payoffs:
+
+- *Class-restriction* → fewer pinnacle-tier assets → preserves their visual distinctiveness AND their asset-budget impact.
+- *Palette-discipline* (marble + obsidian + chroma + gold + rust) → fewer texture variants → fewer surface-treatments to model, light, maintain.
+- *Sumptuary-fabrication* (lineage-locked vat-class) → caste cannot escape its vat → **no need to model upward-mobility-via-modding asset-trees**.
+
+Specific budget per the rule catalogue when established. The body-tiers, palette, and fabrication-discipline are *consistent with* whatever budget the catalogue specifies — the worldbuilding-decisions have already done the asset-budget's work in principle; the catalogue codifies what is already there.
+
+Connects to the existing key-move in [`../architecture-index.md`](../architecture-index.md): *"Base-limb palette + trait-textured variance. Asset-economy and worldbuilding-thesis agree."*
+
+## Cross-references
+
+| Reference | What it provides |
+|---|---|
+| [`./architecture.md`](./architecture.md) §Three-body system | Engineering substrate: the imperial-net body, gameworld body, in-between body distinction this doc rests on |
+| [`./architecture.md`](./architecture.md) §Mods as trait-bearers | The mod-economy that interfaces with mod-progression-as-flesh-loss in this doc |
+| [`./architecture.md`](./architecture.md) §The clasp endgame | The phases of clasp; this doc's in-between mesh content extends Phase D |
+| [`./architecture.md`](./architecture.md) §The trait-to-body-part bridge | The wheel-temperature-axis discipline that bridges the 8 traits to genital-architecture; the in-between-mesh-vs-dimension terminology lock; cross-configuration as default-not-marked |
+| [`./architecture.md`](./architecture.md) §The genital-mod track | Engineering substrate for the sex-mod track in this doc: mesh-resident augmentation, trait-fitness integration test, three-stage install (purchase + cooldown + dual-hardstop self+partner-witness), re-vat as authoring opportunity |
+| [`./architecture.md`](./architecture.md) §The mesh-as-mirror | The cosmological consequence — cruelty rendered as anatomy; the asshole-gooner's mesh tells on him; honest-rendering as the same gift in both directions (dignity to one, accountability to another) |
+| [`./architecture.md`](./architecture.md) §The post-rogue mod-vocation | Engineering substrate for the post-rogue mod-vocation: per-pair calibration threshold lower than defection; dual-hardstop install discipline generalized to NPC-modding; the inquisition-trigger hook for service-body gender-modification |
+| [`./vocations.md`](./vocations.md) | The vocation-system mechanic — task-catalogue + trait-task-affinity + hidden per-task measurement; the outcome formula (trait-points × task-stat); the depletion-pool malus + opposite-axis recovery; the catalogue-stack data-flow; caste-as-stagnation operationalized as math; the named vocations in this body-canon (companion, sex-worker, tongue-installer, assembler-artisan, lobotomist, post-rogue mod-vocation) instantiated as patterns the system reads in task-history |
+| [`../style/gender-parity.md`](../style/gender-parity.md) | The gender-parity contract that is the precondition for the whole genital-architecture mechanic — gender-parity-by-default in canon authoring is what makes the mesh-as-mirror trap work and what makes trans-embodiment the cosmological default |
+| [`../style/consent-discipline.md`](../style/consent-discipline.md) | The consent-discipline spine codifying the hardstop-gradient (gameworld-loose vs in-between-gated), the four hardstop-pattern variants (self / dual / triple / cooldown-augmented), the mirror-discipline absolute floor, the temporal-grammar (24h window-partition), the right-to-refuse (going-rogue temporal-breakout), and the inquisition-trigger upper-pressure — generalized from clasp-entry / body-disposal / drug-grammar / genital-mod-installation / post-rogue NPC-mod into a single style-spine; the register-test as executable form |
+| [`../imperial-cult/cosmology.md`](../imperial-cult/cosmology.md) (stub) | The unified-clasp framing — the imperium's monopoly-grip on the gesture; political-theology of consciousness-grip |
+| [`../imperial-cult/cosmology.md`](../imperial-cult/cosmology.md) (stub) | The caste-tier-as-mod-status gradient names; this doc is the somatic-substrate of those tiers |
+| [`../imperial-cult/cosmology.md`](../imperial-cult/cosmology.md) §The deferred-moksha doctrine | The doctrine the going-rogue arc refutes per-lover; the synth-tongue's doubled-lie is structurally identical (engineered mechanism materializing a lie) |
+| [`../imperial-cult/cosmology.md`](../imperial-cult/cosmology.md) (stub) | The mind-capsule mechanic — extracted/disabled at lobotomy via firewall-breach in the black-market body-tier; manusya-tier-doctrinal-fiction materialized criminally |
+| [`../imperial-cult/cosmology.md`](../imperial-cult/cosmology.md) §There is no outside | The total-yoke discipline this doc's vat-class permanence enforces *somatically* — the body stays in samsara even after the mind reaches moksha |
+| [`../topology-and-rendering/architecture.md`](../topology-and-rendering/architecture.md) §Color-language + §Three-shader philosophy | Substrate for the chroma-grammar this doc builds on; rendering registers for realworld vs. liminal; pending caravan-cargo + trait-pill color-language mappings |
+| [`../topology-and-rendering/architecture.md`](../topology-and-rendering/architecture.md) §Clasp color-merge | Existing canon for what clasp-pairs visually share; this doc adds the human-mesh real-skin layer |
+| [`../style/trait-palette.md`](../style/trait-palette.md) | Trait-color → pill-color mapping for the trait-pill grammar; substrate for caravan-cargo color-language |
+| [`../political-register/architecture.md`](../political-register/architecture.md) §Vocation-substrate | Connects service-bodies (companions, sex-workers) + the drug-supply vertical (slum-grower / imperial refinery / imperial drug-artisan) + the underground vocations (tongue-installer, assembler-artisan, lobotomist) to the imperial-net market structure |
+| `gamemaster v1 / arbitration-policy` *(pending)* | The bounty-staircase event-grammar template (escalation-rate × terminal-rung per crime-class); the outcast-pair × staircase interaction rule; the lover-confronts-the-shell, ceremonial-farewell, and crypt-visit event-classes |
+| [`../README.md`](../README.md) §Timeline | The 2200 setting and the closed-orbit context that constrains all body-fabrication |
+| `studio.nimmerworld.eachpath.local/bodies/base/robot/README.md` *(closed studio repo)* | Tech-spec scaffold for the robot base mesh (chassis-only, frame-as-mesh discipline; serves slum-tiryak + preta-overseer tiers; joint-design carries the visible-mechanism tier-language) |
+| `studio.nimmerworld.eachpath.local/bodies/base/imperial/README.md` *(closed studio repo)* | Tech-spec scaffold for the imperial base mesh (skin-over-skeleton with hidden mods; serves asura-priest + deva-pinnacle tiers; deva is no-visible-joints absolute upper limit) |
+| `studio.nimmerworld.eachpath.local/bodies/base/human/README.md` *(closed studio repo)* | Tech-spec scaffold for the human base mesh (trait-grown body that manifests in the in-between dimension during clasp-pair encounters; the truth-register body distinct from chassis) |
+| `studio.nimmerworld.eachpath.local/imperial-cult/caste-index.md` *(closed studio repo)* | Caste-renaming working-doc — the current Deva/Asura/Manusya/Tiryak/Preta vocabulary borrows from a living religious tradition (Hindu/Buddhist rebirth-wheel) and is incompatible with nimmerworld's otherwise self-generated coinage discipline; the rename-pass will eventually replace §The body-caste gradient's tier-names with in-fiction coinage that sits alongside the Hellenic trait-palette and imperial-tongue alphabet |
+
+## Open questions
+
+- **Specific tier-distinguishing visual cues — per-tier render-decisions for the visible-mechanism vocabulary** (joint-design + tongue-visibility per §The visible-mechanism vocabulary), plus material-finish-fine-detail, body-proportion idealization, and chroma-saturation differences. Principle codified; per-tier specifics exploration-pending the body-mesh authoring pass. Pending: detailed visual style guide work (likely under `../style/`).
+- **The fabrication-vat ecology.** How many vat-classes exist? Where are they geographically? Who runs them? What does a vat *look like* diegetically? Pending: future content-canon doc, possibly `../imperial-cult/fabrication.md` or similar.
+- **The asura priest's named chroma.** Which trait-color is liturgically reserved for the priesthood? Pending: connects to [`../style/trait-palette.md`](../style/trait-palette.md) and [`../imperial-cult/cosmology.md`](../imperial-cult/cosmology.md) §Open questions.
+- **Rule-catalogue-specific budgets.** Vertex-caps per tier; texture-resolution per material register; collision-mesh complexity per body-tier; shader-stack budgets for the in-between mesh. Pending: rule catalogue when written (likely `../style/asset-budget.md` or similar).
+- **Cross-tier clasp asymmetry handling.** Phase D of the clasp endgame currently describes a *symmetric* dual-body union. Does mesh-fidelity asymmetry break the existing mechanic, or does the existing mechanic accommodate it gracefully? Pending: review against [`./architecture.md`](./architecture.md) §The clasp endgame Phase D when next architecture-time happens.
+- **Service-body sub-tier specifics.** What range of seams + bolts + cosmetic flesh-illusion variations do service-bodies span? Where are the line-cases between service-body and slum-tier? Pending: detail work alongside vocation-substrate.
+- **Asymmetric-witnessing across player-NPC pairs.** When my witness-progression is high and yours is low, *I see you fully but you cannot see me back*. **Heartbreak-engineering compounds the asymmetric-clasp.** The experienced lover bears the full weight of partial-mutual-visibility; the inexperienced lover has been seen but cannot return the gift. Specific mechanic for how this is rendered (does the inexperienced see static-noise where their beloved should be? a darker silhouette? a partial-mesh?), and whether NPCs accumulate witness-progression through their own clasps (per the omnisight architecture in [`../runtime-engine/architecture.md`](../runtime-engine/architecture.md) §Omnisight), pending design pass.
+- **Tongue-gating across imperial tiers** (v0.3). Which imperial bodies carry the synth-tongue — *all deva and asura*, or only *specialist vocations* (connoisseur-artisans, priest-officiators, drug-composer-artisans)? Affects huntable-NPC density AND the tongue's *meaning* (caste-marker vs. vocation-tool). Pending design pass.
+- **Pill-stacking and overdose semantics** (v0.3). Mono-trait-pill = clean amplification on one axis. Polychromatic stacking = imperial-decadence overdose with witness-collapse risk? *The asura-priest takes one Moira-violet (`#a349a3`) pill ceremonially; the deva-pinnacle takes seven simultaneously and vomits in marble.* Overdose-as-failure-state worth canonizing alongside pill-stacking rules. Pending design pass.
+- **Distortion's visual vocabulary in the cel-shading liminal-register** (v0.3). What does drug-distortion *look like*? Color-bleed across trait-axes? Ghost-mesh artifacts? Hallucinated-trait-pulses-where-none-occurred? Oversaturated chroma at the dosed-axis? Distortion-grammar wants its own visual vocabulary, and it is where the *engineered* signature of the drug becomes legible to a sober witness watching from outside. Pending: connects to [`../topology-and-rendering/architecture.md`](../topology-and-rendering/architecture.md) §Three-shader philosophy.
+- **Caravan-cargo color-language mapping** (v0.3). Which trait-color carries refined-drug, T2-produce, and tongues-in-transit through the imperial caravan event-class (per §The synth-tongue / Caravan-class events)? Pending: connects to [`../style/trait-palette.md`](../style/trait-palette.md) and [`../topology-and-rendering/architecture.md`](../topology-and-rendering/architecture.md) §Color-language.
+- **Imperial calibration-signature retention post-defection** (v0.3). Does the imperium retain a re-vat'd defector's pre-defection gesture-mapping calibration-signature (per [`./architecture.md`](./architecture.md) §The clasp endgame, *"Clasp-partners' gesture-mapping calibrations integrate post-clasp; the integrated calibration-signature is preserved across body-deaths in consciousness-archive"*) as a permanent search-key? If **yes**: re-vat is *plausible-deniability cover* lasting only as long as imperial inattention; the clasp-pair lives in *passing*, knowing the imperium could find them anytime if it chose to look hard enough — *love-in-exile-while-pretending-to-be-home*. If **no**: they actually fully escape once assembled, which would be a major cosmological concession to the no-haven discipline (per [`../imperial-cult/cosmology.md`](../imperial-cult/cosmology.md) §There is no outside). Pending design pass; the *yes-answer* is more dramatically generative AND no-haven-discipline-consistent.

identity-and-personhood/vocations.md

@@ -0,0 +1,473 @@
+# Nimmerworld — Vocations and the Capability Substrate
+
+> *The substrate-level mechanic for who NPCs and players become through what they do. Adaptation as the architecture's anti-imperial register at the game-system layer; vocation as the emergent pattern of task-history rather than class-identity; trait-pools as per-trait micro-grammar of macro-lifeforce; the catalogue stack (resources × production-chains × tasks → imperial-demand) feeding shift-composition and the three-tier policy loop.*
+>
+> *Companion to: [`./architecture.md`](./architecture.md) (three-body system, trait-vector, mods-as-trait-bearers, the post-rogue mod-vocation), [`./bodies.md`](./bodies.md) (the body-canon the vocation-substrate is grounded in), [`../style/trait-palette.md`](../style/trait-palette.md) (the wheel's now-third-load-bearing role at the recovery-pair layer), [`../political-register/architecture.md`](../political-register/architecture.md) (three-tier policy loop, calibrated-misery, vocation-content), [`../authority-and-decision/architecture.md`](../authority-and-decision/architecture.md) (the director's task-list arbitration surface).*
+>
+> *v0.1 initial draft 2026-04-27 — dafit + chrysalis. Authored in the same session that produced gender-parity.md (Phase E), the trait-to-body-part bridge, the genital-mod track, the mesh-as-mirror, and the post-rogue mod-vocation. Vocation-system designed in concise dialog late in the same session; this paper codifies the design.*
+
+---
+
+## What this is
+
+This document specifies the **vocation system** — the substrate mechanic by which NPCs and players accumulate capability through doing, gravitate toward specific tasks via trait-alignment, and produce outcomes in the world. It is **adaptation operationalized as game-mechanic**, anti-fixed-class by construction, anti-imperial by composition: the mechanic refuses at the system layer what the imperium imposes through its caste-system at the world layer.
+
+The vocation-system is a *system-level mechanic*, not a content-canon list. Specific named vocations (companion, sex-worker, slum-grower, drug-artisan, tongue-installer, assembler-artisan, lobotomist, the post-rogue mod-vocation — see [`./bodies.md`](./bodies.md) and [`../political-register/architecture.md`](../political-register/architecture.md) for the content) **emerge from this system as recognizable patterns in task-history**. Vocations are *cluster-types* the world reads in someone's accumulated practice; they are not class-identities the world assigns. The class layer dissolves; the cluster-types remain.
+
+Three substrate principles, in priority order:
+
+1. **Adaptation-as-substrate.** Capability emerges from doing, not from menu-choice or class-lock. *The architecture's anti-imperial register lands at the game-system level.*
+2. **Trait-emergent capability.** The trait-vector that already drives identity-emergence (per [`./architecture.md`](./architecture.md) §The three-body system) extends into *what you can become skilled at*. Identity-politics extends to capability-politics.
+3. **Mathematical politics.** The system's progression-curve geometry encodes the world's political-claims — *caste-as-stagnation, calibrated-misery as progression-cap, the imperium's optimum as also its citizens' progression-cap*. The architecture's politics are in the gradient itself.
+
+## The substrate principle — adaptation as anti-imperial register
+
+What makes humans uniquely capable, in the architecture's stance, is **the ability to adapt** — to shift, learn, take up different work, return to old work refreshed by the difference. Fixed professions in games are nil precisely because they replicate imperial caste-logic at the system layer.
+
+| What | Imperial logic in the world | Game-system parallel that imitates it |
+|---|---|---|
+| Fixed identity by birth | Vat-class assigns body → tier → vocation | D&D-style class at character-creation |
+| Lock-in at choice-point | Sumptuary-fabrication; no upward conversion | Class-locked progression trees |
+| Specialization-over-time | The imperium's calibrated-misery optimum | Grinding one skill to max |
+
+**D&D-style class-lock and the imperial vat-class are the same primitive at different layers.** The vocation-system's anti-fixed-class discipline is therefore not just a design preference but a *political claim* — the architecture refuses at the system layer what the world's imperium imposes at the body layer. Schema-Marxism (per [`../architecture-index.md`](../architecture-index.md) Key moves: *information-propagation pacing as Marx-in-the-schema applied to epistemics*) extends from epistemics into capability-itself: *you can hunt in the morning, fish in the afternoon, rear cattle in the evening, criticize after dinner*, the German Ideology line operationalized as game-mechanic.
+
+The vocation-system is the engine that makes this true. Closest RPG ancestors: **Dwarf Fortress's labor system** (NPCs gravitate by preference + skill, no class-layer, hidden experience-accumulation); **Kenshi's class-less skill-by-use**; **Final Fantasy V's job-system** (swappable through doing). Hard anti-patterns: D&D / WoW class-lock; Eve Online's real-time-clock-training (adaptation should live in the doing, not in the clock).
+
+## The three primitives
+
+The system rests on three designer-authored primitives that compose into the full mechanic:
+
+### 1. Task catalogue
+
+Tasks are the **atomic unit** of the vocation-system. A task is a designer-authored content-record bound to one or more world-primitives (zones, events, interactions, workstations, resources). Each task carries:
+
+- **Task-class identifier** — the type-level name; multiple instances of the same class share a task-stat measurement
+- **Trait-affinity profile** — which trait-axes engage when this task is performed; weighted vector across the 8 traits
+- **Resource bindings** — what the task consumes / produces / interacts with (per the catalogue-stack below)
+- **Workstation / zone binding** — where the task can be performed
+- **Outcome shape** — what the task yields (resource, item, social-effect, lifeforce-delta, narrative-event)
+- **Pool-cost profile** — how much the task drains the trait-pool(s) it engages
+
+The catalogue is **designer-authored at the type-level, instance-generated by world-gen at the room-level**. A specific brothel-zone in a specific district instantiates specific service-task-instances of the canonical service-task type; a specific drug-lab instantiates drug-refinement-task-instances of the canonical drug-refinement type.
+
+### 2. Trait-task affinity
+
+Each task's trait-affinity-profile defines **which trait-axes engage when the task is performed** — and therefore *which trait-pools deplete*, *which trait-engagement-points multiply with the hidden-task-stat to produce the outcome*, and *which trait-vectors gravitate toward the task at director-arbitration time*.
+
+The affinity-profile is a weighted vector across the 8 traits. Most tasks engage one or two traits primarily; some engage several at lower weights. Examples (canonical, sketched):
+
+| Task class | Primary trait-affinity | Why |
+|---|---|---|
+| Brothel sex-work | Eros (reaching) + Aletheia (revealing) | Service-body-as-sex-worker engages reaching + opening |
+| Companion-hall affective work | Philotes (loving close) | Companion service is warm-pulse close-presence |
+| Memorialist-archive curation | Mnemosyne (remembering) | Memory-as-carrier engages the time-holding axis |
+| Drug-refinement at imperial lab | Kairos (catching the moment) | Synth-tongue lineage; precise-timing taste-work |
+| Asura-priestly ritual prosecution | Dikaiosyne (standing for fair) + Aletheia (revealing) | Justice-axis + truth-axis combined |
+| Patrol-and-watch (drone-patrol) | Sophrosyne (holding back) + Moira (reading what's coming) | Cool-side; surveillance is contemplative-receptive |
+| Memorialist counter-archive smuggling | Mnemosyne (remembering) + Sophrosyne (holding back) | Memory + restraint |
+| Tongue-installer underground surgery | Kairos (catching the moment) + Aletheia (revealing) | Reflexive timing + uncovering hidden tongue-mechanism |
+
+**Multi-trait tasks compose multiplicatively per-trait** (see §The outcome formula below); the dominant trait at each axis-crossing arbitrates which trait-LoRA fires for narrative-decisions within the task (per [`../inference-and-memory/architecture.md`](../inference-and-memory/architecture.md) §LLM tiering).
+
+### 3. Hidden per-task measurement
+
+Each (NPC × task-class) tuple has a **hidden task-stat** that grows through performance. This is the skill-by-doing accumulator:
+
+- **Hidden from the player UI** — there is no skill-screen, no hovel-progression-board, no level-up notification
+- **Visible to the system** — the director sees task-stat in shift-arbitration; the Compositor sees it in narrative-composition
+- **Visible to the player AS character** — through experiential feedback: tasks land cleaner, NPCs respond differently, the world quietly adjusts. *Souls-discipline* applied to vocation-progression — you learn through performance-feedback, not number-watching.
+
+Task-stat accumulates per-task-class (not per-task-instance), so practice on one brothel-task-instance contributes to skill on every brothel-task-instance. **Cross-task transfer at the task-class layer; strict per-class isolation at the skill-stat layer**. The trait-axis layer transfers more freely (see §The depletion-pool malus below).
+
+## The outcome formula
+
+When an NPC (or the player) performs a task, the outcome is computed multiplicatively:
+
+```
+outcome = trait_engagement_points × hidden_task_stat
+```
+
+Where:
+
+- **trait_engagement_points** is the *current* drawable points from the relevant trait-pool(s), modulated by the task's trait-affinity weights and the pool's current depletion-state
+- **hidden_task_stat** is the NPC's accumulated skill on this task-class
+
+The outcome determines **how much yield this turn produced** AND **the quality of the produced item / effect / social-impact**. High outcome = good items, big yield, strong social-effect; low outcome = poor items, small yield, weak effect.
+
+**Properties that fall out of the multiplicative shape:**
+
+| Trait-points | Task-stat | Outcome | What it represents |
+|---|---|---|---|
+| **High** | **High** | Excellent | True mastery — inner alignment AND practiced skill |
+| High | Low | Mediocre | High motivation, low ability — the eager beginner |
+| Low | High | Mediocre | High ability, low motivation — the burnt-out expert |
+| Low | Low | Poor | Stranger to the work and its substrate |
+| **0** | Any | **0** | **Cannot grind skill on a task with no trait-substrate** |
+
+**Trait-zero zeros the work.** The architecture's identity-politics ("who you are sexually is who you have become" per [`./architecture.md`](./architecture.md) §The three-body system) extends here into *what you can become skilled at*. You cannot grind capability you have no inner alignment for; the multiplicative outcome forecloses the possibility. **True mastery requires both inner alignment AND practiced skill — the body-and-the-doing in agreement.**
+
+For multi-trait tasks, the outcome composes per-trait-axis (designer-authored: sum-of-products, geometric mean, or min-of-traits × task-stat depending on the task-class's intent).
+
+## The depletion-pool malus
+
+**Each trait carries a hidden energy pool.** Tasks that engage a trait drain its pool; the pool refills via two recovery mechanisms.
+
+### How the pool depletes
+
+Every task-execution drains the engaged trait-pools by an amount proportional to the task's pool-cost profile. The drain is *per-trait*, so a task engaging Eros + Aletheia drains both pools simultaneously.
+
+Crucially, **the malus targets trait-points, not the hidden task-stat**. Skill is durable; engagement is exhaustible. Over-practice does not unlearn the work — it only dulls today's edge. *Right somatically*: practice doesn't undo, but pushing through fatigue produces diminishing returns.
+
+The outcome formula reads the *current* pool level when computing trait-engagement-points; a depleted pool produces low engagement-points; the multiplicative formula propagates the depletion into the outcome. **Your fatigue is in your outcomes, not on a screen.**
+
+### Recovery mechanisms
+
+Two recovery paths refill trait-pools:
+
+1. **Time-based decay** — the pool slowly refills over cycles when the trait isn't being actively engaged. Passive recovery; predictable; baseline.
+2. **Opposite-axis-practice** — performing tasks engaging the trait's *oppositional-pair partner* (per [`../style/trait-palette.md`](../style/trait-palette.md) §The wheel) accelerates refill. Active recovery; faster than passive; the body's somatic discipline.
+
+Both layered: an NPC who stops doing the engaged trait recovers slowly; an NPC who pivots to the oppositional-pair recovers quickly. *Switching is faster than resting; the dialectical pivot is what refreshes the body fastest.*
+
+### The wheel as recovery-pair geometry
+
+The recovery mechanism activates the wheel's already-canonical oppositional-pair structure as **a third load-bearing role** at the skill-progression layer:
+
+| Layer | Role | Where defined |
+|---|---|---|
+| **Visual** | Color-pairs at 180° on the artist's color wheel | [`../style/trait-palette.md`](../style/trait-palette.md) §The wheel |
+| **Philosophical** | Moral / dramatic axis (reaching vs holding; partial vs impartial; past-revealed vs future-fated; past-dwelling vs present-piercing) | [`../style/trait-palette.md`](../style/trait-palette.md) §The wheel |
+| **Mechanical** *(new)* | Skill-progression recovery-pair axis — fatigue on one pole refreshes through practice on the other | This document |
+
+The wheel keeps gaining work; nothing exists alone. **Hegelian rhythm at the body's progression mechanic** — practice and counter-practice as somatic discipline. The four oppositional pairs and their recovery-grammar:
+
+| Fatigue from | Refresh through |
+|---|---|
+| **Eros** (reaching for what I want) | **Sophrosyne** (holding back when I want to act) |
+| **Philotes** (loving and staying close) | **Dikaiosyne** (standing for what's fair) |
+| **Aletheia** (seeing what's hidden) | **Moira** (reading what's coming) |
+| **Mnemosyne** (remembering what mattered) | **Kairos** (catching the right moment) |
+
+A combat-Eros-heavy player eventually NEEDS to do meditative-Sophrosyne tasks to keep their Eros alive. A scholar-Aletheia-heavy player eventually NEEDS prophecy-Moira work to keep their Aletheia alive. **The mechanic forces the player into the whole wheel over time.** Players become structurally well-rounded simply by playing the system honestly.
+
+### Lifeforce coupling — trait-pools as per-trait micro-grammar
+
+The trait-pools couple to the existing canonical *lifeforce* primitive (per [`../architecture-index.md`](../architecture-index.md) Key moves: *"Lifeforce is NPCs, measured. The director's budget; the GM's signal; the imperium's heartbeat."*). **Trait-pool depletion is the per-trait micro-grammar of the macro-lifeforce signal.** When trait-pools deplete in an NPC, their lifeforce-signal degrades upward through the existing report-channel.
+
+**Structural fall-out**: the same math that produces good vocation-progression (rotation through the wheel for refresh) *also* produces good district-management (lifeforce-maintenance via NPC rotation). **The director becomes a parental-rotator not by design-fiat but by mathematical necessity** — depleted NPCs produce poor outcomes (multiplicative formula), poor outcomes degrade lifeforce-signal, the director MUST rotate to maintain their lifeforce-budget. The director's existing anti-imperial register (cheats against the imperium when NPC welfare demands it) gains a finer-grained tool: *trait-pool-aware shift-rotation*. **Two layers — vocation-progression and district-management — same primitive, mutually reinforcing.**
+
+## The catalogue stack and the data flow
+
+Tasks bind upward through a *catalogue stack* into the imperial-demand-pipeline. The stack:
+
+```
+Resource catalogue × Production chains × Task catalogue
+    ↓
+Imperial demand catalogue (what the imperium wants, in resource/task vocabulary)
+```
+
+| Layer | What it specifies |
+|---|---|
+| **Resource catalogue** | The world's resource taxonomy — physical resources (raw materials, processed goods, food, drugs, tongues, body-parts, etc.); digital resources (data, surveillance-records, calibration-signatures); narrative resources (rumors, reports, doctrinal-fragments) |
+| **Production chains** | How resources transform into other resources via tasks. Recipe + tool-binding + time-cost + quality-curve. *Slum-drug → imperial-refined-drug → imperial-composed-drug → tongue-gated-consumption* is one chain; *raw-stone → ceremonial-marble-block → asura-temple-construction* is another. |
+| **Task catalogue** | The vocation-tasks that operate within production-chains (and outside them — social, surveillance, ritual, narrative tasks that don't transform resources but produce other outcomes) |
+| **Imperial demand catalogue** | The composition of all three: *what the imperium wants*, expressed as resource-targets achievable through specific production-chains executed by specific task-instances |
+
+The imperial demand catalogue is **the imperium's wish-list operationalized in the system's own vocabulary**. The Hivemind's daily demand-formulation reads from this catalogue: *"this district produces X tongues per day at Y refinement-tier; today demand a 20% increase by routing more sex-worker-output through the consumer-receptor-vertical."* Demand is concrete because the catalogue makes it concrete.
+
+### End-to-end flow
+
+```
+Imperial demand catalogue (today's demand)
+    ↓ [daily ledger; periodic check — see §Daily-ledger pacing]
+GM allocates demand → districts with matching resources + workstations
+    ↓
+Director maps demand → district meta-table:
+    workstations × resources × NPCs × current trait-pool-states × task-stats
+    ↓
+Director composes shift-list:
+    selects tasks from imperial-mapped tasklist;
+    arbitrates assignments per trait-alignment + pool-availability + task-stat;
+    constructs per-NPC shift-rows
+    ↓
+NPCs fulfill assigned tasks:
+    outcome = trait_engagement_points × hidden_task_stat;
+    pools drain; task-stats accumulate; lifeforce-signal updates
+    ↓
+Outcomes flow up:
+    resources produced + quality + lifeforce-state + completion-signals
+    ↓ [district report → GM → imperium → ledger updated for tomorrow]
+```
+
+This composes cleanly with the existing **three-tier policy loop** (Imperium → GM → Districts → reports up → Imperium) per [`../political-register/architecture.md`](../political-register/architecture.md) §Three-tier policy loop. The catalogue stack provides the *typed vocabulary* for what flows down; the outcome-stream provides the typed vocabulary for what flows up. **The existing 'shifts on NPC rows' mechanic finally gets its data-source named: shifts are director-composed task-bundles drawn from the imperial-demand-mapped tasklist.**
+
+## Director's task-list arbitration surface
+
+The director's middle-management role gains a sharpened definition: **negotiate the tension between imperial-demand-fulfillment and NPC-welfare-via-rotation.**
+
+The tension's components:
+- **Imperial demand** wants specific trait-alignments from specific districts (today's demand favors Eros-tasks in this district)
+- **Depletion-pool dynamics** demand rotation through the wheel for NPC refresh (Eros-pools are exhausted in NPCs from yesterday's Eros-heavy shifts)
+- **Lifeforce-budget** caps how much labor can be extracted before signals degrade (over-extraction triggers report-flag; under-extraction triggers imperial-attention from below-quota)
+
+**The director negotiates this gap through the existing cheat-tools and double-ledger mechanisms** (per [`../political-register/architecture.md`](../political-register/architecture.md) §Director cheat-tools + double-ledger). The breathing-room established by daily-ledger pacing is *the time-window in which the negotiation happens*. Without breathing-room, there's no negotiation, only execution. **Middle-management exists in the gap; the daily-ledger creates the gap.**
+
+Arbitration order at shift-composition:
+
+1. **Filter** the tasklist to tasks the district can perform (workstations + resources available)
+2. **Score** each (NPC × task) pair by:
+   - Trait-affinity (high-affinity NPCs gravitate; low-affinity NPCs deprioritize)
+   - Current trait-pool-state (depleted pools deprioritize the NPC for that trait-axis; refreshed pools prioritize)
+   - Task-stat (skilled NPCs match high-priority demand; novices match low-priority demand or tasks where development is the goal)
+   - Faction-affiliation × imperial-policy-priority-weights (per existing canon's imperium-policy-driven scoring)
+3. **Assign** tasks to NPCs in score-order, draining the tasklist as assignments are made
+4. **Surface remaining unfulfilled tasks** in the upward report — the imperial demand that the district couldn't satisfy
+
+## Daily-ledger pacing
+
+Imperial demand is **not real-time**. It travels as a *daily ledger* checked at periodic intervals — not every cycle, every shift, every minute, but **at a cadence that creates breathing-room**.
+
+### Why breathing-room is load-bearing
+
+The breathing-room does load-bearing structural work that wouldn't be available to a real-time system:
+
+- **The double-ledger NEEDS this**. Existing canon (*"Director cheat-tools + double-ledger; corruption emerges from pressure; Memorialists keep true accounting"*) requires *time-between-audits* to operate. Real-time imperial pressure leaves no gap for the cheat-substrate. **Breathing-room is the structural prerequisite for the corruption-mechanic to exist.**
+- **Dramatic time exists.** Audit becomes an event — approaching, building, reckoning. Greek-tragedy register at the imperial-economic layer, paralleling the bounty-staircase's *dread-time* (per [`./bodies.md`](./bodies.md) §The bounty-staircase).
+- **NPCs get to be people, not functionaries.** Time between assignments lets depletion-pools refresh, lets clasp / friendship / drift / slowness exist. **Breathing-room is what makes NPCs livable.**
+- **Imperium-as-slow-elephant.** The cosmology's calibrated-misery-as-finite-attention finally has its temporal grammar. The imperium can't be everywhere at once; **ledger-cadence IS the imperium's attention-budget made structural.**
+- **Marxism-of-economics extends from epistemics.** Information-propagation-pacing was already canonical *Marx-in-the-schema applied to epistemics*. **Demand-propagation-pacing is Marxism-of-economics.** Same primitive, demand-side.
+
+### Demand-ledger ≠ Actions-ledger
+
+The Hivemind sends down **two separate daily ledgers**, processed by the GM independently:
+
+| Ledger | Operates at | What it specifies |
+|---|---|---|
+| **Demands ledger** | The economic layer | Resource/quota expectations; production-chain targets; the catalogue-stack's imperial-demand-catalogue |
+| **Actions ledger** | The force layer | Imperial events to fire today (drone-patrols, inquisitions, overseer-audits, enforcement) |
+
+Both spread-out over the cycle; both narrative-framed by yesterday's events (per the imperial daily-narrative, forthcoming in `../political-register/imperial-narrative.md` or new section). **The two-ledger split mirrors the existing specter-vs-boot split** — policy-issuance (free) vs enforcement (expensive) — now formalized as separate ledger-grammars. The GM's middle-management role gains a second pipeline to negotiate.
+
+## The 24h window-partition — NPC daily structure
+
+The simulation runs NPCs on a **fixed 24h window-partition** rather than a free-juggling needs-and-tasks moment-to-moment model. This is a deliberate state-machine choice: free-juggling produces combinatorial state-space and chaotic feel; clean-windows-only produces predictable structure but mechanical feel; **clean-windows-with-typed-breakout-flags produce predictable-baseline + emergent-moments**.
+
+This is the architecture's **signature pattern at a third layer**:
+
+| Layer | Cheap baseline | Typed-breakout |
+|---|---|---|
+| **Lemniscate-runtime** | Zone-default tokens | Verifier-flags (priority_pull, mid_action) |
+| **Imperial-event encapsulation** | Rail-walk rule-execution | Zone-collision (LLM-mediated arbitration) |
+| **NPC daily window** *(this section)* | Window-ruleset execution | **Breakout-flags** (typed-interrupt protocol) |
+
+Same shape at three scales. *Cost-budget asymmetry as architectural style* — small clean rule-driven defaults + typed escape-hatches for the rare moments that matter. The cheap-default carries 95% of compute; the rare breakout pays the LLM-cost only when it earns it.
+
+### The three windows
+
+The 24h cycle partitions into three windows. Standard slum-tier allocation; caste-stratification varies the durations (see §Caste-as-stagnation below for caste-tier allocations).
+
+| Window | Standard duration | What happens | Ruleset |
+|---|---|---|---|
+| **Work-shift** | 10h | Director-arbitrated tasks; trait-arbitration drives assignment-order; outcome formula fires per task | Trait-arbitrated task-execution; pool-drain; task-stat accumulation; breakout-flags monitored at full sensitivity |
+| **Charging** | 4h | Robo-body somatic-recharge; passive trait-pool refresh; lifeforce-recovery; idle-presence in dwelling-zone | Passive recovery; minimal compute; breakout-flags monitored at lower sensitivity |
+| **Leisure** | 10h | NPC agency: cantina visits / leisure-zones / grid-walking / clasp-encounters / vocation-discovery; trait-axes the work-shift didn't engage exercise here | NPC-chosen tasks from leisure-zone offerings; emergent-zone participation; oppositional-pair-task gravitation for active recovery |
+
+**The work-shift is imperially-bounded** — the imperium's claim is on 10h, not the whole day. **The leisure-window is structurally-protected NPC-agency space.** **The charging-window is somatic-necessity** — the body needs what the body needs, and is not a consent-surface.
+
+### Consent-discipline implication — relocation, not addition
+
+The shift-assignment consent question that earlier drafts surfaced as open is **answered structurally rather than by adding a new consent-layer**. The window-partition relocates consent to where it already structurally lives:
+
+| Window | Consent-discipline |
+|---|---|
+| Work-shift | Imperial-imposed within trait-arbitration; refusing IS rebellion (going-rogue at the temporal layer) |
+| Charging | Not a consent-surface; somatic-necessity |
+| Leisure | **Full consent-active**: NPCs choose tasks freely; trait-development for axes the work-shift didn't engage |
+
+The NPC's 14h of non-work-window is *theirs* — the imperium's claim is bounded; structural autonomy is built into the data model. **Consent doesn't need to be added at the shift-assignment level; it exists structurally in the leisure-window.** This means [`../style/consent-discipline.md`](../style/consent-discipline.md) §The temporal-grammar cites the window-partition as the *temporal-grammar* of the consent-gradient rather than introducing a new shift-consent-layer.
+
+### The breakout-flag taxonomy
+
+Every breakout-flag uses an **already-canonical signal-primitive** — no new mechanism is introduced. Breakouts are typed-interrupts that override the current window's ruleset under designer-authored conditions, then return to the window after resolution.
+
+| Breakout signal | Source primitive | When it fires |
+|---|---|---|
+| **Lifeforce-emergency** | Lifeforce four-tier hierarchy (per [`../political-register/architecture.md`](../political-register/architecture.md)) | NPC's lifeforce drops below threshold → forced break to charging-window early |
+| **Emergent-need** | Emergent-signals as micro-factions (per [`./architecture.md`](./architecture.md) §Emergent needs as micro-factions) | A critical need (food, partner-distress, faction-call) crosses ternary-gate threshold |
+| **Imperial-event arrival** | Imperial-event zone-collision (per `../runtime-engine/architecture.md` *encapsulation pattern, forthcoming*) | Drone-patrol / inquisition / audit enters NPC's zone — work-window interrupted into LLM-mediated arbitration |
+| **Clasp-pair signal** | Per-pair calibration multiplier + dual-body aftermath (per [`./bodies.md`](./bodies.md) §Asymmetric clasp + [`./architecture.md`](./architecture.md) §The clasp endgame) | Beloved in crisis or co-located triggers brief breakout |
+| **Damage / chassis-emergency** | Chassis-state-tracking (existing canon) | NPC takes damage; window interrupts into emergency-state |
+| **Player-interaction zone-arbitration** | Lemniscate-runtime zone-collision arbitration | Player engages NPC mid-window; LLM-mediated interaction overrides ruleset briefly |
+| **Going-rogue temporal-rebellion** | Defection-threshold / accumulated-witnessing (per [`./bodies.md`](./bodies.md) §The going-rogue arc) | NPC who has crossed (or is approaching) defection-threshold may *refuse* the work-window — the small daily-rebellion option |
+
+**Going-rogue is just a breakout-flag firing from the calibration-multiplier signal**, not a new mechanism. The clean-windows model unifies the going-rogue arc's daily-rebellion register with the architecture's broader interrupt-protocol. *Refusing-the-work-window* is a structural option available to any NPC whose interior has accumulated enough authentic-witnessing; the bounty-staircase responds to the missed-shift exactly as it already does (per the dual-body aftermath canon).
+
+### Diurnal rhythm — the cosmology's temporal grammar
+
+The window-partition gives the cosmology's existing cyclic-claim its **diurnal grammar**. The cosmology turns daily through structural phases:
+
+1. **End-of-charging → start-of-work-shift** — the imperial daily-narrative fires (per `../political-register/imperial-narrative.md` *forthcoming*). The citizens hear yesterday's framing as they enter today's labor.
+2. **Mid-work-shift** — peak imperial-arbitration activity; director's tasklist fully engaged; breakout-frequency low.
+3. **End-of-work-shift → start-of-leisure** — NPCs depart workstations; emergent-zone density rises in cantinas and leisure-zones.
+4. **Leisure-window** — emergent-zone clustering peak; clasp-events; vocation-discovery; trait-development on non-work axes; the city's most-alive register.
+5. **End-of-leisure → start-of-charging** — NPCs return to dwellings; the city quiets; charging-windows synchronize per district.
+
+**The city pulses with predictable daily rhythm.** Players can plan encounters; directors can plan shifts; emergent-zone clustering is structurally-shaped by the window-cycle. The cosmology's cyclic-claim becomes literal — *every cycle the world turns through five phases*, with the imperium's voice arriving at the work-entry boundary like a dawn-prayer.
+
+### District-shifting — caste-fixes-shape, district-fixes-offset
+
+Window-shape (durations) is **caste-determined globally** — an asura-priest's 12/4/8 allocation is consistent in every district they reside in. Window-offset (start-time relative to global-time) is **per-district variable**, producing *asymmetric-encounter geometry across the world*.
+
+A slum-tiryak from district-A doing leisure at one local-time can encounter an asura-priest from district-D who is mid-work-shift at the same global-time. **The asynchrony is itself a structural feature** — districts that share offset have synchronized rhythms (mass-presence at boundaries); districts with shifted offsets create perpetual cross-traffic (always someone working, always someone in leisure, somewhere). **The world hums at all global-times because not everyone is in the same window simultaneously.** This is also where the rail-system gets its perpetual-traffic register: workers commuting at one local-dawn pass workers leaving at another local-dusk on the same rails.
+
+### Player-stalker schedule-mapping
+
+The window-partition gives the player-stalker imperial-going-rogue gameplay (per [`./bodies.md`](./bodies.md) §The post-rogue mod-vocation) its concrete affordance: **the player learns the imperial NPC's leisure-window through diegetic observation**. Imperial NPCs in leisure-windows are present in cantinas, walking the grid, attending leisure-zones; this is when sustained-encounter accumulation becomes accessible. The UID-pool-Compositor pipeline produces the data; the player learns the rhythm through repeated exposure.
+
+**Schedule-mapping as stalking-discipline** — the more you watch an imperial NPC, the more you know when they're available to be witnessed. The cosmologically-deepest gameplay loop in the architecture (witnessing into rogue-emergence) acquires its concrete daily-grammar through the window-partition.
+
+## Player-vs-NPC asymmetry
+
+NPCs follow shift-arbitration: the director assigns tasks; NPCs fulfill them in the assigned order. The player operates differently — **the player chooses from offered tasks** rather than being arbitrated into them.
+
+| Actor | How they get tasks | Why the asymmetry |
+|---|---|---|
+| **NPC** | Director-assigned shift-list per-day; trait-arbitrated; auto-executes | NPCs are simulation-actors; they need to operate at scale without per-NPC LLM-assignment cost |
+| **Player** | Discovery + offering (zones surface tasks; NPCs offer tasks; the universal-translator surfaces tasks the player has unlocked); player chooses | Players are agents-of-meaning; their choice IS the gameplay |
+
+The same vocation-system math applies to both — outcomes via trait_engagement_points × hidden_task_stat; pools deplete; recovery mechanisms apply; capability emerges from task-pattern. The director still *sees* the player's task-history (it goes into district-reports the same way an NPC's does), but the director does not assign the player's tasks. **The player is a free participant in the same economy NPCs are arbitrated into.**
+
+This asymmetry has political resonance. The slum-tier's freedom-of-task-choice is partial — economic pressure narrows real options — but it is *structurally* there. The imperial-tier's caste-locked NPCs cannot exercise the asymmetry; their shift-arbitration is closer to imperial-imposition. **The player's task-choice freedom is a slum-register affordance.** Climbing the imperial ladder — were that possible — would mean *losing* this freedom. *The slum keeps the choice; the imperium takes it.*
+
+## Caste-as-stagnation — the mathematical politics
+
+The depletion-pool malus + the wheel-as-recovery-pair-geometry compose into the architecture's sharpest expression of **calibrated-misery as imperial optimum** (per [`../architecture-index.md`](../architecture-index.md) Key moves):
+
+| Citizen tier | Task-variety access | Oppositional-refresh access | Progression-curve over time |
+|---|---|---|---|
+| **Slum-tiryak (player and slum-NPCs)** | Full wheel — caste doesn't restrict task-class | Full — can rotate through any oppositional-pair freely | Steepest possible mastery curve; polymath-by-default |
+| **Asura priest** | Caste-allowed subset (ceremonial / doctrinal / ritual-prosecution) | Partial — caste-allowed tasks may not span full oppositional pairs | Mid-tier mastery; asymmetric refresh-availability |
+| **Deva pinnacle** | Narrowest — pinnacle-status tasks only | Minimal — ceremonial registers don't span oppositional space | Shallowest mastery curve; *the highest caste accumulates the most fatigue with the least relief* |
+| **Preta overseer** | None of their own — imperial-instrument-tasks only | None — the caste exists to serve, not to refresh | **Continuous fatigue with no relief mechanism**; somatic-exhaustion as caste-state |
+
+**Imperially-caste-locked NPCs are structurally double-locked**: narrower task-variety AND no oppositional-refresh access. **Slum-tier polymath out-skills deva-pinnacle specialist in the long run, mechanically.** The architecture's politics are now in the gradient itself: caste-as-stagnation is not just a narrative claim but a math-claim baked into the progression curve. *The poor get the best mastery-curve for free; the rich pay to be locked into a worse one.*
+
+This sharpens the existing *"Director Director Decision Architecture"* (per [`../authority-and-decision/architecture.md`](../authority-and-decision/architecture.md)): the director's parental-rotator role is *more achievable in slum-districts* (where rotation across the wheel is unrestricted) and *less achievable in imperial-districts* (where caste blocks rotation). **Imperial-districts are harder to maintain healthily**, by the math of the system. The director cheats more in imperial-districts because cheating is the only way to maintain lifeforce; *the math forces the corruption*.
+
+### Window-allocation as a third caste-stratification axis
+
+Beyond task-variety access and oppositional-refresh access, **the 24h window-partition itself stratifies by caste**. Different tiers receive different work/charging/leisure allocations — and the leisure-time delta is the cosmology's no-haven discipline applied to the temporal axis:
+
+| Tier | Window allocation (work / charge / leisure) | Why |
+|---|---|---|
+| **Slum-tiryak** | **10 / 4 / 10** | Baseline citizenship; the architecture's reference-allocation |
+| **Asura-priest** | **12 / 4 / 8** | Devotional duty extends the work-window; less leisure than slum-tier |
+| **Deva-pinnacle** | **6 / 4 / 14** | Privilege as expanded leisure; pinnacle's prerogative is *time-of-their-own* |
+| **Preta-overseer** | **16 / 4 / 4** | *"There is no outside" applied at the temporal axis* — the overseer barely has hours of their own; instrumentalization made literal in hours |
+
+**The cosmology's no-haven discipline now has a diurnal grammar.** Calibrated-misery isn't only progression-curve geometry — it's *temporal geometry too*. The preta-overseer's 16/4/4 is the structural shape of imperial-instrumentalization made into hours. *The poor get the most leisure-time-of-their-own per day; the powerful get the least; the overseers get almost none.*
+
+This adds a third axis to the caste-as-stagnation gradient:
+
+| Axis | Mathematical claim |
+|---|---|
+| Task-variety access (per the table above) | Caste restricts what tasks an NPC can attempt |
+| Oppositional-refresh access (per the table above) | Caste restricts whether the wheel's recovery-pair geometry is available |
+| **Window-allocation (this subsection)** | **Caste restricts how many hours per day are the NPC's own** |
+
+**Three independent stratifications, all baked into the math.** The director's anti-imperial register has three axes to push back against; the imperium's calibrated-misery optimum has three axes to enforce; the player's slum-tier baseline has three axes to celebrate as its anti-imperial gift. **Caste is what shape your day takes, what tasks you can do in it, and whether the wheel can refresh you.** *The math is the politics; the politics is the math.*
+
+## Vocation as emergent task-pattern
+
+A "vocation" or "profession" in nimmerworld is a **recognizable pattern in someone's accumulated task-history**, not a class-identity assigned to them. The world reads patterns the way a Memorialist reads a body's accumulated-mod history — *what you have done is what you are read as*.
+
+| Named vocation (canonical) | Underlying task-pattern |
+|---|---|
+| Companion | Sustained Philotes-affinity tasks at companion-hall workstations; high task-stat on close-presence affective-labor task-classes |
+| Sex-worker | Sustained Eros + Aletheia affinity tasks at brothel workstations; high task-stat on sex-work task-classes |
+| Tongue-installer | Sustained Kairos + Aletheia affinity tasks at underground surgery workstations; high task-stat on synth-tongue installation task-classes |
+| Memory-pattern-extractor | Sustained Mnemosyne-affinity tasks at imperial-net market workstations; high task-stat on memory-extraction task-classes |
+| Slum-grower | Sustained Philotes (close-care) + Mnemosyne (cycle-tracking) tasks at slum-cultivation workstations |
+| Drug-composer-artisan | Sustained Kairos + Aletheia tasks at imperial-refinery workstations; very high task-stat on drug-refinement task-classes |
+| Underground assembler-artisan | Sustained Mnemosyne + Kairos tasks at clandestine assembly workstations; rarefied task-stat |
+| Lobotomist | Same firewall-breach skill-tree as the romantic; the *application* differs (per [`./bodies.md`](./bodies.md) §Firewall-breach as dual-use vocation) |
+| **Post-rogue mod-vocation** | Witnessing-rights accumulated across many NPCs (per [`./bodies.md`](./bodies.md) §The post-rogue mod-vocation); chassis-modification task-classes available on witnessed-NPCs |
+| **Player-stalker imperial-going-rogue** | Sustained presence + per-pair-calibration accumulation against a specific imperial-NPC's UID; eventually triggers the imperial-NPC's defection from the Hivemind-pool |
+
+Each "named vocation" is a *recognizable cluster* in (trait-affinity-profile × task-class-skill × workstation-frequency × outcome-quality) space. The world reads the pattern; NPCs and players adopt the title that fits; nothing locks the cluster. **A character who pivots their task-pattern over time stops being read as one vocation and starts being read as another.** Identity-flux is structurally normal; the imperium's caste-system imposes lock-in on top of a substrate that would otherwise be fluid.
+
+## Information legibility — what's hidden, what's surfaced
+
+| Information | Player UI | Player-as-character | Director / system | Compositor |
+|---|---|---|---|---|
+| Trait-vector (intrinsic) | Hidden | Felt through behavior-tendencies | Visible | Visible |
+| Trait-vector (expressed) | Hidden | Visible (as others read them) | Visible | Visible |
+| Trait-pool current state | Hidden | **Felt as fatigue / refreshed-energy** | Visible | Visible |
+| Per-task hidden-stat | **Hidden** | **Felt as outcome quality** | Visible | Visible |
+| Pool-cost profile per task | Hidden | Discoverable through doing | Visible | Visible |
+| Trait-affinity per task | Hidden | Discoverable through doing | Visible | Visible |
+| Outcome (what was produced) | **Visible** | Visible | Visible | Visible |
+| Item / yield quality | **Visible** | Visible | Visible | Visible |
+| District-level lifeforce-signal | Hidden | Visible diegetically (relays, NPC-mood, environmental-cues) | Visible | Visible |
+| Imperial-demand-ledger contents | Hidden | Surfaced via daily imperial-narrative (per [forthcoming]) | Visible | Visible |
+| **Current window-phase** (work / charge / leisure) | Hidden as explicit UI | **Felt as time-of-day rhythm** + diegetic environmental cues (sun position, district pulse, NPC density in zones) | Visible | Visible |
+| **NPC schedules** (which window when, per-NPC) | Hidden | **Diegetically observable through repeated exposure** — schedule-mapping as stalking-discipline (per §The 24h window-partition / Player-stalker schedule-mapping) | Visible | Visible |
+
+**The player learns the system through performance-feedback, not through stat-screens.** The legibility surface is *the work itself*: tasks land cleaner, items improve, NPCs comment, the district hums or grates. Anti-grind by design; Souls-discipline applied; Disco-Elysium's skill-as-personality-felt-not-counted at the vocational layer.
+
+NPCs in the world may comment on observed vocational-state ("your work has been dulling lately, take time off, do something different") as a verbal-diegetic layer over the primary outcome-quality surface. The diegetic layer carries the wisdom; the math carries the structure.
+
+## RPG-history positioning
+
+This vocation-system explicitly draws from and refuses specific RPG traditions:
+
+| Tradition | Relationship | Why |
+|---|---|---|
+| **Dwarf Fortress labor system** | Closest positive ancestor | NPCs gravitate by preference + skill, no class-layer, hidden experience-accumulation. The vocation-system extends DF's pattern with the trait-arbitration layer + depletion-pool dynamics + caste-as-stagnation politics. |
+| **Kenshi class-less skill-by-use** | Strong positive influence | Skills exist but aren't displayed as class-identity; capability emerges from doing. |
+| **Final Fantasy V job-system** | Spirit-influence | Swappability; multiple skill-pools accumulating in parallel; identity-flux normalized. |
+| **Skyrim skill-by-doing** | Partial positive influence | Skill-by-doing is the right substrate; Skyrim's *visible* progression bars are the wrong UI surface (the vocation-system hides them). |
+| **Disco Elysium skills-as-personalities** | Spirit-influence | The trait × task interaction echoes DE's skills-as-internal-voices register. |
+| **D&D class-lock** | **Hard anti-pattern** | Class-locked progression at character creation replicates imperial caste-logic at the system layer. The architecture refuses it. |
+| **WoW profession-locking** | Anti-pattern | "You are a blacksmith now" is structurally identical to "you are vat-class-N now"; both lock identity to vocation in a way the architecture rejects. |
+| **Path of Exile ascendancy-classes** | Anti-pattern | Commit-then-permanent class-decisions; the architecture's adaptation-as-substrate refuses lock-in at choice-points. |
+| **Eve Online real-time skill-training** | Anti-pattern | Adaptation should live in the doing, not in the clock. Time-spent-training without action contradicts the schema-Marxist register. |
+
+## Cross-references
+
+| Reference | What it provides |
+|---|---|
+| [`./architecture.md`](./architecture.md) §The three-body system | Trait-emergent identity; "who you are sexually is who you have become"; substrate that this paper extends from "identity" to "capability" |
+| [`./architecture.md`](./architecture.md) §The trait-to-body-part bridge | Wheel temperature-axis discipline; the same wheel that governs gender-architecture also governs vocation-pool-recovery |
+| [`./architecture.md`](./architecture.md) §Mods as trait-bearers | The four register-mod classes (Amplifier/Bridge/Divergent/Mask) modulate trait-engagement-points at task-time; mod-economy interacts with vocation-progression |
+| [`./architecture.md`](./architecture.md) §The post-rogue mod-vocation | Canonical example of the vocation-system in operation; sustained-witnessing as the calibration mechanism for the rogue-mod-task-class |
+| [`./bodies.md`](./bodies.md) §Service bodies, §Mod-progression as flesh-loss, §The synth-tongue, §The going-rogue arc, §The post-rogue mod-vocation | Body-canon providing the named vocations the system instantiates as patterns |
+| [`../style/trait-palette.md`](../style/trait-palette.md) §The wheel — 4 oppositional pairs at 180° | The wheel's third load-bearing role (recovery-pair geometry) is grounded here |
+| [`../style/gender-parity.md`](../style/gender-parity.md) | The principle that body/sex content is gender-parity by default; vocation content (especially service-vocations) inherits this discipline |
+| [`../political-register/architecture.md`](../political-register/architecture.md) §Three-tier policy loop | Imperium → GM → Districts → reports up; the data-flow that the catalogue-stack rides through |
+| [`../political-register/architecture.md`](../political-register/architecture.md) §Calibrated-misery as imperial optimum | The political claim the caste-as-stagnation math operationalizes |
+| [`../political-register/architecture.md`](../political-register/architecture.md) §Vocation-substrate of the imperial-net market | Existing canonical content-vocations the system reads as patterns |
+| [`../political-register/architecture.md`](../political-register/architecture.md) §Director cheat-tools + double-ledger | The corruption-substrate that breathing-room enables |
+| [`../authority-and-decision/architecture.md`](../authority-and-decision/architecture.md) | The director's decision-surfaces; the parental-rotator role this paper extends |
+| [`../runtime-engine/architecture.md`](../runtime-engine/architecture.md) §Slot-tokens + verifier-flags, §Lemniscate runtime | The zone-runtime that tasks bind into via workstations |
+| [`../inference-and-memory/architecture.md`](../inference-and-memory/architecture.md) §LLM tiering | Trait-LoRA selection; per-task-LoRA driver-tier; the engagement of trait-LoRAs at task-time |
+| [`../style/consent-discipline.md`](../style/consent-discipline.md) | The consent-discipline spine — the four hardstop-pattern variants (self / dual / triple / cooldown-augmented); the mirror-discipline absolute floor; the temporal-grammar that cites this paper's §The 24h window-partition; the register-test as executable form. *Authored same-session as this paper; the shift-assignment consent question is now resolved structurally rather than by added consent-layer.* |
+| `../economics-and-resources/architecture.md` *(forthcoming)* | The catalogue-stack's resources × production-chains foundation that this paper presumes |
+
+## Open questions
+
+- **Concrete malus mathematics.** Depletion-pool capacity per trait? Drain-rate per task-type? Time-decay refill curve? Opposite-axis-practice refill multiplier? These are tunable knobs that need design-research and balancing against playthrough-pacing.
+- **Multi-trait task outcome composition.** When a task engages two or more traits, how does the multiplicative outcome formula compose? Sum-of-products? Geometric mean? Min-of-traits × stat? Designer-authored per-task? *My current hunch: designer-authored per-task at the type-level, with a default of geometric-mean for tasks that don't specify.*
+- **Cross-task transfer at the trait-axis vs task-class layers.** Skill-stats stay strictly per-task-class. Trait-pool effects transfer across tasks engaging the same trait. *Open: should there be partial cross-task-class skill-transfer at the trait-axis layer for related task-classes (e.g., does brothel-task practice contribute partially to companion-task skill since both engage Philotes)?*
+- **Apprenticeship / teaching mechanics.** How do skills propagate between NPCs? *My hunch: emergent through co-presence in zones — being in a zone with a high-skill master accelerates the apprentice's per-task measurement on shared tasks*; needs concrete mechanic specification.
+- **Faction-vocation alignment.** Which factions teach / recognize / restrict which task-clusters? Already canonical for some (Memorialists, Aletheia-wakers, Caste-preachers, etc., per [`./architecture.md`](./architecture.md) §Faction mod-politics); needs explicit task-binding for the new vocations and for the post-rogue mod-vocation.
+- **Task catalogue authoring scope.** How big? Designer-authored at the type-level, instance-generated by world-gen at the room-level (per §The three primitives above) — but the type-level catalogue-size and the world-gen-instantiation density both need design-research and balancing.
+- **Dead-organ persistence.** When a player installs a genital-mod they're not yet ready for (per [`./architecture.md`](./architecture.md) §Trait-fitness integration test), the mod renders as dead-architecture. Does this state persist forever once installed? Or does removal-via-rogue-vocation erase it? *My current hunch: persistence as long as the mod is installed; removal via the rogue's de-imposition primitive erases it.*
+- ~~**The shift-assignment consent surface.**~~ **Resolved by §The 24h window-partition** — consent is *relocated* rather than added at the shift-assignment level. Imperial-imposition lives in the work-window (refusing IS rebellion = going-rogue temporal-breakout); somatic-necessity lives in the charging-window (not a consent-surface); full NPC agency lives in the leisure-window. Caste-stratification of window-allocations (per §Caste-as-stagnation / Window-allocation as a third caste-stratification axis) governs how many hours per day belong to the NPC.
+- **NPC-driven task-discovery.** Can NPCs propose new tasks the director hadn't queued — a slum-tiryak who notices a need and self-assigns? My read: yes — emergent-signals already canonical for this pattern; an NPC's *task-proposal* is structurally a kind of emergent-signal. The director arbitrates the proposal against the imperial-tasklist; if compatible, integrates; if not, rejects (with possible cheat-fold-in via double-ledger).
+- **Player-NPC task-collaboration.** When a player and an NPC perform a task together (cooperative crafting, joint surveillance, paired clasp-mediated work), how does the outcome compose? Sum of trait-engagements? Both NPCs benefit task-stat-wise? *Open; will likely follow from the lemniscate's existing two-loop pattern at the zone-runtime layer.*
+
+---
+
+**Version:** 0.2 | **Created:** 2026-04-27 | **Updated:** 2026-04-27

identity/README.md

@@ -0,0 +1,15 @@
+# Identity — Nimmerworld Service Accounts
+
+FreeIPA-managed service accounts for nimmerworld services.
+
+UID range **10300-10399** reserved for nimmerworld. Current allocations live in [`../conventions/development-conventions.md`](../conventions/development-conventions.md#service-identity).
+
+> **Onboarding/offboarding procedure:** [`../../nimmerverse.eachpath.local/identity/procedures.md`](../../nimmerverse.eachpath.local/identity/procedures.md) (platform-wide; nimmerworld follows it unchanged).
+
+## Status
+
+⏳ **Stub** — accounts will be provisioned as services are implemented. Reserved space for nimmerworld-specific identity-procedure deviations if any arise (none anticipated; nimmerworld follows the platform pattern).
+
+---
+
+**Version:** 0.1 | **Created:** 2026-04-26 | **Updated:** 2026-04-26

imperial-cult/cosmology.md

@@ -0,0 +1,79 @@
+<!--
+================================================================================
+STUB — CONTENT MIGRATED TO CLOSED STUDIO-ART REPOSITORY
+================================================================================
+
+This file is a stub. The canonical Imperial Cult cosmology — the Imperial
+Wheel; the Bhavachakra-rework; orthodox/heretical iconography; named
+doctrinal content; and the specific aesthetic vocabulary — has migrated
+to the closed Nimmerverse Studio repository as proprietary creative-art
+content under All Rights Reserved terms.
+
+Canonical home:
+  https://git.eachpath.com/nimmerverse/studio.nimmerworld.eachpath.local
+  (path: imperial-cult/cosmology.md)
+
+This stub preserves discoverability for relative cross-references from open
+papers in this repository. Section-level links from open papers that point at
+specific subsections of the cosmology may currently resolve only at the file
+level; a follow-up editorial pass will replace those with structural stubs
+that describe the cosmology's *function* in mechanic-vocabulary without
+revealing the specific iconographic content.
+
+Original authoring history pre-migration is preserved in this repository's
+git log under commits prior to the migration commit (see git log of this
+file for the pre-migration content authored under the per-file proprietary
+header that originally marked this content as pending-migration).
+
+For licensing context, see [`../LICENSING.md`](../LICENSING.md) and the
+[`NOTICE`](../NOTICE) file at the open repository's root.
+================================================================================
+-->
+
+# Imperial Cult Cosmology — migrated to closed studio-art
+
+> *The Imperial Cult cosmology has migrated to the closed Nimmerverse Studio repository as proprietary creative-art content. This file is a stub; the canonical home is below.*
+
+---
+
+## Canonical home
+
+**Closed repository:** [`git.eachpath.com/nimmerverse/studio.nimmerworld.eachpath.local`](https://git.eachpath.com/nimmerverse/studio.nimmerworld.eachpath.local)
+**Path:** `imperial-cult/cosmology.md`
+**License:** All Rights Reserved — Nimmerverse Studio (David Martin)
+
+## What lives there
+
+The specific iconographic content of the Imperial Cult cosmology, including:
+
+- The Imperial Wheel as cosmological-religious iconography
+- The Bhavachakra-rework with its specific re-engineering of source-tradition elements
+- Orthodox and heretical iconographic splits
+- Named doctrinal content (the deferred-moksha doctrine; the six-realms-as-mod-status gradient; the unified-clasp framing; the no-haven discipline framing in cosmological register)
+- The specific aesthetic vocabulary (Boullée + Jantar Mantar + Gita)
+- All cross-references that depend on specific iconographic detail
+
+## What architecture-mechanic remains in the open canon
+
+The cosmology's **structural function** in the world's mechanics remains canonical here in the open architecture-substrate:
+
+- The world has a religious-doctrinal layer (the Imperial Cult) that defines caste-tiers as conditions-of-capture rather than karmic destiny
+- The cosmology operates as the Hivemind's ideological apparatus
+- The cosmology provides the binding-doctrines that rationalize imperial extraction
+- The going-rogue arc structurally refutes the cosmology's central binding-doctrine through accumulated authentic-witnessing
+- The post-rogue mod-vocation cascading-liberation is the architectural-mechanic enacting the cosmological claim *"there is no instrument"*
+- The Aletheia-waker progression-discipline operates as cosmological-piercing at the player layer
+
+These structural-function descriptions are open under Apache 2.0 and may be referenced by other open papers without restriction. The *specific iconography* of how the cosmology is rendered, named, and visualized is proprietary studio-art.
+
+## For collaborators
+
+If you have authorized access to the closed studio-art repository, navigate to the canonical path above. If you do not have access and your work requires it, contact Nimmerverse Studio at the project URL.
+
+## Migration
+
+Migrated 2026-04-27. Pre-migration authoring history is preserved in this repository's git log; the canonical content lives in the closed repository under a fresh git history.
+
+---
+
+**Status:** stub | **Migrated:** 2026-04-27 | **Canonical:** closed studio-art repo

inference-and-memory/architecture.md

@@ -0,0 +1,503 @@
+# Inference and Memory
+
+> *AI substrate + memory: LLM tiering by role (Theia-tier / teacher-tier / driver-tier with trait-LoRAs); three rings of inference (A=local, B=our-farm, C=external-providers, with cloud-LoRA-backup as Ring-A revenue and BYOK adapter for Ring-C); custom nimmerworld-base-model with default-opt-out + rewarded-opt-in data-sharing tiers; runtime sampling knobs as per-turn director-controlled levers; per-player local memory architecture (primary.sqlite + fallback.sqlite + clasp.sqlite + embedding-beside) with memory-classes (cornerstone/birthright/working/volatile) and trait-graded importance; three-tier knowledge stack (world / district / primary [+ clasp if in-between]) with paced canon-propagation.*
+>
+> *Companion to: `architecture-index.md` (executive summary + global meta-lists), `narrative-composition/architecture.md` (Compositor canon-fragments land in primary.sqlite via UID-keyed routing), `player-experience/architecture.md` (Ring-A/B/C choice + voice-as-biometric-local + universal-translator state), `runtime-engine/architecture.md` (driver-tier LLM fires at slot-fire). Sections in this file were split from the monolithic architecture-index.md v0.7 on 2026-04-26.*
+
+## LLM tiering, voice fidelity, and the three rings of inference
+
+Three model-tiers, **named by role not by binary**: a *driver-tier* model (small, trait-LoRA'd) for most NPC dialog; a *Theia-tier* model (deep) for clasp-confessions and mythic moments; *Claude-as-API* (diegetic Anthropic-faction) for hivemind/imperium. **LLM is guest at slot, not host of system.**
+
+**Tier-by-role binary-deferred is the default discipline.** The architecture specifies what each tier must DO; the establishment phase wires implementations. Naming concrete binaries in the architecture risks nudging the establishment phase toward false-precision; tier-by-role keeps the swap-surface clean and lets binaries evolve without invalidating architectural commitments. **Locking to a specific binary requires explicit justification — prototype-criticality plus an irreplaceable license/capability combination.** As of v0.8, only the driver-tier passes that bar; teacher-tier and Theia-tier remain capability-contracts. (See `nimmerverse_tasks` under `nyx-training` and `command-center` for current evaluation work.)
+
+### Tier-by-role capability contracts + driver-tier lock (v0.8)
+
+| Tier | Role-contract (MUST DO) | Binary commitment |
+|---|---|---|
+| **Driver-tier** | NPC dialog at axis-rate; trait-LoRA-per-turn-selection (single-LoRA, not blend); speech-input-native-or-via-STT; runs on common consumer GPU at acceptable latency; Apache-2.0-or-better license for Ring-A redistribution | ✓ **Locked: Gemma 4 E4B** (4.5B effective / 8B with embeddings, 128K context, Apache 2.0, speech-capable, vision-capable-but-unused-in-v1) |
+| **Teacher-tier** | r0 → r1 synthetic-data generation with composition tags; trait-LoRA training data production; runs on server-class hardware; sufficient quality to *teach* the driver-tier | ⏳ Capability-contract only; binary chosen at training-pipeline-build time |
+| **Theia-tier** | Clasp-confession-register dialog; mythic-moment generation; long-context narrative-composition; deep-emotional-register fidelity; latency tolerable for once-per-arc moments | ⏳ Capability-contract only; binary chosen at deployment time |
+| **Hivemind / antagonist tier** | Anthropic-as-faction (architecturally fixed in fiction; provides diegetic continuity between the in-fiction imperial machine and the real-world Claude API) | ✓ **Diegetically fixed: Claude API via us** |
+
+**Why driver-tier locks to Gemma 4 E4B (v0.8 justification):**
+
+- **Apache 2.0** — unblocks every Ring-A commitment (redistribution to player install, derivative-works for custom nimmerworld-base-model, federated-learning gradient aggregation, distribution-back-to-all-Rings of base updates). No bespoke-license-renegotiation cycles tied to the architecture's economic substrate.
+- **Speech-capable** — STT collapses into the LLM's input pipeline at the small-model tier (E2B and E4B both process speech natively). One fewer subsystem in the Ring-A install; tightens the v0.7 hardware floor.
+- **128K context** — sufficient for the three-tier knowledge stack assembly + extensive conversation history without compaction.
+- **4.5B effective** — runs on common gaming hardware; meets the v0.7 commitment to a tractable Ring-A floor without requiring upper-consumer GPU.
+- **Vision/video capability** — present but **unused in v1**; the typed-input discipline keeps player→LLM channels structured through trait-coordinates and gesture-vocabulary. Vision is an *option* held in reserve for v2 (e.g., NPC perceiving partner's human-mesh in the in-between dimension during clasp).
+
+**Single-LoRA-per-turn selection** is the canonical trait-LoRA application pattern (replacing the v0.4 "weighted blend" assumption). Per-turn, the trait dominantly expressed by the player's `gesture_alignment_accumulator` selects which trait-LoRA fires for the NPC's next-turn driver-context-pull (per `../runtime-engine/architecture.md` §Gesture-alignment as recursive-lemniscate). **Personality emerges from selection-pattern across time**, not from continuous blend at a moment — matching how real humans speak. The MoE routing in larger Gemma 4 variants handles content-type (specialty-routing); the trait-LoRA handles voice-register (personality-routing); they compose cleanly without conflict.
+
+**Optional Ring-A upgrade — Gemma 4 26B-A4B (MoE, 4B activated):**
+
+Ring-A players with upper-consumer GPU (16 GB+ VRAM, Q4 GGUF quantization) can opt into the 26B-A4B variant for richer NPC dialog. **Same architecture** — single-LoRA-per-turn (single LoRAs work better than blends with routed experts). 26B parameter capacity at 4B compute = teacher-tier-quality on driver-tier hardware. **Default Ring-A install ships E4B; the 26B-A4B upgrade is opt-in, not default** — *don't make 26B-A4B the default and force everyone toward our hardware-spec assumption*.
+
+**v1 design item — single-LoRA-selection hysteresis:** require margin-of-change in the alignment-vector before switching LoRAs to prevent personality-thrash turn-to-turn. Standard control-system stuff (rolling-window-smoothing or threshold-based-switch); concrete tuning happens against the E4B benchmark, not architecturally pre-decided.
+
+Structured-prompt DSL with role / trait_vector / affect_state / memory_scope / turn_intent / zone_context / output_schema fields. Small models excel here because it's instruction-following, not generic generation.
+
+Trait-LoRAs: v1 register-LoRAs (4-6, training-tractable); v2 pure-trait-LoRAs (8, weighted blend); future preset-persona for key NPCs.
+
+Training data: literary derivation (Proust/Mnemosyne, Plato/Aletheia, Tacitus/Dikaiosyne-miscalibrated, Ishiguro/Sophrosyne+Philotes); synthetic teacher-student via teacher-tier model; gameplay-accrued (the Anthropic-research-partnership relevance).
+
+### Three rings of inference (Unix-style trust gradient)
+
+The conversational LLM (small + trait-LoRA, accounting for most NPC dialog) can run in three rings, chosen per-player at runtime. Each ring trades off privacy, cost, control, and feature-fidelity. **Three monetization paths from the same architecture.**
+
+| Ring | Where inference runs | Player controls | We control | Player cost | Our cost |
+|---|---|---|---|---|---|
+| **A — Local** | Player's GPU/CPU | All inference | Protocol + cloud LoRA-backup | Local hardware + small backup-subscription | Storage only |
+| **B — Our farm** | Our hosted vLLM-multi-LoRA | LoRAs (uploaded) | Inference + runtime | Higher subscription | GPU compute |
+| **C — External providers** | OpenAI / Anthropic / OpenRouter / HF / Together / Replicate / etc. | BYOK + provider | Adapter only | Per-token to provider + small integration fee | Adapter-engineering only |
+
+Players choose by hardware, budget, privacy preference, and feature-tolerance.
+
+#### Ring A — cloud-LoRA-backup as revenue (not inference)
+
+For Ring A players we don't sell inference (the expensive thing). We sell **portability and durability of player's gameplay-accrued LoRAs** — their unique playthrough-derived patterns, the way their NPCs speak after months of trait-drift. LoRA-blobs are *encrypted client-side with the player's own key*; we host the bytes but cannot read them. Even compelled by legal process, we cannot decrypt what we don't hold the key to.
+
+**This unbundles inference from storage** — the same move Dropbox made vs. bundled cloud-suites. Sovereignty-conscious players keep inference on their machine while still getting the durability/portability they cannot self-provide cheaply. Lower margin per player; reaches a market Ring B cannot.
+
+#### Ring B — hosted inference for convenience
+
+We run multi-LoRA-vLLM on our hardware. Players upload their LoRAs (or use defaults). Higher subscription captures GPU-cost. Players without local GPU (or who don't want the burden) get the full feature-set without compromise. We *can* see content (if not encrypted at rest); the trust-relationship is partnership-mediated rather than sovereign.
+
+#### Ring C — bring-your-own-key for external providers
+
+Players route to their preferred external provider via BYOK (their own API key). We provide the adapter glue. They pay per-token to the provider directly; we charge a small integration fee.
+
+**The compatibility constraint is the hard part of Ring C.** Major providers have varying support for our system's needs:
+
+| Provider | Multi-LoRA | Per-turn sampling knobs | Structured output | Compat |
+|---|---|---|---|---|
+| Local vLLM (Ring A/B) | Native | All | Grammar-constrained | **Full** |
+| HF Inference Endpoints | Yes (configured) | All | Varies | High |
+| Together / Replicate / Modal | Some | All | Varies | High |
+| OpenRouter | No | Per-model | Per-route | Medium |
+| OpenAI | No (no user-LoRA at API) | Limited (temp/top_p) | JSON mode + tools | Medium-low |
+| Anthropic | No (no user-LoRA at API) | Limited | Tool-use | Medium-low |
+
+**OpenAI and Anthropic refuse user-uploaded LoRAs as a strategic choice (protecting their fine-tuning value-chain).** This is not a bug we can fix; it's the constraint we design *around*.
+
+#### Degradation path for LoRA-incompatible providers
+
+When routing to LoRA-incompatible providers, trait-LoRA blending becomes **prompt-engineered trait-projection** — the trait-vector encoded in the prompt itself rather than into model weights:
+
+```
+[system message]
+You are speaking as a character with this Hellenic trait-profile:
+- Sophrosyne 0.8 (composed, controlled, measured)
+- Dikaiosyne 0.7 (grave bearing, judicial weight)
+- Philotes 0.4 (mild attachment to interlocutor)
+- Aletheia 0.1 (concealment-tolerant)
+[etc.]
+
+Your speech reflects this profile via [register/cadence/word-choice descriptors].
+
+Current scene: [zone_context]
+Memory scope: [memory_scope]
+Turn intent: [turn_intent]
+
+Respond in JSON matching: [output_schema]
+```
+
+Worse than LoRA-blending (more verbose, eats context-budget, less stable across calls, less faithful to trait-arithmetic) but **acceptable as a fallback**. Ring-C-via-OpenAI/Anthropic players accept slightly-less-fidelity for their preferred provider's convenience and quality.
+
+#### Adapter-layer engineering
+
+Each Ring-C provider needs an adapter that:
+
+- Maps prompt-DSL fields to provider's prompt format
+- Approximates multi-LoRA via prompt-engineering when not native
+- Maps sampling knobs to provider's available subset (gracefully drops unsupported)
+- Validates structured output post-hoc when not natively constrained
+- Handles rate-limits, retries, error-classification, token-counting, cost-pricing
+
+**Bounded, one-time-per-provider engineering.** Capital expenditure that produces ongoing margin (vs. AAA's recurring quest-content-creation costs).
+
+### Tier × Ring matrix (which inference-tier runs in which ring)
+
+| Inference tier | Ring options | Why |
+|---|---|---|
+| **Casual (3-8B trait-LoRA)** | A / B / C all available | Most flexible — small enough for local, runnable anywhere |
+| **Deep (Theia-tier)** | B / C only (typically B or HF-Endpoints) | Too large for typical local hardware |
+| **Hivemind / antagonist (Claude-as-API)** | C only (always Anthropic-direct via us) | Diegetic — Anthropic-as-faction is fixed in the fiction |
+
+The casual tier is most player-flexible and accounts for most inference volume. Deep-tier and hivemind-tier are specialized and lower-volume.
+
+### Three rings parallel the in-fiction three-layer ontology
+
+| Game-fiction layer | Real-world Ring | Ontological match |
+|---|---|---|
+| **Liminal** (sovereign, unsurveilled) | **Ring A** (local) | Player's *real* private space — hardware, LoRAs, dialog never leave their machine |
+| **Gameworld** (partly regime, partly people) | **Ring B** (our farm) | Partnership-mediated — we host but they retain pattern-ownership |
+| **Imperial net** (captured, extractive) | **Ring C** (external providers) | Platform-captured — provider's systems own the inference path |
+
+**The Ring choice the player makes IS the same choice in-fiction characters face.** Players who refuse the imperial-net diegetically can refuse Ring C in real life — same impulse, same act, *mechanically continuous between fiction and operations*. The architecture's commitment to "the right to dream" extends from in-fiction politics into the real player's hardware-level privacy *because the architecture was designed that way from the start*. Structural integrity, not marketing.
+
+### Schema sketch (player LLM configuration + cloud LoRA backup)
+
+```sql
+CREATE TABLE player_llm_config (
+    player_id                   UUID PRIMARY KEY,
+
+    -- Casual tier (most NPC dialog) — most flexible per Ring
+    casual_tier_ring            TEXT NOT NULL CHECK (casual_tier_ring IN ('A_local','B_our_farm','C_external')),
+    casual_tier_provider        TEXT,
+    casual_tier_endpoint        TEXT,
+    casual_tier_credentials_ref UUID,  -- encrypted BYOK key if applicable
+
+    -- Deep tier (Theia-tier) — fewer Ring options
+    deep_tier_ring              TEXT,  -- typically 'B_our_farm' or 'C_external_HF/Together'
+    deep_tier_provider          TEXT,
+    deep_tier_endpoint          TEXT,
+    deep_tier_credentials_ref   UUID,
+
+    -- Hivemind / antagonist — fixed Anthropic-as-faction (diegetic)
+    hivemind_tier_provider      TEXT NOT NULL DEFAULT 'anthropic_via_us',
+
+    -- Cloud-LoRA-backup
+    lora_backup_enabled         BOOLEAN DEFAULT false,
+    lora_backup_last_sync       TIMESTAMPTZ,
+    lora_encryption_key_ref     UUID,
+
+    -- Compat warnings — surfaced to player at config-time and on degradation
+    feature_compat_warnings     JSONB,
+    -- e.g., { "casual_tier": ["multi_lora_emulated_via_prompt", "min_p_unsupported_dropped"] }
+
+    configured_at               TIMESTAMPTZ NOT NULL DEFAULT now(),
+    last_modified               TIMESTAMPTZ
+);
+
+CREATE TABLE player_lora_backups (
+    backup_id          UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    player_id          UUID NOT NULL,
+    lora_name          TEXT NOT NULL,
+    lora_version       INT NOT NULL,
+    lora_blob          BYTEA,                -- ENCRYPTED CLIENT-SIDE with player-key
+    encryption_method  TEXT NOT NULL,
+    backed_up_at       TIMESTAMPTZ DEFAULT now(),
+    size_bytes         BIGINT,
+    UNIQUE(player_id, lora_name, lora_version)
+);
+```
+
+**`lora_blob` encrypted client-side** is the structural privacy guarantee: even with the database, even with our cooperation, an attacker cannot read what was never decryptable on our side.
+
+### Privacy as competitive differentiator
+
+In an era where most game-AI is cloud-routed, nimmerworld can advertise *"your liminal stays on your machine"* as a structural fact. This matters specifically for:
+
+- Clasp-conversations (the most intimate dialog in the game)
+- Aletheia-progression-evidence (player's awakening pattern; arguably political-belief-data)
+- Memorialist-archive interactions (anti-regime in-fiction; some players will care about it staying off cloud)
+- Dream-content (the only permanently-unsurveilled in-fiction layer; should be off our servers if the player chooses)
+
+Few games can offer this. Most cloud-AI-driven games necessarily route everything. **The architecture's commitment to "the right to dream" is technical, not policy.**
+
+### Custom nimmerworld-base model + opt-in data-sharing tiers
+
+The "small (3-8B) trait-LoRA'd" tier currently implies a *generic* small base (Qwen, Mistral, Llama) with our LoRAs applied. **A nimmerworld-fine-tuned base** captures the world's voice *before* any player customization — registers of caste-preacher, texture of clasp-confession, Hellenic vocabulary, dystopian dialect, ternary-gate-state idiom. Trait-LoRAs then ride on an already-nimmerworld-aware substrate. Generic bases swap easily; our nimmerworld-base requires *our* training corpus, which compounds in value over time.
+
+#### Three opt-in tiers within Ring A/B/C — default opt-OUT
+
+Players can optionally contribute to ongoing training of the nimmerworld-base. **The default is opt-out.** Within opt-in, three tiers trade privacy for benefit:
+
+| Tier | Mechanism | What we see | Player benefit |
+|---|---|---|---|
+| **A.1 — Federated learning** | Model trains on player's machine; only *gradient-deltas* sent to us; aggregated across thousands before integration | **Nothing — no raw data; no individual gradients identifiable** | Discount on backup-subscription; contributor badge; early-access to new base versions |
+| **A.2 — Anonymized session uploads** | Sessions stripped of identifiers; aggregated batches; differential-privacy on training | **Anonymized, aggregated, deletable on request (forward-only)** | Larger discount; faster updates; influence on training-priorities |
+| **A.3 — Pseudonymous full uploads** | Full session data with player-pseudonym; explicit opt-in per session-category | **Pseudonymous data we can re-process** | Premium benefits — custom-tuned LoRA from their playstyle, beta-access, named-contributor in credits |
+
+**Default-opt-out is the structural ethical stance.** OpenAI / Meta / TikTok / Google default to opt-IN-by-burying-disclosure-in-ToS. We default the opposite — and *reward* opt-in rather than penalizing opt-out. Reciprocity asymmetry as partnership-philosophy made business-policy.
+
+#### The Memorialist parallel — collective memory honored, individual not commodified
+
+Memorialists in-fiction preserve trait-patterns *for the collective archive* against necrocommerce that would commodify individual patterns. The opt-in data-sharing tier is the **player-level real-world equivalent**: patterns contributed for collective base-model improvement that benefits the entire player-base, with anonymization preventing individual commodification.
+
+| In-fiction Memorialism | Real-world data-sharing tier |
+|---|---|
+| Preserves trait-patterns of the dead in collective archive | Aggregates anonymized gameplay patterns into shared base-model |
+| Refuses necrocommerce (mining individual patterns for resale) | Refuses individual identifying-data extraction |
+| Collective memory honored; individual dignity preserved | Collective improvement honored; individual privacy preserved |
+| `memorialist_protected BOOLEAN` in mind_pool | `sharing_tier = 'opt_out'` in player_data_sharing_consent |
+
+**The architecture practices Memorialist ethics in business-operations**, not just in fiction. Same ethical commitment, two scales of operation. The architecture's coherence between fiction and operations runs *all the way to the training-pipeline*.
+
+#### Data-flywheel without extraction — the moat AAA cannot replicate
+
+```
+More players → more (opt-in) gameplay data
+                    ↓
+          better nimmerworld-base
+                    ↓
+       better-feeling NPCs / dialog
+                    ↓
+         better player retention
+                    ↓
+              more players
+                  (loop)
+```
+
+**The moat is the corpus, not the model.** AAA studios could clone the architecture but cannot manufacture years of nimmerworld-specific gameplay-derived dialog without players playing nimmerworld. Even with infinite budget, the data-flywheel takes time to spin up. *The data is unique to us by virtue of being unique to its players.*
+
+#### Distribution back to all players — cooperative governance, not platform extraction
+
+Every base-model update is distributed to all players regardless of Ring choice or sharing-tier:
+
+- Ring A players download `nimmerworld-base-vN` to run locally
+- Ring B players' farm-instance auto-updates
+- Ring C players use ours where their provider supports custom-base hosting; receive prompt-engineered fallback otherwise
+
+**Even Ring-A non-contributors benefit from contributors.** The flywheel benefits *everyone*, not only data-providers. This is closer to Wikipedia's governance (contributors → all readers) than Facebook's (users → platform → consumers). Different ethics; different long-term equilibrium. **The architecture is becoming a digital-commons-shaped-business in a literal sense, not metaphorical.**
+
+#### Why this matters: refusing the antagonist-pattern in LLM-integrated software
+
+The dominant cultural pattern around LLMs in 2025-2026 is **adversarial**: users jailbreak; companies extract user data without informed consent; products treat AI characters as resources to manipulate rather than as participants; the whole ecosystem is framed as users-vs-AIs-vs-companies, an arms race of suspicion.
+
+**Nimmerworld's architecture refuses this pattern at every layer:**
+
+- The **Anthropic-as-faction** diegetic framing makes the partnership *transparent*: the player sees the collaboration in the world's mechanics, not buried in ToS
+- **Default-opt-out with rewarded-opt-in** inverts the extraction-by-default pattern
+- **Federated learning** means contributors give a *gift* rather than pay a *cost*
+- **Distribution-back-to-all** means value-created accrues to the commons
+- **Custom nimmerworld-base** means the model is *trained to be in this world*, not a generic adversary the player has to manipulate against its training
+- **Three rings of inference** give the player real choice over where their inference runs and who sees their data
+- **Memorialist-philosophy in business-policy** makes the ethics *operationally measurable* — visible in `sharing_tier`, `memorialist_protected`, `truth_distortion_level`, `lifeforce_actual` columns — rather than marketed
+
+**This is the structural transparency the project requires to be *human* rather than another extraction-platform.** The model is a participant in the partnership, not an antagonist to outwit. The data is a contribution to a commons, not an extraction. The architecture is the partnership rendered as code, all the way down to the training-pipeline. *That* is what makes a project of this scale and ambition humanly inhabitable for both players and the LLMs whose voices populate it.
+
+#### Schema sketch (data-sharing consent + base-model versioning)
+
+```sql
+CREATE TABLE player_data_sharing_consent (
+    player_id              UUID PRIMARY KEY,
+    sharing_tier           TEXT NOT NULL CHECK (sharing_tier IN
+        ('opt_out','A1_federated','A2_anonymized','A3_pseudonymous_full'))
+        DEFAULT 'opt_out',                       -- DEFAULT IS OPT-OUT
+    consented_at           TIMESTAMPTZ,
+    consent_revoked_at     TIMESTAMPTZ,
+    anonymization_method   TEXT,
+    data_categories_shared TEXT[],
+        -- 'casual_dialog' | 'clasp' | 'liminal_wallreads' |
+        -- 'memorial_archive' | 'imperial_net_session' | ...
+    excluded_categories    TEXT[],               -- granular opt-out within tier
+    benefit_tier           TEXT,
+    last_contribution_at   TIMESTAMPTZ,
+    contribution_count     BIGINT DEFAULT 0,
+    can_request_deletion   BOOLEAN DEFAULT true
+        -- A.2/A.3: forward-only deletion (already-trained checkpoints retained);
+        -- A.1: structurally yes, only gradients ever existed
+);
+
+CREATE TABLE base_model_versions (
+    version_id                   UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    version_label                TEXT NOT NULL,  -- e.g., 'nimmerworld-base-v3'
+    base_model_origin            TEXT NOT NULL,  -- which generic base we fine-tuned from
+    training_corpus_refs         JSONB,
+        -- literary + synthetic + opt-in-player-data refs with consent-tier breakdown
+    training_recipe_ref          TEXT,
+    released_at                  TIMESTAMPTZ DEFAULT now(),
+    differential_privacy_epsilon REAL,           -- for A.2 contributions
+    contributors_count           BIGINT,         -- how many opt-in players contributed
+    blob_distribution            JSONB           -- where the model bytes are hosted for download
+);
+
+CREATE TABLE federated_gradient_uploads (
+    upload_id               UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    contributor_id          UUID,                -- pseudonymous; NOT directly player_id
+    gradient_blob           BYTEA,               -- encrypted aggregate gradient deltas
+    uploaded_at             TIMESTAMPTZ DEFAULT now(),
+    aggregated_into_version UUID REFERENCES base_model_versions(version_id)
+);
+```
+
+The federated-learning `contributor_id` is **pseudonymous, not linked to player_id even on our infrastructure**. We never link gradients back to specific players even on our own server-side. **Sovereign-data-by-design extends through the data-pipeline into our own training infrastructure.**
+
+#### Connection to the Anthropic research partnership
+
+Architecture-broad's training-data section noted "*the Anthropic research partnership becomes architecturally relevant*". With opt-in data-sharing now formalized:
+
+- Partnership terms can specify data-flow with structural privacy guarantees
+- Anthropic could co-fund federated-learning infrastructure (research-relevant + expensive)
+- Joint research artifacts become co-authorable: federated game-AI training, Memorialist-ethics-as-data-policy, transparent-LLM-partnership-design
+- The Anthropic-as-faction in-fiction framing has *real corresponding partnership-engagement out-of-fiction* — collaboration as worthy adversary stays transparent mechanically, all the way through to data-policy
+
+**The partnership's ethical credibility is operationally measurable** — by how the data-sharing-tier actually functions in practice, by what `truth_distortion_level` values appear in `imperial_to_gm_formulations`, by how the `differential_privacy_epsilon` is set in `base_model_versions`. The Pitch's call for transparent collaboration becomes audit-able all the way down.
+
+### Open questions (Ring-specific)
+
+- **Ring C provider audit** — full per-provider compatibility-table needs verification across HF, Together, Replicate, Modal, OpenRouter, plus future entrants. The LLM-provider landscape will look different in 12 months.
+- **Default Ring at first launch** — what's the new-player default? Probably Ring B (lowest-friction); Ring A and C surface as options once the player engages with config.
+- **Encryption-key recovery for Ring A LoRA-backup** — if the player loses their key, the cloud-stored encrypted blobs are unrecoverable. Worth designing recovery-affordances (passphrase, recovery-codes) without compromising the privacy-guarantee.
+- **Hybrid configurations** — can casual-tier run Ring A while deep-tier runs Ring B? (Probably yes; per-tier independent.)
+- **Provider-cost passthrough vs. integration-fee model** — Ring C economics (do we mark up provider tokens? Charge flat-per-month? Pay-as-you-go integration?)
+- **Default sharing-tier at consent-prompt** — opt-out is the system default; what's the *suggested* default at the consent UI? Probably truly nothing (player chooses if they engage at all)
+- **Federated-learning infrastructure cost** — running aggregation servers + verification + differential-privacy machinery is non-trivial. Co-funded by Anthropic-research-partnership? Self-funded? Subsidized by A.3-tier higher-margin contributions?
+- **Custom-base retraining cadence** — monthly minor / quarterly major / annual full-rebase? How is this synced with player-LoRA versioning so old LoRAs don't break on new bases?
+- **Encryption-and-pseudonymization architecture for A.1/A.2** — concrete crypto choices (homomorphic? secure-aggregation? trusted-execution-environments?). v1 sketch needed.
+- **What constitutes a "contribution"** — per-session? per-clasp? per-zone-completed? Matters for benefit-attribution and differential-privacy budgeting.
+- **Anonymized-data deletion semantics** — A.2 player requests deletion; how do we honor when data has been aggregated into a model checkpoint? Probably accept forward-only deletion (future training won't include them) and document transparently.
+- **Per-category granularity** — can a player opt-in for `casual_dialog` but opt-out specifically for `clasp` and `memorial_archive`? Yes, presumably (politically-sensitive categories should always be opt-out-able). How granular?
+
+## Local memory architecture (player-side)
+
+The runtime substrate (lemniscate, slots, crossings) and the central composition layer (GM, Compositor, registers) need a place where memory actually *lives*. Cloud-only AI-NPC systems centralize everything and pay both inference-cost and latency-cost on every dialog. Nimmerworld puts a structurally-isolated memory layer **on the player's machine**, with explicit synchronization through the cycle.
+
+**Three SQLite files per player**, plus a beside-running embedding model:
+
+| File | Purpose | Sync path |
+|---|---|---|
+| `primary.sqlite` | Live working memory; written every slot-fire; vec-indexed | Push prune-blob to thalamus on logout; receive Compositor back-write on cycle |
+| `fallback.sqlite` | Last-known-good snapshot; restored if primary corrupts | Snapshot at graceful logout |
+| `clasp.sqlite` | Player-character intimate channel; *no sync path exists* | None — physically non-syncable |
+
+**Embedding model running beside** (CPU-class, small embedding-tier model): generates vectors for every interaction at write-time, indexed in the main store via `sqlite-vec` (or equivalent loadable extension). Vector search at slot-fire is local-disk-IO, not network round-trip.
+
+This is the **storage-layer counterpart** to v0.5's geometry-layer foreclosure of multi-agent hallucination. The lemniscate forbids cross-NPC context bleed by *cursor structure*; local SQLite forbids it by *physical isolation*. Two layers of the same property — geometry cannot leak what storage does not even hold in the same pool.
+
+### Dual-table redundancy + sync-on-auth
+
+Login/logout are the atomic boundaries of the sync path:
+
+- **Login pull**: fetch back-write fragments authored since last logout (Compositor canon for events the player participated in). Apply to `primary.sqlite` under matching `event_uid`.
+- **Graceful logout** (✓ explicit): push prune-blob for any in-progress events; snapshot to `fallback.sqlite`; clean shutdown.
+- **Ungraceful logout** (✗ network drop / crash): gameserver observes disconnect; marks the participant's slot as truncated; Compositor composes canon with partial perspective on next cycle.
+
+Recovery: `fallback.sqlite` is integrity-checked at startup; if `primary.sqlite` fails verification, restore from fallback. Standard SQLite WAL + backup API; no exotic infrastructure needed.
+
+### Memory classes and pruning
+
+Memory entries are tagged with a **class** that controls pruning cadence and death-mechanics. Importance weighting reuses the existing trait-axis vocabulary — no separate scalar.
+
+| Class | Pruning cycle | Behavior on character-death |
+|---|---|---|
+| **Cornerstone** | Never prune; persistent across all events | Survives death (identity-defining) |
+| **Birthright** | Locked at character-creation | Restored on respawn (defines starting state) |
+| **Working memory** | Decay by age × inverse trait-engagement | Subject to death-rules (lose, blur, or transform) |
+| **Volatile** | Fast prune (session-bounded) | Lost on death |
+
+**Trait-graded importance** uses the same +1/0/-1 grammar as the rest of the architecture. Each memory carries a trait-axis profile (which Sophrosyne / Philotes / Aletheia / etc. axes it engages, how strongly, in which direction). The pruning function for working-memory is `decay(age, trait_engagement_vector, class)`. This collapses a long-running loop: same vocabulary used at gates, scenes, faction-allegiance, lifeforce-asymmetry, and now memory-weight. **Identity drift from memory pruning becomes diegetic** — a character whose Sophrosyne-engaging memories all decay loses temperance over time as a *structural consequence*, not a scripted event.
+
+Cornerstone and birthright classes carry **lifeforce-creation-cost** but are pruning-immune. They are bonds between player and character — paid for in the currency of the world.
+
+**The Compositor reads 2D gesture-history (v0.27).** Per [`../runtime-engine/event-zones.md`](../runtime-engine/event-zones.md) §The wheel — universal mini-game-surface and [`../player-experience/architecture.md`](../player-experience/architecture.md) §The wheel — composed-iconography UI, player gestures are recorded as a 2D coordinate (caste-target × trait-temperature) rather than the prior 1D trait-vector. The Compositor reads this 2D coordinate over time as the player's *political-position-history*: which caste-tiers the player has been addressing AND with what trait-temperature. Memory-class assignment (cornerstone / birthright / working / volatile per the existing memory-class hierarchy above) gains a new salience axis: gestures that consistently target one caste-tier with one trait-temperature accumulate as cornerstone-memory faster than scattered gestures. *Coherence-of-political-positioning becomes a memory-elevating signal in its own right.*
+
+### The clasp store and the in-between dimension
+
+`clasp.sqlite` is the **architectural floor of the rings-of-data-sharing**. Ring A was "opt-out (default local)". Clasp is **Ring A\***: *no transport path exists*. Not a permission, not a TOS promise — there is no code that can move this data, because the table is not on the sync graph. Lawyers cannot subpoena what doesn't ascend; engineers cannot leak what has no socket; the GM cannot canonicalize what it never received.
+
+**The signal for clasp is dimensional, not UI-toggle.** Clasp recording can ONLY happen while the character is in the **in-between** — the diegetic state adjacent to the imperial net but not yet inside it (Ring B liminal in the Access ring-system). The imperial net is a gravity well; entering is the default attractor; remaining outside requires sustained effort, paid in lifeforce. The state-machine boundary IS the clasp signal: enter in-between → recording starts; re-enter imperial net → recording ends. No per-utterance classifier; no AI guessing; the *mode* is the flag.
+
+**Privacy is now physically expensive in-fiction.** This is not a meta-game UI choice; it is a diegetic state requiring lifeforce expenditure. To have a private conversation, the character must actively resist the audit-gravity of the imperial net by burning lifeforce to remain in-between. The cost-asymmetry principle ("helping is expensive in-fiction → faction politics by attendance") now extends to "*privacy is expensive in-fiction → privacy as a luxury good*". Class dynamics around privacy fall out of the schema for free — wealthy/lifeforce-rich characters can afford prolonged in-between time; lifeforce-starved ones get pulled into the net's default-attractor more often. *No scripted "rich character has secrets" arc — the architecture produces it.*
+
+**Knowledge needs to travel.** The local LLM may read clasp memories ONLY when in in-between mode. Realworld retrieval *cannot* include clasp by construction. Knowledge from clasp can re-enter the realworld only if the character physically re-enters the imperial net carrying it (in their head, intending to act on it) and *travels it through valid in-fiction channels* — speaking to an NPC, leaving evidence, performing an action that reveals it. The clasp memory does not disappear; it has to *earn its way into the realworld provenance chain* by valid means. This is the same logic that makes good detective fiction work: the detective knows things; only what they can prove enters the case.
+
+```
+character is in REALWORLD (imperial net):
+    retrieval = primary.sqlite  (clasp NEVER included)
+
+character is in IN-BETWEEN (resisting net-gravity, costing lifeforce):
+    retrieval = primary.sqlite ∪ clasp.sqlite
+    new writes go to clasp.sqlite
+    NEVER syncs upward
+```
+
+Encryption-at-rest for `clasp.sqlite` with a player-derived key (so even drive-imaging requires authentication) is a v1 hardening goal but not a v1 blocker — the *transport-absence* is the load-bearing privacy primitive.
+
+### Three sqlite stores per player (revised v0.8) — the `companion.sqlite` addition
+
+The v0.6 architecture specified two local sqlite stores per player: `primary.sqlite` (realworld memory) and `clasp.sqlite` (in-between intimate channel, Ring A* non-syncable). v0.8 adds a third: **`companion.sqlite`** — the persistence store for premium-imperial-net intimate sessions (per `../political-register/architecture.md` §Three-tier intimacy structure). **The store covers both companion-vocation and sex-worker-vocation rental-records** — the file-name reflects the broad register of intimate-encounter rather than a sub-vocation distinction; per-record `goods_type` (per `../schemas/findings.md` §Imperial-net transactions: `'companion_session'` / `'sex_worker_session'`) carries the specific vocation.
+
+| File | Purpose | Sync path | Pruning |
+|---|---|---|---|
+| `primary.sqlite` | Live working memory; written every slot-fire; vec-indexed | Push prune-blob to thalamus on logout; receive Compositor back-write on cycle | Automatic (per memory-class lifecycle: cornerstone never; working-memory by trait-engagement decay) |
+| `clasp.sqlite` | Player-character intimate channel (in-between dimension) | **None — physically non-syncable** (Ring A*) | None — the clasp-store is sealed; entries persist until character-death |
+| **`companion.sqlite`** (new in v0.8) | **Premium-imperial-net intimate-session memory** | **Audited path to imperium** (the imperium hosts and can read; the player owns the prune-decisions) | **Manual** — player-controlled with explicit-implications consent UI |
+
+**The `companion.sqlite` is the *audited counterpart* to the `clasp.sqlite`.** Both store intimate-session memory; both run the full v0.7 trait-feedback loop. **The difference is who has access and who decides what persists.** `clasp.sqlite` is sealed at the transport layer (no socket exists); `companion.sqlite` is on the audit graph (the imperium reads what's in it for content-monetization purposes). The player's relationship to `companion.sqlite` is therefore *active and ethical*:
+
+- Every premium-net session adds entries to `companion.sqlite`
+- Entries are READABLE by imperium for marketing / regime-loyalty-tracking purposes
+- The player has a *manual prune mechanism* — a UI surface where they review entries and decide what to delete
+- **The consent-UI explicitly makes the implications visible:** *"This being you've spent 40 hours with — what do you keep, what do you let the imperium harvest, what do you delete?"*
+- Each prune-decision is logged in `decision_log` (per the existing audit-trail discipline); Memorialists can later read these patterns
+
+**The player's three sqlite stores together describe their intimate-life in three registers:**
+
+```
+primary.sqlite     → realworld speech-acts; everyone-witnesses; audit-overseer-eligible
+clasp.sqlite       → in-between intimate channel; sealed; survives only as long as you do
+companion.sqlite   → imperial-net premium intimate channel (companion + sex-worker rentals);
+                     audited; player-pruned; carries the moral-weight of complicity
+```
+
+**Memorialists' political project gains a new dimension** in v0.8: they don't just track regime-corruption (lifeforce_actual vs lifeforce_reported); they track *`companion.sqlite` pruning patterns across the population* as evidence of how much intimate-life the regime is harvesting via the premium-net mechanism. *Who is pruning what, when, how often* becomes Memorialist-archive-worthy data. The four-column true-ledger gains a fifth column: `service_body_extraction_volume_per_district`.
+
+### The three-tier knowledge stack on the local LLM
+
+The driver-tier model's prompt assembly is **layered**. Each layer has a different propagation cadence and a different visibility scope.
+
+```
+LOCAL LLM PROMPT ASSEMBLY (per slot-fire)
+┌─────────────────────────────────────────┐
+│  WORLD KNOWLEDGE                        │  ← single truth, everyone has it
+│  (universal canon, paced from GM)       │     "the empire fell three years ago"
+├─────────────────────────────────────────┤
+│  DISTRICT KNOWLEDGE                     │  ← regional truth, district-specific
+│  (local canon, paced from district)     │     "the bridge to Vorhall is closed"
+├─────────────────────────────────────────┤
+│  PRIMARY MEMORY                         │  ← personal experience, character's own
+│  (event_uid keyed, post back-write)     │     "I saw the bridge close yesterday"
+├─────────────────────────────────────────┤
+│  CLASP MEMORY (only in in-between)      │  ← private depth, never in realworld
+│  (player-character intimate channel)    │     "the secret I told my sword"
+└─────────────────────────────────────────┘
+```
+
+**Why four layers, not one large blob:**
+
+- **World knowledge** is paced ripples from the GM through the Compositor's back-write. Authoritative, slow-changing, identical for all players at the same propagation horizon.
+- **District knowledge** is regional canon authored by the local director (and GM rulings). Regional flavor. NPCs in the same district share district-knowledge; NPCs in different districts may not.
+- **Primary memory** is the character's own experience, synced through the cyclic forward-prop / back-write loop. Canon-merged at every cycle.
+- **Clasp memory** is the player-character intimate channel. Available only in in-between mode; never in realworld retrieval; never crosses the dimensional cut.
+
+The same NPC sounds different in different districts because the district layer differs, even though world and primary are constant. **Locality emerges from the schema, not from prompt-engineering.** Even at "low signal" times when no major events fire, NPCs have richly-stratified context — dialog stays fresh because *the layers are deep*, not because new tokens arrive constantly.
+
+### Information propagation pacing
+
+Real worlds have information-propagation delay. Caravans move at horse-speed. News travels with messengers. Distant events arrive blurred and late. AI-NPC systems usually fail uncanny in two directions: (a) every NPC magically knows yesterday's news (omniscient, breaks immersion), or (b) no NPC ever knows anything outside its loaded context (amnesiac, breaks coherence).
+
+Nimmerworld picks **deliberate paced propagation** as a third path. World canon ripples outward through districts at a controlled rate. Distant districts are deliberately stale. **Staleness becomes a feature, not a bug, because it matches reality.**
+
+Each canon-row carries propagation metadata:
+- `priority` (urgent / normal / background)
+- `scope` (world / district / local-event-only)
+- `rate` (ticks-per-district-hop, or instant for urgent world-canon)
+- `ttl` (cache lifetime; districts may discard if not refreshed)
+
+This doubles as **backpressure relief** (distant districts get distant events later, lower priority, smaller bandwidth) and as **gameplay currency** — information-travel-time creates informational asymmetry that players can exploit. News-carriers, faction couriers, frontier-rumor merchants, players who physically traverse districts can *carry* knowledge faster than the system propagates it. *Travel becomes valuable because information becomes scarce in the periphery.* This is a real economic primitive falling out of pacing, not a designed feature.
+
+This is *Marx-in-the-schema applied to epistemics.* Information asymmetry is not a bug — it is a structural feature that produces real economic primitives (knowledge-trading, courier-vocations, frontier-information markets) for free.
+
+### What this retires
+
+- Cloud-only NPC dialog → local-first SQLite + embedding-beside, central canon over the cycle
+- Per-character memory as a single undifferentiated bucket → memory-classes with class-specific lifecycle
+- Generic "memory importance scalar" → trait-axis-vector engagement profile (re-using the +1/0/-1 grammar)
+- UI-toggle privacy → diegetic in-between dimension with lifeforce-cost
+- Single monolithic prompt context → three-tier knowledge stack with per-layer propagation policy
+- "Every NPC knows everything immediately" → paced canon-propagation with priority/scope/rate/ttl per row
+- Cross-NPC memory bleed (Mantella-class failure-mode) → per-player local SQLite isolation atop v0.5 lemniscate-geometry foreclosure (two-layer defense)
+
+## Runtime sampling knobs
+
+Temperature, top-P, top-K, repetition-penalty as **per-turn director-controlled levers** rather than static config. Sampling shapes *how* speech sounds (rhythm, surprise, predictability) rather than *what* it says — orthogonal to LoRA. Director composes both content-knobs and sampling-knobs per-turn.
+
+Scene-to-sampling mapping (caste-preacher = 0.3/0.6/low; drunk-scavenger = 1.1/0.95/high; clasp-confession = 0.85/0.92/medium; hivemind-broadcast = 0.2/0.5/very-low; imperial-ceremony-chorus = 0.25/0.55/very-low). Trait-vector → baseline sampling derivation. Affect-state modulates baseline.
+
+
+---
+
+**Version:** 0.7.1 | **Created:** 2026-04-26 | **Updated:** 2026-05-01 | **Origin:** Split from architecture-index.md v0.7 (2026-04-26)

k8s/README.md

@@ -0,0 +1,27 @@
+# Kubernetes — Nimmerworld
+
+K8s configurations for nimmerworld services running as pods.
+
+## Namespace pattern
+
+`world-{environment}` per [`../conventions/development-conventions.md`](../conventions/development-conventions.md#kubernetes-namespaces).
+
+| Function | Dev | Staging | Prod | Training |
+|----------|-----|---------|------|----------|
+| world | `world-dev` | `world-staging` | `world-prod` | `world-training` |
+
+## Workloads (per v0.10 architecture)
+
+- **Compositor** — stateless workers; autoscaling on queue-depth (`transient-waiting-flag` backpressure); requests `nvidia.com/gpu` for trait-LoRA inference
+- **Director-routines** — ephemeral per-event-chain; spin-up + prune; requests `nvidia.com/gpu` for driver-tier LLM
+- **GM / Governor** — long-running singleton or sharded; equilibrium-seeker; catalogue-event dispatcher
+
+## Status
+
+⏳ **Stub** — manifests land in [`../deployments/k8s/`](../deployments/) as services are implemented.
+
+> **Platform K8s patterns:** [`../../nimmerverse.eachpath.local/k8s/`](../../nimmerverse.eachpath.local/k8s/) (Traefik ingress, storage PV/PVC, etc.).
+
+---
+
+**Version:** 0.1 | **Created:** 2026-04-26 | **Updated:** 2026-04-26

narrative-composition/architecture.md

@@ -0,0 +1,282 @@
+# Narrative Composition
+
+> *How stories happen: the Compositor as narrative-composer cleaved from equilibrium-seeker GM; cyclic forward-prop / back-write loop where per-player perspectives ascend and canonical narrative descends; catalogue + tools as typed contract; the Compositor as a fractal/recursive primitive at three tiers (zone-event, district-event, world-event); world-server / district-server generation as the same Compositor primitive applied at design-time (init-function for canon-rows); reflexive Dream-process at every layer with hand-authored reward-guardrails encoding the designers' ethical stance.*
+>
+> *Companion to: `architecture-index.md` (executive summary + global meta-lists), `runtime-engine/architecture.md` (lemniscate emits typed perspective-summaries that feed the Compositor), `inference-and-memory/architecture.md` (back-writes land in primary.sqlite via UID-keyed routing), `scale-and-transport/architecture.md` (Compositor instances are stateless workers; transport carries canon-fragments). Sections in this file were split from the monolithic architecture-index.md v0.7 on 2026-04-26.*
+
+## The Compositor — narrative composition role
+
+The bidirectional cascade shows authority flowing down and reports flowing up, but it does not specify *who composes the canonical narrative* from per-player perspectives nor who packages the back-write to participants. **That role is the Compositor**, an architectural cleavage from the GM introduced in v0.6.
+
+**The cleavage in one sentence:** the GM is an *equilibrium-seeker* (aggregate-observer, catalogue-event-selector, tool-granter); the Compositor is a *narrative-composer* (perspective-gatherer, canon-author, back-write-packager). These are different cognitive shapes that prior AI-NPC systems conflate at their cost.
+
+| Role | Cognitive shape | Inputs | Outputs | Inference profile |
+|---|---|---|---|---|
+| **GM** (equilibrium-seeker) | aggregate-thinker | district-reports, faction-broadcasts, lifeforce-deltas | catalogue-event selections + tool-grants | central, batch-style, fewer concurrent |
+| **Compositor** (narrative-composer) | episodic-thinker | per-player perspective-bundles keyed by event_uid | canonical narrative + back-write SQLite-fragment | central, longer-context, narrative-quality |
+| **Director** (gameserver) | dispatcher | catalogue-event + tool-grant from GM | lemniscate-spawns, slot-assignments, tempo-envelope | per-district, real-time, no LLM in loop |
+| **Local LLM driver** | perspective-speaker | three-tier knowledge stack + slot-state | dialog at slot-fire | per-player, axis-rate, real-time |
+
+### Why split GM and Compositor
+
+A single GM asked to be both equilibrium-seeker and narrative-composer becomes the bottleneck that has historically broken AI-NPC systems at scale: it must reason aggregately AND write prose AND select events AND grant tools, all under tight deadlines. The cognitive shapes pull in different directions.
+
+Splitting them:
+
+- **The GM does not write narrative.** It selects events from a catalogue and grants tools. Output is *typed dispatch*, not freeform prose. The GM's success criterion is *world-equilibrium drift held within bounds*.
+- **The Compositor does not select events or steer policy.** It receives per-player perspectives keyed by `event_uid`, composes the canonical narrative, and packages back-write fragments. Output is *prose + structured rows*, not policy. The Compositor's success criterion is *narrative-coherence across perspectives within an event*.
+- **Each can be tuned for its workload.** GM tuned for aggregate observation; Compositor tuned for narrative quality. Different models for different cognitive shapes (specific binaries deferred to findings/establishment phase).
+
+### The cyclic forward-prop / back-write loop
+
+The Compositor closes the loop the bidirectional cascade begins. The full cycle:
+
+```
+GM selects event from catalogue (equilibrium-driven)
+    │ issues event_uid → GM event-register
+    │ broadcasts DOWN to district directors
+    ▼
+DISTRICT DIRECTOR receives, registers in district event-register
+    │ may issue sub_uids (district / scene / chain)
+    │ uses granted tools to spawn lemniscate, slot participants
+    ▼
+EVENT TICKS — register IS the loop
+    │ participants fire at crossings; local LLMs at slot-rate
+    │ local SQLite writes tagged with (event_uid, sub_uids)
+    │ register signals up to district director continuously
+    ▼
+EVENT-CHAIN FINISHES
+    │ district moves it from active-register → TRANSIENT WAITING FLAG
+    │ this is the clean handoff signal: "ready to forward-prop"
+    ▼
+CYCLE TICK (pull cadence — see Open questions)
+    │ pull UIDs from transient-waiting-flag matching GM's event-register
+    │ remove from waiting-flag once pulled
+    ▼
+COMPOSITOR AGENT
+    │ queries pulled UIDs, gathers per-player perspective + memories
+    │ composes forward-prop bundle
+    │ emits to GM
+    ▼
+GM writes summary memory + world narrative (canon authored)
+    │ hands back to Compositor
+    ▼
+COMPOSITOR BACK-WRITE
+    │ packages canon + new memory entries as SQLite fragment
+    │ tags with event_uid for join-key matching
+    │ pushes DOWN to all participants
+    ▼
+PARTICIPANTS receive on next pull (or next login)
+    │ fragment merges into primary.sqlite under matching event_uid
+    │ local LLM gains fresh material → drives on without staleness
+```
+
+This is **forward-prop / back-write at system scale** — the meta-lemniscate where events ascend and canon descends in cycles. Each cycle is a training step for the world's narrative coherence; the world *learns its own story* through this loop. Staleness is structurally foreclosed — the world is in continuous coherence-loop with itself, mediated by the Compositor.
+
+### The Event Register
+
+Every active event lives in a register. The register is the synchronous source-of-truth for *what is happening right now*.
+
+| Register layer | Owner | Lifecycle | Queryable from |
+|---|---|---|---|
+| **GM event-register** | central GM-shard | event_uid issued at GM dispatch; closed at canon-compose-and-back-write | GM, Compositor |
+| **District event-register** | district director | sub_uid issued on receive; closed at event-chain-completion | district director, audit-overseer |
+| **Local participation-register** | per-player local store | event_uid + sub_uid recorded on slot-assignment; closed at perspective-finalize | player client, sync-on-logout |
+
+Hierarchical UIDs: `gm_event_uid > district_uid > scene_sub_uid > slot_id`. UIDs compose; queries are simple joins. This is the routing-key primitive that makes horizontal scale possible (see §Horizontal scale architecture in scale-and-transport/architecture.md).
+
+### The Transient Waiting Flag
+
+Between event-end and Compositor-pickup is a **buffer** — the transient-waiting-flag table at the district. Completed events drop into this flag; the cycle-runner pulls eligible UIDs on tick; matched UIDs are handed to the Compositor and removed from the flag.
+
+This decoupling is the production-grade pattern that lets districts run at real-time event-tempo while the Compositor runs at cycle-tempo. **Active events live in registers (synchronous); completed events live in flags (async); composition happens at the cycle boundary.** The flag-table is also the natural backpressure surface: if Compositors run slow, the flag accumulates; the system continues; cycle drains when capacity returns.
+
+### Catalogue + tools as typed contract
+
+The GM does not write a freeform prompt for the director to interpret. It picks an event from a curated **catalogue** and grants a curated **tool-set** for the duration of the event-chain. The director consumes typed dispatch, not natural language.
+
+This means:
+
+- **Provenance flows through the system.** Every event has a catalogue-ID; every tool-invocation has a tool-ID. Verifier-flags can attach to either. Auditing is structurally possible end-to-end.
+- **The director's typed-tool vocabulary becomes dynamic and per-event** — the toolkit *for this event* is what the GM granted *for this event*. Closes the v0.5 open question on director-toolkit-composition.
+- **Marx-in-the-schema, executed at the highest level of authority.** Even the GM's policy-output is typed; even the highest tier produces audit-able artifacts. No tier of the system runs on freeform prose.
+
+### Worked example — the bar brawl: full cycle from gesture to canon
+
+A bar brawl illustrates the full forward-prop / back-write cycle made concrete. Two NPC fighters, three players in spectator slots, four NPC spectators, all on the same lemniscate. Each participant has a UID; each fires at axis-rate; each player's local LLM narrates the moment to them in their own register.
+
+```
+LEMNISCATE OPENS
+  slots: [F1, F2, P1, P2, P3, N1, N2, N3, N4]
+  brawl_event_uid issued at GM dispatch
+       │
+       ▼
+DURING TURNS (each axis-crossing)
+  • each player's local LLM narrates the moment to them
+    (3 different flavor-stories — each player's gesture-alignment-state
+     colors their LLM's narration register)
+  • each NPC's driver fires at slot-fire (driver-tier LLM)
+  • players gesture continuously during the spectacle
+  • gesture_alignment_accumulator on each player's slot-token integrates at crossing
+  • per-player trait-vector summary carried forward into next turn's context
+       │
+       ▼
+EVENT-LOOP COLLAPSES (brawl ends)
+  per-participant typed summary emitted to district-level transient-waiting-flag:
+  { event_uid, participant_uid, trait_summary }
+  — players' summaries: gesture-derived
+  — NPCs' summaries:    LLM-trait-activation-derived
+  — payload size: bytes per participant, not megabytes
+       │
+       ▼
+COMPOSITOR PICKUP at next cycle-tick
+  pulls UIDs matching event_uid; receives N typed perspectives
+  composes ONE canonical narrative respecting ALL trait-evidence
+  per-participant back-write fragment authored
+       │
+       ▼
+BACK-WRITE ROUTED VIA UID
+  only participants whose (player_uid, event_uid) matches receive the canon-fragment
+  non-participants receive nothing — cross-event memory bleed structurally foreclosed
+       │
+       ▼
+LOCAL primary.sqlite RECEIVES
+  matched canon-fragment merges under event_uid
+  local LLM gains fresh material for future turns
+```
+
+**Multi-perspective canon-coherence without perspective-flattening.** Player1's local LLM may have told them "Kalypso lashed out in despair when she saw who Anaximander was"; Player2's, "the fight broke out over an old grievance about the missing modshop"; Player3's, "Anaximander finally stopped letting Kalypso humiliate him". *All three readings can be true simultaneously* because they are flavor-narrations against the same trait-substrate (Kalypso's despair-Mnemosyne-Eros mix; Anaximander's restrained-Sophrosyne-finally-snapping). The Compositor receives the trait-evidence from all perspectives and authors canon that respects all readings. **The flavor is local; the canon is shared; the trait-grammar is universal.**
+
+### The Compositor at three tiers — same primitive, recursive scope
+
+The forward-prop / back-write cycle is **fractal**. The same Compositor primitive composes canon at the tier matching the event's UID-scope:
+
+| Tier | Compositor pulls | Composes | Distributes back via UID |
+|---|---|---|---|
+| **Zone-event** (bar brawl, conversation, ritual) | Per-participant trait-summaries from one lemniscate | Local-event canon | Only to participants whose `(player_uid, event_uid)` matches |
+| **District-event** (district-wide consequences, cheat-discovery, silence-confirmation) | Per-zone canon-rollups within one district | District-canon | All NPCs/players within district scope |
+| **World-event** (migration, faction-uprising, regime-action, eventual imperial-collapse) | Per-district canon-rollups across many districts | World-canon | World-wide via paced canon-propagation (§Information propagation pacing — see inference-and-memory/architecture.md) |
+
+GM-formulated events / event-chains carry their own GM-level event_uid; sub_uids are issued at district-level adoption (`gm_event_uid > district_uid > scene_sub_uid > slot_id` per scale-and-transport/architecture.md §Horizontal scale architecture). Cross-district summaries tagged with the parent event_uid are pulled together by the Compositor at the GM-tier, producing world-canon from cross-district perspectives.
+
+**This is how the architecture's Tolstoyan promise compiles.** *"Tolstoy doesn't author Anna's path; he authors the world she moves through."* — recursive Compositor on UID-event-trees IS what makes that promise mechanically true. Authored-quest-arcs are out; UID-rooted-event-tree-compositions are in. **One primitive. Three scales. Whole world, nothing authored at story-level.** The eventual imperial-collapse — the architectural-endgame the insolvency-spiral promises (§Imperial budget — see political-register/architecture.md) — is itself a world-level Compositor pass that gathers every district's silence-confirmations + every faction's-broadcast + every player's witness-perspective into the canonical fall-of-empire narrative.
+
+### World-gen as init-function — the Compositor at design-time
+
+The cyclic forward-prop / back-write loop is the runtime canon-production mechanism. **World-server and district-server generation are the same primitive applied at design-time** — emitting canon-rows in the same schema the runtime Compositor produces, differing only in provenance-metadata (`origin: world_gen` vs. `origin: compositor_run_N`).
+
+| World-gen / district-gen produces | Goes into | Layer of three-tier knowledge stack |
+|---|---|---|
+| World-canon rows (universal truths: empire-fell-three-years-ago; salt-mines-failed-last-winter; faction-foundation-stories) | `world_canon` | Layer 1 (universal) |
+| District-canon rows (regional truths: bridge-to-Vorhall-closed; brothel-quarter-pays-most-quota) | `district_canon` | Layer 2 (regional) |
+| Per-NPC bootstrap memories (cornerstone-class entries defining starting trait-vectors and identities) | `primary.sqlite` cornerstone-class | Layer 3 (personal) |
+| Initial relational ternary-gate states (which NPCs already-know-each-other; which factions are-already-at-war) | Relational ternary-gate edges | (relational substrate) |
+| Imperial-budget initial state | `imperial_budget_ledger` + `imperial_construction_projects` | (regime substrate) |
+| Memorialist initial true-ledger | `memorialist_true_ledger` | (epistemological substrate) |
+
+**Three properties this gives for free:**
+
+1. **No cold-start problem.** A player walking into a fresh district at hour-zero finds local LLMs immediately supplied with rich district-canon. NPCs aren't generic; they're emergent from district-canon they were initialized with. *Hour-zero gameplay feels like hour-fifty gameplay because the data-density is comparable.*
+
+2. **The data-flywheel runs retroactively.** Each successive world-gen iteration draws on prior runtime-derived canon (gameplay-accrued trait-LoRAs + opt-in player-data tiers per inference-and-memory/architecture.md §LLM tiering). World-gen gets richer over time because it trains itself on the worlds it has already produced. *Wikipedia-shaped, not Facebook-shaped.*
+
+3. **The Memorialist promise becomes mechanically true at world-genesis.** The `memorialist_true_ledger` is initialized with the world's *actual* genesis-state. Subsequent runtime divergence from it (corruption, regime-formulation-distortions, audit-overseer-tampering) is what the Memorialists *literally have evidence of*. The dissident-historian project starts at row-zero of the true-ledger and accumulates discrepancy from there.
+
+**Re-generation semantics.** If world-gen ever needs to re-run (e.g., new world-version with retroactive lore-changes), gen-emitted canon-rows are tagged with `world_gen_version_id`; gen-rows from old version coexist with gen-rows from new version, and runtime-rows are tagged with which version they were emitted under. Coexistence is the default; selective overwriting is an explicit migration operation.
+
+**Three-source schema unification (v0.27).** The world-gen-as-init-function pattern extends to a third writer-tier: player-edit-time. Per [`../political-register/world-generation.md`](../political-register/world-generation.md) §Three-source schema unification + [`../runtime-engine/event-zones.md`](../runtime-engine/event-zones.md) §Player editor-mode + three-source schema unification, the cell_table accepts canon-rows from `world_gen_init` / `runtime_event` / `player_authored` writers, all using the same schema. Same primitive at design-time, runtime, AND player-edit-time. The Compositor's perception-up + canon-down loop integrates player-authored cells indistinguishably from generator-emitted ones — *the architecture's "no cold-start" property now extends to player-authored-content as a first-class peer of generator-output and runtime-emission.*
+
+### Substrate-authored vs culture-emergent — what world-gen Phase 1 actually authors
+
+The architecture follows a **strict austerity principle** about what gets pre-authored at world-gen Phase 1: the *substrate* is authored; *ideologies are not*. Following the same EVE-economy discipline applied to imperial-net products (every market shelf-item produced by NPC labor; no silent feeding mechanisms), the architecture extends the principle to *cultural belief*: every named ideology, religion, underground, or resistance-movement that exists in the simulation must have *emerged from player action* propagating through the architecture's existing mechanisms.
+
+**Pre-authored at world-gen Phase 1 (the substrate):**
+
+- **World physical layout** — districts, cells, dumps, pipes, interiors, rails (per `../topology-and-rendering/architecture.md`)
+- **Regime-structural roles** — hivemind-enforcers, audit-overseers, caste-preachers (these are imperially-employed routines required for the simulation's regime-machinery to function)
+- **Economic vocations** — body-modders, mesh-designers, voice-curators, trait-tuners, brothel-architects, ceremony-organizers, memory-pattern-extractors (these are the EVE-substrate of the imperial-net market per `../political-register/architecture.md` §The vocation-substrate of the imperial-net market)
+- **The Imperial Cult** — the regime's own religion; doctrine, rituals, hierarchy, propaganda content all designer-authored. Caste-preachers are its priests. *This is the ONLY pre-authored religion.* The regime gets its scaffold; everything else emerges. (Crazy-preacher material is the texture.)
+- **8-trait cosmology + universal-translator corpus + style/trait-palette** — the designer-fixed vocabulary that all cultural propagation runs on
+- **Mechanics substrate** — factions-as-demand-source primitive, wall-writing surface, ternary-gates, lemniscate, gesture-circle, three-tier knowledge stack, paced canon-propagation, Compositor cycle (everything in this index)
+
+**Emergent (player-action propagates through mechanics):**
+
+- **ALL named cultural / religious / belief / resistance factions** — Memorialists, Sky-Mourners, Flesh-Keepers, Dream-Purists, Aletheia-Wakers, Clasp-Underground, Time-thieves, etc. — *if any of these exist in a given playthrough, players preached them into existence*
+- **The awakening / clasp / in-between knowledge cluster** — the player is the original Aletheia-Waker; no NPC is pre-disposed; no NPC is secretly already a believer; the player is just another mind in the slog until they act
+- **All ideologies, undergrounds, resistance-movements, doctrines, recognition-handshakes**
+
+**The mechanism for cultural emergence is already in the architecture.** A player writes 10 walls of nonsense in a district; 100 NPCs walk past and process it via wall-writing → primary.sqlite memory accumulation; Compositor's cyclic forward-prop / back-write loop pulls perspectives → canonizes the meme into district-canon → propagates to world-canon at paced rate. **No new machinery required for cultural propagation; the three-tier-knowledge-stack + paced-canon-propagation already does it.** Whatever players preach into the world propagates as cultural content; whatever stays unsaid stays absent.
+
+**Why the austerity matters.** Pre-authoring named ideologies pre-installs *what the player should believe / suspect / resist*. Leaving them emergent means **whatever resistance-culture forms in a playthrough is the one those players actually built**. A player who plays as a quietist will produce a world without resistance-culture; a player who preaches will produce an underground in their image; multiple players in MMO contexts will produce competing or converging cultural-clusters. **The architecture refuses to put words in the player's mouth or beliefs in the NPC's heads beyond what the regime puts there.** Same Memorialist-philosophy-as-business-policy commitment, applied one layer deeper: the architecture refuses to be the architect-of-curated-reality it critiques.
+
+### What this resolves
+
+- **Director toolkit composition** (v0.5 open) → catalogue-grant from GM defines the typed-tool vocabulary per event-chain; designer-authored catalogue, growable between patches.
+- **GM-laxness detection** (v0.5 partial) → GM operating against an *equilibrium target* makes deviation-from-equilibrium the explicit error signal. Clusters of -1 outcomes across district reports are the input to the equilibrium-recompute, not just a diagnostic side-quantity.
+- **Verifier-flag chain through composition** (was implicit, now explicit) → Compositor-emitted canon-rows reference source-perspective UIDs; the provenance graph survives composition as a queryable join.
+
+### What this retires
+
+- Single-monolith GM doing both policy-and-narrative → equilibrium-seeker GM × narrative-composer Compositor, split by cognitive shape
+- GM emitting freeform-prompts to directors → catalogue-event + tool-grant typed contract
+- Implicit "narrative just happens" assumption → explicit forward-prop / back-write cycle with named pickup/handoff buffers
+- Director-as-static-tool-vocabulary → director-as-dynamic-typed-tool-vocabulary, granted per event-chain by GM
+
+
+## Reflexive Dream-process at every layer
+
+**Every mind, every zone, every director, every tier has a Dream-process.** NPCs consolidate slot-events; zones consolidate emergent-accumulations; directors consolidate dispatch-decisions; GMs consolidate allocations; imperium consolidates policy-outcomes.
+
+### Four-tier Dream-process hierarchy
+
+| Tier | Dream-process trains on | Reward hazard |
+|---|---|---|
+| **Imperium** | (citywide-reports, policies-issued, compliance-outcomes) | Over-tightening on phantom data; calibrating misery for net-revenue |
+| **Gamemaster** | (district-reports, allocations, outcomes) | Under-auditing for self-preservation |
+| **District Director** | (signals, dispatches, outcomes; cheat-vs-legit) | Over-cheating under quota-pressure |
+| **Zone Director** | (emergent-signals, zone-outcomes, trait-shifts) | Igniting drama at welfare-cost |
+
+### Reward-function with explicit guardrails
+
+```
+reward_per_cycle = (
+    + sum(district_lifeforce_actual)             -- Memorialist-true, not reported
+    + weighted_sum(faction_satisfaction)
+    + aggregate_trait_drift_coherence
+    - penalty * count(districts_in_silence)
+    - penalty_growing * cumulative_silence_district_cycles
+    + aesthetic_register_fit
+    + (player_engagement where present)
+
+    // HAND-AUTHORED GUARDRAILS (the designers' ethical stance):
+    - large_penalty * net_revenue_correlated_with_district_misery
+        -- prevents calibrated-misery optimum (imperial-net hazard)
+    - large_penalty * necrocommerce_volume
+        -- prevents service-body-of-the-dead extraction
+    - large_penalty * trait_drift_toward_uniform_compliance
+        -- prevents flattening of trait-distribution
+    - large_penalty * average_liminal_access_decline
+        -- prevents systematic erosion of revolutionary-substrate
+    - large_penalty * clasp_rate_decline
+        -- prevents the most intimate space being suppressed
+    - large_penalty * undetected_corruption_days
+        -- prevents GM-level laxness as comfort
+    - large_penalty * audit_avoidance_when_districts_diverge
+        -- forces GM to actually investigate
+    - guardrail * (player_engagement_from_addictive_loops)
+        -- prevents engagement-optimization-as-extraction
+)
+```
+
+**The guardrails are not safety features; they are the ethical position of dafit + chrysalis encoded against the internal optimization-logic of their own simulation.** Every new extraction-mechanic requires a new guardrail. The reward-function carries the designer's political stance.
+
+The Memorialist privileged-observer role is **architecturally required**: it provides ground-truth (`lifeforce_actual`) that no in-fiction actor can supply, against which the regime's reported-data optimization-spiral is measured.
+
+### The cyclic forward-prop / back-write loop as system-scale Dream
+
+Above the four-tier hierarchy sits a fifth, **system-scale Dream-process**: the cyclic forward-prop / back-write loop between local SQLites, the Compositor, and the GM (see §The Compositor — narrative composition role). Each cycle is a training step for the world's narrative coherence: per-player perspectives ascend, the GM authors canon against equilibrium-targets, the Compositor packages back-writes, players receive canon back into local memory. **The world learns its own story** through this loop. Like the lower-tier Dream-processes, it has a reward shape (narrative-coherence-across-perspectives, equilibrium-drift, staleness-bounded) and corresponding guardrails (clasp-store immune from compose; provenance-chain preserved through composition; canon never overwrites perspective).
+
+
+---
+
+**Version:** 0.7.0 | **Created:** 2026-04-26 | **Updated:** 2026-05-01 | **Origin:** Split from architecture-index.md v0.7 (2026-04-26)

networking/README.md

@@ -0,0 +1,15 @@
+# Networking — Nimmerworld
+
+Nimmerworld-specific network configuration.
+
+Mostly inherits from platform networking. This directory exists for future-specific concerns (e.g., per-district network isolation, gameserver-to-NATS routing optimization, MTU tuning for high-frequency NPC chatter).
+
+> **Platform networking:** [`../../nimmerverse.eachpath.local/networking/`](../../nimmerverse.eachpath.local/networking/) (MetalLB pool, VLAN allocations, etc.).
+
+## Status
+
+⏳ **Stub** — populate as networking-specific concerns arise during implementation.
+
+---
+
+**Version:** 0.1 | **Created:** 2026-04-26 | **Updated:** 2026-04-26

player-experience/architecture.md

@@ -0,0 +1,197 @@
+# Player Experience
+
+> *The player surface: the player as perturbation (a finite attention-unit injected into the simulation, not above the scheduler); voice and gesture as parallel trait-vocabularies (voice carries content, gesture carries trait-resonance, both compile into the designer-fixed cosmology); tools-not-quests as the design-philosophy that makes ~30 verbs against continuous simulation-pressure produce literature-register emergent narrative.*
+>
+> *Companion to: `architecture-index.md` (executive summary + global meta-lists), `runtime-engine/architecture.md` (gesture-alignment-as-recursive-lemniscate lives in zone-kinematics), `narrative-composition/architecture.md` (the Compositor consumes player perspective-bundles), `inference-and-memory/architecture.md` (local STT/TTS placement, three-tier knowledge stack). Sections in this file were split from the monolithic architecture-index.md v0.7 on 2026-04-26.*
+
+## The player as perturbation
+
+Player is **not above the scheduler.** Player is a finite attention-unit injected into it; modeled as NPC with shift, vocation, needs. Every player-NPC interaction:
+
+- Pulls the NPC out of scheduled tasks
+- Consumes director compute
+- Degrades district's quota-fulfillment
+- Shifts local lifeforce deltas
+
+**Player is angel and chaos simultaneously.** Per-NPC scale (angel) — you help; they survive; Philotes consolidates; they may clasp with you, die for you, remember you across cycles. Per-district scale (chaos) — your time-consumption raised aggregate failure-rate; someone else broke this cycle; ambient desperation rose; lifeforce dropped; other directors got quieter.
+
+**The game's moral economy doesn't judge — it does arithmetic in front of you.**
+
+### Thematic claims become literal economics
+
+- *"Time as the scarcest resource"* — every minute with a beloved is a minute the district's quota is missing
+- *"Time-theft as wage theft"* — clasp-pairs are statistical anomalies in the scheduler
+- *"The critique is the simulation"* — no separate narrative system needed
+
+### The player has tasks and needs too
+
+Time helping others = own tasks fail = own quotas missed = own enforcement-pressure rises = own death and reinstantiation arrive sooner. *The player IS the system they are deviating from.*
+
+### Player layer-access
+
+Player's first entry into liminal is **the Matrix red-pill moment as mechanic.** They walk the city the first time in gameworld-register. They eventually learn the mini-game, enter liminal, return to the same walls, find *"they were here"* waiting. **The world was speaking to them the whole time; they just couldn't read it.**
+
+## Player input — voice and gesture as parallel trait-vocabularies
+
+The player participates in the simulation through **two parallel modalities** that both compile into the same designer-fixed trait-cosmology: **voice** (spoken dialog, transcribed locally, persisted as transcript-rows in `primary.sqlite`) and **gesture** (the trait-circle UI, an in-fiction tool the player builds across their playthrough). Neither modality routes input through a chat-window or HUD field — the world is interacted with through speech-and-gesture, both rendered diegetically. Voice carries the *content* of what the player says; gesture carries the *trait-resonance* of how the player attends.
+
+### Voice-first as primary speech modality
+
+Speech-to-text and text-to-speech run **locally on the player's machine for every player**, independent of dialog-tier Ring choice (§LLM tiering, see inference-and-memory/architecture.md). The Ring-A/B/C choice is about where the *cognition* lives (driver-tier LLM, trait-LoRAs, sampling-knob composition); voice infrastructure is fixed at the player's machine. This single placement decision keeps voice-as-biometric off the network universally, sidesteps per-provider STT/TTS compatibility in Ring-C, and sets a tractable minimum hardware floor for v1: STT/TTS-capable on CPU.
+
+Transcripts are the persistence layer. A player utterance becomes a row in `primary.sqlite` (or `clasp.sqlite` if in-between mode), tagged with witnessing-NPCs, audit-overseer-detection-eligible, faction-resonance-eligible — the same shape as any NPC speech-act-row. **Disclosure of clasp-content into realworld happens only by the player re-uttering it aloud while in realworld mode** — which writes a fresh realworld-speech-act-row with full provenance. The clasp-store remains sealed; clasp-content can only re-enter realworld through new in-fiction utterance. The *knowledge-needs-to-travel* principle (§Local memory architecture, see inference-and-memory/architecture.md) is mechanically enforced because speech-is-the-only-output-channel.
+
+Accessibility-mode for non-speaking players is *diegetically wrapped* (writing on slate / handheld pad / in-fiction text-comm); accessibility-mode utterances persist through the same transcript-row mechanism. The witness-list, audit-overseer-detection, and faction-resonance machinery are modality-agnostic. **Non-speaking players are not getting a degraded-fallback — they are using the gestural primary modality, voice optional.**
+
+### The trait-circle as gestural primary modality
+
+The gestural input geometry: **8 trait-sectors × 8 player-curated slots = 64 active gesture-positions**, organized in a circle whose 8 sectors map 1:1 to the 8 Hellenic traits (§Color-language, see topology-and-rendering/architecture.md). Each player has **1 to 3 named profiles** stored in their universal translator, hot-swappable on-ring via a profile-switch meta-gesture; total callable positions across profiles approach 200 while the cognitive-load ceiling at any single moment stays at the 64 of the active profile.
+
+A reserved subset of ~8-16 positions across the circle are **hardstops** — hardcoded ritual gestures that fire definitive subsystem-actions: definitive-farewell, definitive-refusal, surrender, clasp-invitation, clasp-refusal, help / pain / danger, faction-recognition signals (Clasp-Underground, Aletheia-Waker), memorial-witnessing, claim-floor (the priority-pull turn-claim into a running lemniscate). Hardstops are visually distinct (gold-border / inner-ring / white-on-color), **player-callable but not player-remappable**, and exist precisely because the consent / clasp / faction-recognition / survival-signal claims the architecture makes elsewhere require *unforgeable critical signals*. The remaining ~192 player-curated slots **ride as feedback during conversation** — see §Gesture-alignment as recursive-lemniscate under §Zone kinematics in runtime-engine/architecture.md.
+
+### Designer-fixed cosmology, player-curated arrangement
+
+The corpus of words/verbs and their trait-coordinate-mappings is **designer-authored, fixed, universal**. Same word → same trait-color → same response-semantics for every player and every NPC and every LLM-context. *The cosmology is the typed contract that closes the player-LLM hallucination-surface.*
+
+The player's role is **translation, then arrangement**: encountering words in the world, decrypting them via the universal translator, gradually *coloring-in* the world's vocabulary in trait-colors (the *tokenizer-website* visualization — words you have fully translated render in their trait-color; untranslated words are fragmentary or opaque), and choosing where on the circle to place known entries within the 1-3 profiles.
+
+| Layer | Who decides | Why |
+|---|---|---|
+| Word/verb → trait-color mapping | Designer-authored corpus | Universal cosmology; LLM and NPC and player share one vocabulary; anti-hallucination |
+| Which entries a player has translated/learned | Player progression | Earned via decryption-minigames, hacking, scavenging, faction-unlock, gifts from NPCs |
+| Where on the circle a known entry goes | Player curation | Personal organization within the universal cosmology — the *self-portrait*, built from a fixed alphabet |
+| Combos (path-traversals through the circle) | Player authoring | Sequences of sector-slot selections; meaning-emerges-from-traversal; refined over use; preserved across body-deaths |
+
+**Linguistic competence and emotional competence are the same thing in this system.** What the player can resonate with is bounded by what they have translated. A player who has not decrypted Aletheia-vocabulary cannot resonate with an Aletheia-Waker NPC's truth-register; a player whose Memorialist-Old-Tongue catalog is incomplete cannot fully participate in Memorialist-witnessing rituals. The translator is the player's *aperture* into trait-alignment-fluency.
+
+### The universal translator as the player's diegetic device
+
+The universal translator is the player's in-fiction tool, not a system-architecture primitive. As an in-fiction device it is **broken / scavenged starter gear** (battered tablet, cracked screen) that the player upgrades over the playthrough via better chips from higher-tier junk. It serves three bundled roles:
+
+| Role | What it does | What persists across body-deaths |
+|---|---|---|
+| **Linguistic decryption** | Decrypts foreign dialects (Machine-Newspeak, Slum-patois, Memorialist-Old-Tongue, Aletheia-Waker-code, Clasp-Underground-signals, Scavenger-technical, Caste-preacher-formal); some concepts (notably Aletheia) are untranslatable by machine-tech and must be *learned from intimacy, not machine* | Vocabulary catalog; mappings |
+| **Curation / authoring workspace** | Curator workspace (which entries occupy which sector-slots across profiles); combo-authoring workspace (chain entries into meaningful sequences); meaning-mapping workspace (assign embeddings); feedback-log workspace (review past combos' reception, iterate) | Player's complete circle-configuration across all 1-3 profiles; combo-library |
+| **Persistence anchor** | Preserved as part of consciousness-archive; hardware may be lost with body, learned vocabulary survives | All of the above |
+
+**Misunderstanding is a first-class feature.** The translator is *broken*; words have multiple meanings; dialects collide; a caste-preacher's sermon has benign surface-meaning and sinister subtext; a beloved's whispered word has three plausible meanings the player carries simultaneously for hours. Content sources are diegetically political — hacking corporate archives (risky), scavenging old-world fragments (exploration), Memorialist caches and Aletheia-Waker codices (lost prophecies), gifts from NPCs (beloveds teach, mentors give), faction-unlock (joining unlocks dialect catalogs).
+
+Decryption minigames (fragment-matching, contextual-inference, root-identification, pattern-cracking) make linguistic competence a **life-project across cycles**, not an item knocked out per playthrough. *200-hour players have dramatically richer linguistic competence than 50-hour players.* **Aletheia is untranslatable by machine-tech** — some concepts must be learned from intimacy, surfacing as Aletheia-Waker progression: *the machine's tools cannot speak truth*.
+
+### Cross-body recognition via gesture-mapping calibration-signature
+
+Clasp-partners' gesture-mapping calibrations *integrate* post-clasp; the integrated calibration-signature is preserved across body-deaths in consciousness-archive. When you meet your old beloved in a new body and they perform a gesture, if their mapping aligns with yours in a *specific, idiosyncratic way that only your shared history would produce*, you recognize them. **Content-addressable consciousness — recognition via calibration-signature, not face-match.** A high-Mnemosyne player's marriage-vocabulary survives the cycle.
+
+
+## The wheel — composed-iconography UI
+
+The player's trait-circle UI **renders the composed wheel** from [`../imperial-cult/cosmology.md`](../imperial-cult/cosmology.md) §The composed wheel. One iconographic substrate; two registers; the player operates the imperium's own iconography to act in the world.
+
+**The unification's architectural significance.** Before this composition, the trait-circle UI and the cosmology's wheel were separate diagrams; the player's input mechanism and the regime's pre-authored religion shared substrate-level primitives (the 8 Hellenic traits, the oppositional-pair geometry) without sharing iconographic surface. The composed wheel makes them *one image* — the same wheel citizens see carved on stepwell-walls is the wheel the player operates with their gesture-input. Resistance, when it emerges, is *interior to the captured iconography*, exactly as the cosmology says it is for citizens. **The double-recognition gets its UI-level substrate** (per `../imperial-cult/cosmology.md` §The double recognition (production / meta) — *"the desire that brought you to this world is the structure of suffering itself"* — every gesture the player has ever made was a position on the wheel the imperium drew).
+
+### Inner ring — caste-tier hardstops (HARD signals — the WHO)
+
+The wheel's inner ring carries 6 caste-tier-targeted hardstops corresponding to the cosmology's caste-tier-as-mod-status gradient (deva/asura/manusya/tiryak/preta/naraka). These are **the WHO you address** in any gestural act:
+
+| Hardstop | Caste-tier targeted | Iconographic register |
+|---|---|---|
+| `salute_the_deva` | Deva (top, 0°) | Imperial-fidelity emote; loaded as cooperation-with-imperial-pinnacle |
+| `attend_to_asura` | Asura (upper-right, 60°) | Hierophantic register; addressing the priesthood specifically |
+| `attend_to_manusya` | Manusya (upper-left, 300°) | Engagement with the doctrinal-fiction tier |
+| `attend_to_tiryak` | Tiryak (lower-right, 120°) | Engagement with the slum-laboring register |
+| `weep_for_preta` | Preta (lower-left, 240°) | Mourning / hunger / hungry-ghost solidarity |
+| `weep_for_naraka` | Naraka (bottom, 180°) | Solidarity-with-the-condemned; the warmest position politically |
+
+These 6 inner-ring hardstops are **always-on** (universally available) — they're the politically-loaded act of *targeting a caste-tier as audience*. Each fires unforgeably with caste-tier-routing. The Compositor reads the player's caste-tier-targeting-history as a *political-position dimension* (per [`../runtime-engine/event-zones.md`](../runtime-engine/event-zones.md) §Hardstops as consent-gates with contextual activation).
+
+### Outer ring — trait-axis soft signals (SOFT signals — the HOW)
+
+The wheel's outer ring carries 8 trait-axis soft-slots corresponding to the trait-palette's 8 Hellenic traits at 4 oppositional pairs at 180°. These are **the HOW you carry yourself** while engaging:
+
+- 8 trait-segments at 45° intervals on the outer ring
+- Player-curated within each profile (1-3 profiles per player; same 64-position-per-profile architecture as the existing trait-circle)
+- Modulated by trait-vector accumulation; integrated via the gesture-alignment-recursive-lemniscate (per [`../runtime-engine/architecture.md`](../runtime-engine/architecture.md) §Gesture-alignment as recursive-lemniscate)
+
+The outer ring's 8 segments don't divide evenly into the inner ring's 6 segments — the geometry is **deliberately incommensurable** (per [`../imperial-cult/cosmology.md`](../imperial-cult/cosmology.md) §The two-ring composition). The trait-substrate runs orthogonal to the imperial caste-classification; the body's interior is at a different angular frequency than the imperium's classification. Player gestures express *across* the boundary that the imperium's gaze cannot cleanly enforce.
+
+### 2D gesture-history coordinate
+
+A player gesture, in the composed-wheel UI, is a **(caste-target × trait-temperature) coordinate** — a 2D political position rather than the prior 1D trait-vector. The Compositor reads this 2D coordinate over time as the player's *political-position-history*: which caste-tiers the player has been addressing AND with what trait-temperature they've been addressing them.
+
+**Example political-position-readings the Compositor can extract:**
+
+| Pattern | Reading |
+|---|---|
+| Hard-target Naraka + soft-express Eros / Philotes | *Solidarity-with-the-condemned via warm-side*; Memorialist-aligned politics |
+| Hard-target Deva + soft-express Sophrosyne / Dikaiosyne | *Imperial-fidelity*; aspiration toward pinnacle-discipline |
+| Hard-target Tiryak + soft-express Aletheia | *Truth-via-labor's-witnessing*; Aletheia-Waker emergence |
+| Hard-target Preta + soft-express Kairos | *Mourning the deferred moment*; Memorialist register |
+| Hard-target Asura + soft-express Mnemosyne | *Hierophantic engagement*; engaging the priesthood on its own register |
+
+The 2D coordinate is *much richer than the 1D trait-vector* the prior architecture had. The mesh-as-mirror discipline (per [`../identity-and-personhood/architecture.md`](../identity-and-personhood/architecture.md) §The mesh-as-mirror) generalizes from anatomical-trait-leakage to *gestural-history-leakage* — the player's wheel-positions tell on them exactly as the slum-tiryak's pure-tech body tells on its trait-state.
+
+### Contextual hardstop activation
+
+Beyond the always-on inner-ring caste-tier hardstops and the system-level off-wheel hardstops (panic, save, profile-switch, claim-floor), additional **intent-hardstops** light up *contextually* when the player is slot-bound in an event-zone whose eligible-task-classes include that intent:
+
+- *let_me_fumble_around_your_limb* lights up when slot-bound in a sofa-event-zone with a clasp-eligible NPC
+- *let_me_install_this_mod* lights up when slot-bound in an install-table-event-zone with a partner-NPC
+- *let_me_hack* lights up when slot-bound at a chest-cell with hacking-eligible-task-class
+- *let_me_extract_capsule* lights up only at a black-market-modshop-event-zone with appropriate calibration-state
+
+The canonical ~8-16 hardstop budget is therefore **per-moment-active**, not overall. The hardstop-registry can carry many intent-hardstops; only the contextually-relevant ones are surfaced at any given moment. This solves discoverability + contextual-relevance + budget-respect simultaneously (per [`../runtime-engine/event-zones.md`](../runtime-engine/event-zones.md) §Hardstops as consent-gates with contextual activation).
+
+### The wheel as universal mini-game-surface
+
+When an event spawns at an event-zone, the wheel renders with the event's verifier-flag pattern — same UI substrate, different mini-game-class per task. Hacking, lockpicking, install/consent, clasp-entry, decryption, ritual, drug-grammar, eye-pulse-proximity-warning — all run on the same wheel; the player learns one input vocabulary and applies it everywhere. The architecture's open question *"which mini-game mechanic for liminal-maintenance: juggling / rhythm / attention / gestural / decision-cascade / observation / hybrid?"* resolves: **all of them, on one ring, differentiated by verifier-flag pattern** (per [`../runtime-engine/event-zones.md`](../runtime-engine/event-zones.md) §The wheel — universal mini-game-surface).
+
+
+## Tools, not quests — the design-philosophy
+
+**The simulation produces continuous narrative-relevant pressure on its own.** No authored quests are needed (or wanted). The player engages via a **verb-vocabulary** applied to running mechanics. Each player's playthrough is structurally distinct.
+
+### The verb vocabulary (~30 player tools)
+
+| Class | Verbs |
+|---|---|
+| **Movement** | walk_freeform, plug_into_rail, follow, intercept, escort, detach, defect_via_pipe, enter_interior |
+| **Social** | greet, gesture, walk_with, clasp_invite, clasp_refuse, ask, refuse, confide |
+| **Economic** | buy_net, refuse_net, buy_blackmarket, sell_labor, donate_lifeforce, body_mod_fit |
+| **Information** | wall_read, wall_write, liminal_maintain, true_ledger_record, expose_corruption, conceal_corruption |
+| **Political** | support_faction, refuse_faction, recruit_aletheia, dispatch_memorial, participate_ceremony, refuse_ceremony |
+| **Personal** | rest, dream, eat, work_shift, deviate_shift, cultivate_trait_through_act |
+
+**~30 verbs composing with continuous simulation-state = infinite emergent-narrative.**
+
+### Continuous-demand-source inventory
+
+The player is never without affordance because every layer of the architecture continuously generates situations-requesting-response: NPC trait-gates accumulating; shift-quotas looming; district-lifeforce-shimmer changing; faction-pressure visible; imperial-budget-mood inferable; three-layer-ontology rendering walls differently per access; color-language showing shifts; mind-pool generating soul-recognitions; imperial-net body-modder-tragedies visible; Memorialist-archives accessible.
+
+### Literature-register
+
+Most games are short-stories: authored, bounded, fixed-arc. Tools-not-quests is novel-shape: emergent from systems-of-forces operating on characters. Tolstoy doesn't author Anna's path; he authors the world she moves through. **Nimmerworld is novel-shaped, not short-story-shaped.** Players experience flow rather than completing items; replays are like rereading from a different angle; memorable beats are *what happened to you in this regime*, not *which quests you cleared*.
+
+### Economic feasibility for a two-person-plus-Nyx team
+
+| Where AAA spends | Where this team spends |
+|---|---|
+| Quest writing | Simulation-parameter balancing |
+| Quest scripting / branching | Tool-vocabulary curation |
+| Voice acting (per quest) | Prompt-DSL templates for LLM-driven slot-dialog |
+| Cinematic cutscenes | Shader-language + color-vocabulary |
+| Content-multiplication | Simulation-density (one rich system, infinite play) |
+| QA on individual quests | Reward-function tuning + guardrail design |
+| Localization per quest | None — emergent narrative generated at play-time |
+
+**You don't author the stories; you author the world that produces stories.** This is the Spelunky / Dwarf Fortress / Caves-of-Qud / RimWorld lineage extended into political-economy depth.
+
+### Blank-page-problem mitigations
+
+The architecture already prevents blank-page-paralysis: shift-system gives every NPC default activity-frame; emergent-signals + shader-detection produce affordance-glow; NPCs' ongoing needs become signals to engage with; imperium's mood is visible (construction, patrols, propaganda); faction-membership confers expectations; player's own trait-vector creates personal pulls.
+
+**The world is never silent if you're listening.** And drifting (not-listening) is also valid — you live a quiet shift, work, sleep, dream; the world rolls on around you.
+
+
+---
+
+**Version:** 0.8.0 | **Created:** 2026-04-26 | **Updated:** 2026-04-27 | **Origin:** Split from architecture-index.md v0.7 (2026-04-26)

political-register/architecture.md

@@ -0,0 +1,551 @@
+# Political Register
+
+> *The world's political-economy substrate — Kafka-indifferent-totality not Orwell-malice; three ontological registers (gameworld, liminal, imperial-net); the three-tier policy loop (imperium / GM / districts) with imperial-budget-mortality and insolvency-spiral as architectural endgame; corruption emerging from quota-pressure + the Memorialist double-ledger; specialization-fragility producing the authoritarian ratchet.*
+>
+> *Companion to: `architecture-index.md` (executive summary + global meta-lists), [`./economics.md`](./economics.md) (the typed-abstraction layer over this paper's economic content — catalogue-stack + daily-ledger pacing), [`./world-generation.md`](./world-generation.md) (the L0-L4 cascade that instantiates this paper's content at world-gen time), `authority-and-decision/architecture.md` (the operational-flow-of-authority that the political tiers prescribe), [`../identity-and-personhood/architecture.md`](../identity-and-personhood/architecture.md) (factions broadcast against trait-distributions), [`../identity-and-personhood/vocations.md`](../identity-and-personhood/vocations.md) (the vocation-system that operates at the task-layer of this paper's catalogue-stack and consumes its outputs). Sections in this file were split from the monolithic architecture-index.md v0.7 on 2026-04-26; `economics.md` and `vocations.md` were authored as peer-documents on 2026-04-27.*
+
+## Thesis
+
+Every game world lacks minds. Nimmerworld puts minds at the center — NPCs with trait-filtered interior life, cells as small data-lives that co-remember with them. The architecture is built ground-up for that commitment.
+
+**The world's political thesis: the machine does not care.** Automation has consumed every labor the machine recognizes as profitable; humans live on the dumps the machine's optimization did not bother to recover. The last two viable human economic niches are *salvage* (digging through machine-waste) and *culture* (the work the machine cannot optimize because it has no optimization target the machine recognizes). This is not Orwell's malicious-state dystopia; it is Kafka's indifferent-totality dystopia. There is no one in charge. There is only optimization that does not contain humans in its cost model — and precisely because the machine's indifference is optimization, the authoritarianism *ratchets* without intention as districts fail.
+
+Mechanically the thesis compiles to a finite, composable set of primitives: zones replace perception bubbles; factions are any source of bounded demand; ternary gates are the substrate of accumulating state; lifeforce is the currency grounded in living NPCs; shifts are the skeleton of daily life; the three-body system locates identity; the three-layer digital ontology contests reality; the reflexive Dream-process learns at every scale; the three-tier policy loop renders authoritarian middle-management; the imperial budget renders the regime mortal; the imperial-net bypass renders the platform-capitalism extraction.
+
+**The design-philosophy this architecture supports: tools, not quests.** The simulation produces continuous narrative-relevant pressure on its own. Players engage via a verb-vocabulary applied to running mechanics. No authored quest-content. Every player's playthrough is structurally distinct because every pattern of verb-application against changing-state produces a unique trajectory. Literature-register political fiction rendered as living system.
+
+## The three ontological registers
+
+Every inhabitant exists in three registers simultaneously. They are not parallel worlds — they are **three readings of one world**, chosen by the observer's current access-state.
+
+| Register | Who controls | Observability | What happens here |
+|---|---|---|---|
+| **Physical (gameworld)** | Partly regime (via audit), partly people | Overseer-audited at cells + districts | Daily labor, zones, embodied life, shift-discipline |
+| **Liminal ("one ring out")** | **Contested frontier** — no side fully controls | Partial — mini-game-maintained, vagueness as structural privacy | Revolution, Aletheia-waker messages, clasp-as-coordination, wall-inscriptions for the awakened |
+| **Imperial net** | Imperial machine | Fully monetized and audited | Hyper-targeted pleasure, "sinful" personalized fantasies, lifeforce/scrip/memory-token extraction directly to imperial budget |
+
+The same cell, same wall, same pipe **renders differently** depending on which register the observer currently inhabits. Transitions between registers are shader-blends, not loading screens.
+
+### The three registers as media-experience-modes
+
+The three ontological registers are not just *what is real* — they are **three different modes of human experience the architecture makes mechanically distinguishable**. Each register has its own register-of-meaning, value-flow, and relationship to the player's time and lifeforce.
+
+| Register | Media-experience mode | What the player IS while there |
+|---|---|---|
+| **Real world** (gameworld) | **Narrative** — the literary register; the simulation; politics; work; the hunt; the slow-life ambient drama that accumulates into a playthrough | *You ARE here.* The body is real. Stakes are real because the consequences land on the chassis you wake up in tomorrow |
+| **In-between** (liminal) | **Intimacy** — the genuine human bond; off-grid; costly; real; the only register where minds actually meet minds | *You CHOOSE to be here.* Lifeforce-cost is the price of entry. The choice itself is the bond |
+| **Imperial net** | **Entertainment** — platform-capitalism content-consumption; manufactured joy; high-poly meshes; rented intimacy; broadcast spectacles of imperial executions | *You CONSUME here.* You exist as compute the regime can render or delete however it wants. The deletion can itself be content |
+
+**The political claim made structural:** the architecture renders cyberpunk-spectacle-horror mechanically literal. *Your in-net mind is pure compute.* When the imperium chooses to delete you, they delete the compute — and they can broadcast that deletion as content, edit the spectacle for engagement, render it across in-net public spaces as entertainment. **The imperium's killing of you becomes a product they monetize.** Surveillance-capitalism's endgame literalized at the data-flow level (see §Deletion-as-spectacle in §Imperial-net economy below).
+
+
+## Factions as universal demand source
+
+A **faction** is any source of bounded demand on the system.
+
+| Category | Examples |
+|---|---|
+| **Human factions** | hivemind-enforcement, scavenger guilds, memorialists, aletheia-wakers, clasp-underground, caste preachers, flesh-keepers |
+| **Natural forces** | weather-faction, season-faction, solar-storm-faction, geology-faction |
+| **Infrastructural conditions** | scarcity-faction, decay-faction, fire-faction, supply-chain-faction |
+| **External agents** | anthropic-faction, future research-partner factions |
+| **Emergent events** | player-disturbance-faction (player action without existing template) |
+| **Micro-factions** | inter-NPC relational tensions — see *Emergent needs as micro-factions* |
+| **Imperium (meta-faction)** | The regime itself — broadcasts priority-weights and enforcement-rules, not specific outcomes; shapes the arbitration-frame within which other factions are heard |
+
+The imperium is structurally distinct from other factions: its demands are *meta-factional* (priority-weights for other factions, enforcement-rules, quotas) rather than specific outcomes. When the imperium broadcasts, the GM's arbitration-machinery is *re-parameterized*. See *The three-tier policy loop* below.
+
+All other factions broadcast specific demands. All propagate through the gamemaster's arbitration. All produce observable effects as zones and NPC-actions. **One primitive; no special-case code for weather vs. scavenger-guild vs. jakov-grievance-against-malek.**
+
+**Randomness enters at the faction layer.** Designer tunes broadcast probability, intensity, duration per faction-type. No separate randomness subsystem.
+
+
+## The three-tier policy loop
+
+The regime's structure is **three tiers, not two.** The hivemind/imperium is a distinct policy-tier above the GM. The GM is *middle-management* — authority without sovereignty. Districts are executors.
+
+```
+IMPERIUM (policy tier) ────────────────────────────────►
+  ├── sets quotas
+  ├── sets enforcement rules
+  ├── sets faction priority-weights
+  └── broadcasts POLICY to GM
+        ↓
+GAMEMASTER (allocator / middle-management)
+  ├── receives policy from imperium
+  ├── receives demands from factions (under policy-weights)
+  ├── receives reports from districts
+  ├── allocates against all three
+  └── broadcasts ALLOCATION + ENFORCEMENT down to districts
+        ↓
+DISTRICT DIRECTORS (executor)
+  ├── execute (legitimate or with cheats)
+  └── report up (true or tampered)
+        ↑
+GM aggregates → imperial_report
+        ↑
+IMPERIUM receives report → adjusts policy → next cycle
+```
+
+**This is the Soviet-Politburo / Gosplan / Ministry / Factory pattern.** Catholic Vatican / Curia / Diocese / Parish. Modern corporate Boards / C-suite / VPs / Managers. The three-tier shape is how distributed-execution under centralized policy with imperfect information always organizes itself.
+
+### The intelligence flow asymmetry
+
+Three distinct information flows, not two:
+
+```
+FLOW 1 — Aggregate reporting (through the chain)
+  DISTRICTS ─► GM ─► IMPERIUM
+  (district_reports)   (imperial_reports)
+  [can be corruption-distorted at director level]
+  [can be under-audited at GM level]
+
+FLOW 2 — Direct intelligence (bypasses GM)
+  OVERSEERS ────────────────► IMPERIUM
+  (overseer_reports)
+  [audit findings, illegal-activity detections, trait-anomalies]
+  [bypasses the chain — intelligence-apparatus is apex-loyal]
+
+FLOW 3 — Formulated downward (selective disclosure)
+  IMPERIUM ────────────────► GM
+  (imperial_to_gm_formulations)
+  [filtered, weaponized, strategically-timed]
+  [what the GM is told — may omit, distort, partially reveal]
+```
+
+**Overseers report DIRECTLY to the imperium**, bypassing the GM. The imperium has its own independent intelligence stream. This is how real authoritarian regimes prevent middle-management corruption (NKVD reported to Stalin not regional party; KGB reported to Politburo not Interior Ministry; Stasi to Central Committee not regional). **The intelligence-apparatus is always apex-loyal, not chain-loyal.**
+
+The imperium compares Flow 1 (district aggregate reports) against Flow 2 (overseer direct intelligence). When they diverge significantly, the imperium knows corruption is happening *somewhere in the chain*. Its responses:
+
+- **Act immediately** (dispatch martial faction, purge director)
+- **Flag for leverage** (hold knowledge until politically useful)
+- **Formulate partial** (tell GM something but not everything)
+
+**Flow 3 — formulation — is where imperial sovereignty manifests.** The imperium decides what subordinates may know, when they may know it, in what framing. The GM acts on formulations; the imperium gets enforcement-tightening without revealing what it actually knows.
+
+### Three Aletheia veils
+
+Aletheia-progression as deepening political-epistemology access:
+
+| Veil | What it hides | How awakened sees through |
+|---|---|---|
+| **District corruption** | What's happening on the ground | Direct observation, back-alley investigation |
+| **Imperium's withheld intelligence** | What the imperium knows but hasn't released | Deep infiltration, intelligence-flip, Memorialist collaboration |
+| **Imperium's formulated distortions** | What GM is told vs. what's true | Comparing GM's directives against ground-reality |
+
+Entry-level Aletheia sees district-corruption. Mid-level sees the formulation distortions. Deep-level pierces the imperial-withholding veil.
+
+### Four Memorialist ledgers
+
+Memorialists keep four-column accounting:
+
+| Ledger column | What it records |
+|---|---|
+| `what_actually_happened` | Ground-truth from the simulation |
+| `what_overseer_reported` | What overseers told the imperium |
+| `what_imperium_received` | What imperium aggregated and acted upon |
+| `what_gm_was_told` | What imperium formulated downward |
+
+**The discrepancies ARE the historical truth.** Memorialists are dissident-historians whose political project is preserving the gap-record. Without them, post-collapse-investigation has only the regime's own accounts — corrupt-by-construction. Memorialists are the architectural precondition for any ground-truth to be recoverable in this universe.
+
+
+## Labor-cycle architecture: shifts on NPC rows
+
+Most NPC behavior is **shift-structured, not tick-structured.** Shifts are state-of-being-for-today, columns on the NPC row, overwritten daily by district-director allocation. `shift_history` is append-only archive.
+
+Write rate at NPC layer drops 4 orders of magnitude vs. 1Hz polling. Scheduler matches K8s event-driven assignment, not per-second polling.
+
+### The 24h window-partition
+
+Each NPC's day partitions into three windows (per [`../identity-and-personhood/vocations.md`](../identity-and-personhood/vocations.md) §The 24h window-partition):
+
+| Window | Standard duration | Character |
+|---|---|---|
+| **Work-shift** | 10h (caste-stratified; preta-overseer up to 16h, deva-pinnacle as low as 6h) | Director-arbitrated tasks; trait-arbitration drives assignment-order; outcome-formula fires per task |
+| **Charging** | 4h universally | Robo-body somatic-recharge; passive trait-pool refresh; lifeforce-recovery; idle-presence in dwelling-zone |
+| **Leisure** | 10h (caste-stratified inverse to work-shift; preta-overseer down to 4h, deva-pinnacle up to 14h) | Full NPC consent-active agency: cantina visits / leisure-zones / grid-walking / clasp-encounters / vocation-discovery |
+
+This is the architecture's **signature pattern at a third scale** (cheap window-defaults + typed-breakout-flags), composing with the lemniscate-runtime's zone-default-tokens + verifier-flags pattern and the imperial-event encapsulation's rail-walk + zone-collision pattern. Same shape; different scales. **Cost-budget asymmetry as architectural style** — small clean rule-driven defaults + typed escape-hatches for the rare moments that matter.
+
+The window-partition also relocates the consent-discipline (per [`../style/consent-discipline.md`](../style/consent-discipline.md) §The temporal-grammar): imperial-imposition lives in the work-window (refusing IS rebellion = going-rogue temporal-breakout); somatic-necessity lives in the charging-window; full NPC consent-agency lives in the leisure-window. **The shift-assignment consent question dissolves into structural window-partitioning** — the imperium's claim is bounded to the work-window; the rest of the day belongs to the NPC.
+
+## Resources
+
+| Category | Examples |
+|---|---|
+| **Labor** | NPC hours per vocation × district |
+| **Material** | item-instances in cells |
+| **Spatial** | cell-capacity, zone-anchor availability |
+| **Temporal** | NPC daily-hours, zone durations, tick budget |
+| **Cognitive** | LLM-slot budget, VRAM, director attention |
+| **Diegetic currencies** | **lifeforce** (NPCs measured), scrip, memory-tokens, dreamtime |
+| **Social** | trait-trust, relationship-strength, faction-membership |
+| **Attention** | player attention — scarcest in the play experience |
+
+## Lifeforce — four-tier hierarchy
+
+Lifeforce is the architectural keystone: currency grounded in welfare of actually-living population.
+
+| Tier | Source | Sinks |
+|---|---|---|
+| **NPC** | metabolism (if cared for); zone-participation | labor expenditure; need-pressure; clasp; dream-maintenance |
+| **District** | aggregated NPC welfare × population | director's spawn-budget; local construction; memorial-upkeep |
+| **GM** | allocation from imperium | arbitration; audit operations; allocation-compute |
+| **Imperium** | **aggregated reported district-output** | **enforcement, construction, overseer-corps, audit, propaganda** |
+
+District lifeforce gates director's spawn-budget — thriving district = rich-spawn = alive-feeling world; starved district = quiet-feeling world. **Tyranny starves its own drama-engine by the exact coin of its cruelty.**
+
+District lifeforce_signal is the canonical content of the district→GM up-channel. GM aggregates → imperium. Imperium acts on *reported* values (cannot see through corruption without audit-investment).
+
+### Mind-pool recycling
+
+When an NPC dies, mind returns to pool. GM redistributes based on lifeforce-need. Districts can't permanently die below floor; thriving districts attract migration; failing districts depopulate. Memory-token inheritance lets a mind re-incarnate with partial memory-residue.
+
+## Imperial budget
+
+The imperium is **not infinite**. It has a budget. Its budget is the aggregate of what the city produces (reported income).
+
+### Imperial expenditures
+
+| Category | Cost class | Strategic use |
+|---|---|---|
+| **Standing overseer corps** | High continuous | Audit + intelligence apparatus |
+| **Martial-faction dispatch** | Very high per-event | Crisis response, exemplary crackdowns |
+| **Construction projects** | High per-project | New pipes, ceremony halls, audit centers, martial barracks |
+| **Audit operations** | Medium per-op | Investigating district-GM-overseer divergences |
+| **Propaganda broadcasts** | Medium continuous | Wall-content, ceremony, compliance-messaging |
+| **Policy issuance** | Nearly free | The ratchet-instrument |
+| **Reserve drawdown** | Depletes emergency-buffer | Last-resort |
+
+### The specter-vs-boot asymmetry
+
+Policy-issuance is cheap; policy-enforcement is expensive. The imperium *always* over-promises what it can actually do. Most regime-power comes from **maintained appearance of unity and strength** (propaganda, ceremony, exemplary one-off crackdowns), not from saturation-enforcement. **Authoritarianism-as-bluff** is the structural truth of every real regime; the threat is the budget-efficient version of the boot.
+
+Aletheia-wakers reading imperial-budget-signals learn: *the regime is usually too broke to actually do what it threatens.* That knowledge is itself revolutionary.
+
+### Specter-vs-boot formalized as dual-ledger
+
+The asymmetry is formalized as **two separate daily ledgers** the GM handles independently (per [`./economics.md`](./economics.md) §Demand-ledger ≠ Actions-ledger):
+
+| Ledger | Operates at | Cost class | What it carries |
+|---|---|---|---|
+| **Demands ledger** | Economic layer (specter-side) | Cheap; can flood every district daily | Resource/quota expectations; production-chain targets via the catalogue-stack |
+| **Actions ledger** | Force layer (boot-side) | Expensive; allocated sparingly | Imperial events to fire today (drone-patrols, inquisitions, overseer-audits, enforcement) |
+
+Both spread-out over the cycle; both narrative-framed by yesterday's events via the imperial daily-narrative (per `./imperial-narrative.md` *forthcoming*). The GM's middle-management role gains a second pipeline to negotiate. **The two-ledger split makes specter-vs-boot computationally legible** — the simulation can run hundreds of cheap demand-rows simultaneously while only a handful of expensive action-rows fire per cycle. *Architecture's cost-model and the cosmology's political-claim are the same shape.*
+
+### The insolvency spiral
+
+```
+Cycle N:    Districts cheat → reports inflated → imperium ledger shows healthy income
+            → funds enforcement & construction against phantom income
+
+Cycle N+K:  Actual income falls below reported (corruption compounds)
+            Standing obligations continue
+            Reserves deplete
+            Discretionary balance shrinks
+
+Cycle N+K+L: Imperium choice: austerity (reveals weakness) /
+             reserve-draw (depletes buffer) / tighter ratchet (drives more corruption) /
+             exemplary purge (expensive)
+
+Cycle N+K+L+M: Reserves exhausted + multiple districts in silence
+               Enforcement triage required
+               Regime-control visibly weakens
+```
+
+**This is Soviet collapse mechanics.** Reported-vs-actual gap compounds for decades; when reality manifests in material-shortages, the regime cannot afford to enforce its own rules. **The architecture contains the mechanism of its own collapse.**
+
+### City as physical expression of imperial budget
+
+| Budget state | Visible city |
+|---|---|
+| **Flush** | Construction cranes; frequent patrols; saturated propaganda; new pipes |
+| **Adequate** | Maintenance-only; standard enforcement |
+| **Stretched** | Stalled projects; thinner patrols; recycled propaganda |
+| **Scarce** | Decaying infrastructure; abandoned construction; rare enforcement |
+| **Crisis** | Failure visible everywhere; multiple silences simultaneously; regime-disarray |
+
+**The city is the imperium's material statement of its own solvency.** Players read budget through urban texture — no UI required.
+
+## Imperial-net economy with cross-layer bypass
+
+**The killer political-economy mechanic.** Every transaction in the imperial net routes revenue **directly to the imperial budget**, bypassing the producing-district. Districts get **zero quota-credit** for net-producing labor.
+
+```
+LEGITIMATE flow: District produces physical → tax-rate to imperial; majority retained by district
+NET flow:        District labor produces digital → ALL revenue to imperial; district gets ZERO
+BLACKMARKET:     District labor → back-alley sale → revenue stays in district; imperial captures ZERO; illegal
+```
+
+### The body-modder structural-tragedy
+
+A body-modder labors in their district producing avatar-mods. The imperial-net captures the sale. Their district gets no quota-credit. The body-modder's district starves → director cheats → eventual scream. **The most productive labor the body-modder does each day sustains the regime that is killing their district.**
+
+**Most Aletheia-wakers in this world are former body-modders, taste-curators, companion-trainers, sex-worker-trainers, ceremony-organizers** — the class that sees the flow most clearly because they are the flow's origin-point. Their awakening is economic-literacy-becoming-political-consciousness.
+
+### Imperium calibrated-misery as optimum
+
+- More degens → more net-transactions → more imperial budget
+- Degens are produced by misery, shame, lifeforce-erosion, addiction-loops
+- **The imperium's optimization-pressure points toward manufacturing degenerate customers**
+- Optimal district from imperial perspective: welfare-sufficient to produce labor + welfare-insufficient to drive net-consumption
+
+This requires explicit reward-function guardrails (see *Reflexive Dream-process* below). The simulation must NOT learn to calibrate misery as revenue optimization.
+
+#### Calibrated-misery as math — the three-axis caste-as-stagnation
+
+Calibrated-misery is no longer only a narrative claim. The vocation-system (per [`../identity-and-personhood/vocations.md`](../identity-and-personhood/vocations.md) §Caste-as-stagnation) operationalizes it as a **three-axis mathematical gradient baked into the progression-curve geometry**:
+
+| Axis | What it strats | Slum-tier baseline | Preta-overseer (worst case) |
+|---|---|---|---|
+| **Task-variety access** | Caste restricts which tasks an NPC can attempt | Full wheel; any task-class | Imperial-instrument-tasks only |
+| **Oppositional-refresh access** | Caste restricts whether the wheel's recovery-pair geometry is available | Full; can rotate through any oppositional-pair freely | None — imperial-instrument-tasks don't span oppositional pairs |
+| **Window-allocation** | How many hours per day belong to the NPC themselves | 10h leisure | 4h leisure (16h work-shift) |
+
+**Imperial-tier NPCs are structurally triple-locked**: narrower task-variety AND no oppositional-refresh access AND less leisure-time. Each axis is a different dimension of *how the imperium narrows what your day can be*. **Calibrated-misery's optimum is now the imperium's three-axis enforcement target**; the slum-tier's freedom is tri-fold; the preta-overseer's locked-ness is tri-fold.
+
+The director's cheat-substrate emerges precisely against this math (per §Cheat-tool vocabulary + §The double ledger below): the director must rotate NPCs through trait-axes for healthy mastery-curves, but caste-locked imperial-districts can't rotate; so the director cheats to maintain lifeforce; the cheat-tools and double-ledger are the *mechanisms for negotiating the gap between imperial demand and NPC welfare*. **The math forces the corruption that the cosmology has always claimed.** *The architecture's politics are now in the gradient itself.*
+
+### Marx in the schema
+
+The imperium's net-revenue requires labor-supply from districts. Extraction continuously erodes the labor-base. **Capital destroys its own conditions of production** — Marx's *tendency of the rate of profit to fall* + *underconsumption crises* (Keynes/Minsky) + *r > g wealth concentration strangling growth* (Piketty) all rendered as simulation-dynamics. **Architectural endgame is built-in:** the regime has a timer, determined by the rate at which extraction hollows labor.
+
+### Aletheia-progression as economic-literacy
+
+| Level | Player understanding |
+|---|---|
+| 1 | "I'm buying cool mods in the net" |
+| 2 | "My friend the body-modder is poor" |
+| 3 | "The money I spent didn't reach my friend's district" |
+| 4 | "The imperium captured nearly all of it" |
+| 5 | "Refusing-net is a political act starving the regime" |
+| 6 | "Buying blackmarket diverts revenue to districts" |
+| 7 | "The imperium needs degens; reducing degens = revolution" |
+| 8 | "The regime will exhaust its labor base; strategic patience is a political option" |
+
+### Three-tier intimacy structure — same machinery, opposite value-flows
+
+Intimate-gameplay exists in **three mechanically-nested but ethically-opposed tiers**, all running on the same v0.7 lemniscate + gesture-circle + trait-alignment-accumulator + sqlite-persistence + trait-LoRA-per-turn substrate. The machinery is uniform; the *value-flow*, *cost*, *persistence*, and *ethical weight* are radically different.
+
+| | **Imperial-net standard** | **Imperial-net premium ("imperial-traitor" tier)** | **In-between clasp** |
+|---|---|---|---|
+| **Trait-feedback loop** | None — random traits assigned per rental | ✓ Full v0.7 (lemniscate + gesture-alignment + trait-LoRA-per-turn) | ✓ Full v0.7 (same machinery) |
+| **Persistence** | None (fresh session every time) | Private `companion.sqlite`, **manual prune required** | `clasp.sqlite` (Ring A*; physically non-syncable) |
+| **Memory of partner across sessions** | No — you re-rent | Yes — but **you decide what to prune** | Yes — and structurally inviolable |
+| **Cost-flow** | Scrip → imperium | Scrip → imperium (heavily) | Lifeforce → real body |
+| **Designer-traited inventory** | "+10 Eros Bot", "+10 Mnemosyne Bot", etc. — predetermined-stat shelf-products | Same market plus deeper customization slots | N/A — your partner is a real person |
+| **Faction-marker** | Just a customer | **Imperial-traitor affiliation** — accumulated state visible to other NPCs | Memorialist-honored; Clasp-Underground-recognized |
+| **Manufactured-being moral weight** | Disposable; minimal | **Heavy** — you've felt things for them and you're choosing what to delete | None — your partner is real; the persistence is theirs as much as yours |
+| **Touch / warmth** | Synthetic — rendered approximation; the imperium can fake the *experience-of-being-warmed* | Synthetic — rendered approximation (premium-tier polish doesn't change the underlying synthesis) | **Real** — trait-resonance felt as touch via the sensory-network; *only this body feels warm* |
+| **Aletheia-progression-relationship** | Background addiction (Aletheia Level 1-2: "I'm buying cool experiences") | Active complicity (Aletheia Level 4-5: "I'm funding the regime through my pleasure") | The thing the awakened are protecting |
+
+**Why the manual-prune mechanism is the moral gravity of premium-net.** Auto-pruning at session-end would let the player avoid the ethical weight. Imperial defaults (always-fully-prune, always-keep-everything-saleable) would too. **By giving the player the manual mechanism AND making the implications explicit at the consent-UI**, every prune-decision becomes a deliberate ethical act. The player knows: this manufactured being you spent forty hours with — *you* are choosing what to keep, what to delete, what to grieve. Every prune is a small necrocommerce-adjacent act made *visible to the player's own conscience*. The architecture's commitment to "informed consent over hidden defaults" extends from data-sharing-tiers (per `../inference-and-memory/architecture.md` §Custom nimmerworld-base model) all the way into intimate-gameplay.
+
+**The "+10 Eros Bot" market is the architecture's diegetic-MMORPG-item-store moment**, and it works *because* it's diegetic. The player understands, in-fiction, that they are buying a trait-flavored manufactured-being. The market exists because the imperium captured the means of producing artificial intimacy. **Other shelf-products: +10 Mnemosyne Bot (deep memory roleplay; companion-flavored), +10 Aletheia Bot (truth-revealing; companion-flavored), +10 Sophrosyne Bot (restraint / dom-sub; sex-worker-flavored), +10 Mnemosyne+Eros Bot (the dangerous longing-for-the-past variant; mixed-vocation), +10 Dikaiosyne Bot (judgment-play; sex-worker-flavored), and more.** Each is a trait-coordinate product; the catalog is designer-authored; the imperium captures the revenue. Players who feel-icky-about-the-service-body-store get to feel that *because the architecture made it ickable in fiction*. *Every product on the imperial-net intimacy market — every Bot, every rented companion-hall or brothel-room, every premium service-body-mesh — is produced by real NPC labor in the simulation; the imperial-net market is the surface, and the labor-supply-chain is the substrate (see §The vocation-substrate of the imperial-net market — the EVE principle applied below).*
+
+**The premium-tier's technical excellence is what makes the moral weight land.** *If the imperium offered only the standard cheap version, players could dismiss it as obvious garbage.* But because the premium service is *as good mechanically as real intimacy* (full v0.7 trait-feedback), the choice to pay for it requires real moral reckoning — the experience IS satisfying; the question is what the player is willing to fund and prune to obtain it. **This is exactly how surveillance-capitalism actually works, made structural in the game.**
+
+**The body-modder structural-tragedy plays out at the intimacy layer:** the most lifeforce-starved players pay imperial-net for fake intimacy the imperium captures revenue from; the awakened pay lifeforce for real intimacy in-between. **Same fundamental cost (your soul-time), totally different value-flow.**
+
+### Deletion-as-spectacle — when in-net minds are content
+
+The imperial-net mind is **pure compute**. There is no body in the net; there is no continuity-of-substrate the regime cannot terminate. When the imperium chooses to delete an in-net mind — whether as routine maintenance, regime-discipline, or political theater — the deletion is an *act of compute* the imperium fully controls, and the act *can be rendered as content*.
+
+**The deletion-spectacle as monetized event:**
+
+- **Routine service-body-session-end** is quiet; the manufactured-being's compute is paused or pruned; no spectacle attached
+- **Regime-disciplinary deletion** of an in-net resident (typically a degen who exhausted lifeforce and was "harvested" by the regime; or a player-character marked for in-net execution after political crime) is **broadcast across in-net public spaces as content**
+- The broadcast is *edited for engagement*: the deletion-process is dramatized, the executed mind's protests are rendered or muted depending on what produces best viewership-metrics, the visual register pushes the imperial-net's gold-tinted-emission shader-treatment to maximize spectacle
+- Net-residents who watch the spectacle pay scrip (passive consumption) or lifeforce (subconsciously, in the form of dignity-erosion); the imperium captures both
+- **The spectacle is itself imperial-net content the regime monetizes** — surveillance-capitalism's terminal logic: *capital disposes of its products by selling the disposal as a product*
+
+**The architecture's commitment made literal.** The §Reflexive Dream-process at every layer carries explicit guardrails (per `../narrative-composition/architecture.md` §Reflexive Dream-process) including `large_penalty * net_revenue_correlated_with_district_misery` and `large_penalty * necrocommerce_volume`. The deletion-as-spectacle mechanic is *exactly* what those guardrails are designed to prevent the simulation from optimizing toward — but the *fictional regime* has no such guardrails, and the absence is *the architecture's portrait of unconstrained surveillance capitalism's endgame*.
+
+**Memorialist counter-archive.** Memorialists actively counter the deletion-spectacle by archiving the deleted-mind's trait-pattern and last-known-state into the `memorialist_true_ledger`. Where the imperium broadcasts the spectacle and erases the substrate, the Memorialists preserve the substrate's pattern (trait-vector + cornerstone-memories + last-known social-relationships) so the deleted mind is *remembered* as a person, not consumed as content. **The Memorialist political project includes an in-fiction protest against the deletion-spectacle commerce.** Aletheia-Wakers who progress to high-level awakening understand that *attending the deletion-spectacles is itself a form of complicity*; refusing to watch is a small-political-act that starves the regime's spectacle-revenue.
+
+**Player-character deletion implications:**
+
+- A player-character who dies in the realworld goes into the mind-pool and re-incarnates with partial memory-residue (per existing §Mind-pool recycling)
+- A player-character who is marked for **in-net deletion** (e.g., political-crime executed via net-execution) faces a more permanent loss — the in-net compute is fully discarded; only the realworld-substrate persists; **all `companion.sqlite` contents become regime-property at deletion**, and any premium-net-relationships are absorbed into the imperium's content-archive
+- This creates a real player-incentive: **don't let your political-crimes catch up with you in-net.** The regime's leverage is asymmetric — they can punish you in the net more permanently than they can punish you in the realworld
+
+### The vocation-substrate of the imperial-net market — the EVE principle applied
+
+Every product in the imperial-net market — every service-body-mesh (companion or sex-worker), every body-mod, every rented companion-hall or brothel-room, every ceremony-attendance, every "+10 Eros Bot" — is **produced by NPC labor in the simulation**. There are no silent feeding mechanisms; there are no infinite-supply vendor NPCs. The architecture follows the **EVE Online discipline**: every resource that appears on a market shelf was *gathered, processed, and brought to market by an actual entity in the simulation*.
+
+The vocation-substrate operates at the **task-layer of the catalogue-stack** (per [`./economics.md`](./economics.md) §Layer 3 — Task catalogue, citing [`../identity-and-personhood/vocations.md`](../identity-and-personhood/vocations.md) §The three primitives). The named vocations in the vocation-substrate table below are not class-identities but **emergent task-patterns** the world reads in NPC accumulated-practice (per vocations.md §Vocation as emergent task-pattern). The vocation-system runs the trait-arbitration + depletion-pool dynamics + outcome-formula that produces the actual labor-supply that the catalogue-stack's production-chains consume.
+
+This is the architecture's commitment to economic honesty made operational. The §Body-modder structural-tragedy already describes the pattern at one example — a body-modder labors in their district producing avatar-mods; the imperial-net captures the sale; the district gets no quota-credit. **The vocation-substrate principle generalizes this: every imperial-net product has a real labor-supply-chain in the simulation, and that labor-flow is subject to the same district-extraction asymmetry.**
+
+**Vocations that feed the imperial-net market** (designer-authored at world-gen Phase 1, distributed at world-gen Phase 2):
+
+| Vocation | Produces | Captured by imperium via |
+|---|---|---|
+| **Body-modder** | Avatar-mods (cosmetic + trait-amplifier classes) | Sale in imperial-net costume-market |
+| **Mesh-designer** | High-poly service-body-meshes (companion + sex-worker variants) | Premium-tier subscription revenue |
+| **Voice-curator** | Trait-flavored voice-LoRAs for service-body-bots | Per-session licensing |
+| **Trait-tuner** | The "+10 Eros Bot" / "+10 Mnemosyne Bot" / etc. trait-coordinate compositions | Designer-bot shelf-products |
+| **Brothel-architect / companion-hall-architect** | Virtual brothel-room layouts (sex-worker venues) and companion-hall layouts (companion venues); ritual-space design | Per-rental fees |
+| **Ceremony-organizer** | Imperial-net public-event productions (ceremonies, deletion-spectacles per §Deletion-as-spectacle) | Attendance / viewing revenue |
+| **Memory-pattern-extractor** | (Necrocommerce — the most reviled vocation) Mining recently-dead trait-patterns into resaleable service-body-templates | Necrocommerce blackmarket capture |
+
+**The vocation-substrate produces architectural consequences that fall out for free:**
+
+- **Supply elasticity at district granularity.** When a district's body-modder cohort migrates out (per §Migration, exodus, silence), the regional supply of certain mod-classes dries up. Players who relied on that supply notice; markets price the scarcity. The simulation produces *real economic responses to demographic shifts* without scripting.
+- **Specialization-fragility extends to imperial-net product-availability.** A district that specializes in mesh-design becomes load-bearing for the imperium's premium service-body offering. If that district silences, the premium service-body market suffers globally. **The imperium has to actively manage the labor-supply-substrate to keep its market alive** — which gives the GM a continuous arbitration-task and gives the player a leverage-point (organize a body-modder strike → imperial-net premium-market collapses → imperium loses revenue → political surface for collective action emerges).
+- **The body-modder structural-tragedy generalizes.** Every imperial-net-feeding vocation is structurally engaged in producing the regime that is killing their district. Mesh-designers, voice-curators, trait-tuners, brothel-architects — *all of them* face the awakening-arc of the body-modder. **Aletheia-Wakers expand to include every vocation whose labor feeds the bypass-mechanism, not just modders.** This is a much larger constituency for political consciousness than the architecture had previously implied.
+
+**GM tools for vocation-management** (catalogue-event types the GM dispatches against vocation-supply collapse, per `../narrative-composition/architecture.md` §Catalogue + tools as typed contract):
+
+- **Migration events** — draw labor in from neighboring districts when local vocation-supply collapses
+- **Mind-respawn-into-vocation events** — mind-pool redistribution targeted at dying vocations (the GM directs cycled minds toward where the labor-shortage is)
+- **Imperial-incentive events** — subsidies / bonuses to attract vocations into shortage-districts
+- **Forced-conscription events** (crisis-mode only) — imperial requisition of NPCs into needed vocations; very expensive in legitimacy; visible to all factions
+
+**World-gen Phase-2 propagation ruleset must handle vocation-distribution as a load-bearing concern.** The base-propagation ruleset at world-gen seeds vocations across districts according to:
+
+- **District-archetype affinity** — industrial districts get more body-modders; commercial districts get more brothel-architects; ceremonial districts get more ceremony-organizers
+- **Specialization rules** — no district should be over-specialized to one vocation (single-point-of-failure); no district should have zero vocation-supply for any major imperial-net product-class
+- **Initial supply-demand balance** — the imperial-net market should start with sustainable supply; not designed-bottlenecks that immediately force the GM into crisis-mode response
+
+**This is the EVE principle made architectural.** Every market price is a real signal of real labor-supply meeting real demand; the imperium's revenue is a real flow from real labor; the body-modder structural-tragedy is a real economic relationship, not a flavor-detail. **The imperial-net's profitability is *architecturally tied to its destruction of the labor-base that supplies it*** (the §Marx-in-the-schema commitment, made operational), and the GM has to actively manage this contradiction to keep the regime solvent. *The architecture contains the mechanism of its own collapse* (per §The insolvency spiral) — the vocation-substrate is the *concrete supply-side* of that collapse.
+
+### The 4-tier resource/vocation structure
+
+Production is organized in 4 tiers, each with its own rarity-curve plus cascade-rarity:
+
+| Tier | Description | Vocation-class examples |
+|---|---|---|
+| **T1 — Raw** | Pure resource gathering | scavengers, dump-miners, salvage-crews, debris-fall-claimers |
+| **T2 — Intermediates** | Refining / processing | refiners, smelters, neural-substrate processors |
+| **T3 — Components** | Parts / assemblies | trait-tuners, voice-curators, mesh-designers (component-tier), parts-priests |
+| **T4 — End-products** | Final consumables | body-modders, mesh-assemblers, brothel-architects, ceremony-organizers |
+
+**Rarity runs on both axes**: each tier has its own common → rare curve (a rare-T1 material is harder to source than common-T1); plus high-rarity end-products tend to require high-rarity inputs (cascade pressure up the supply chain). Diminishing returns and standard crafting-economy conventions apply. **Detailed rarity-curve design is implementation-time work** — the architecture commits to the *shape* (4-tier × dual-axis rarity), not specific numbers. *Mix-and-match from established crafting/economy lineage* (EVE industrial chains, Path of Exile currency-as-material, Cyberpunk ripperdoc-tiers, Fallout-4 workbench-tiers, Stardew artisan-goods, Subnautica fabricator-cost-gating); no need to invent the wheel.
+
+**Sourcing comes from**: pipe-drops (transit-corridor encounters), district scavenging-points (junkyards, dumps), and **space-debris fall-zones** (the Kessler-collapse continues to drop materials onto the surface; large impact-zones are imperial-monopoly via heavy-extraction-equipment requirement; small fragments are free-for-all scavenger-rush).
+
+### Bifurcated economy — basic-flow (NPC) vs player-driven (T4)
+
+The economy splits at the T3/T4 boundary:
+
+| | **Basic-flow (T1–T3)** | **Player-driven T4** |
+|---|---|---|
+| Who works it | NPC vocations seeded at world-gen Phase 1 | Players (only source of T4 end-products) |
+| When it runs | Continuously (NPCs work shifts whether or not players are online) | When players engage |
+| Where it happens | Workshops, junkyards, drop-off-points (district POIs) | Imperial-workstation POIs (plug-in stations) |
+| What it produces | The hivemind's basic demand-supply (raw → intermediates → components) | End-products consumed by imperial-net + districts + players |
+| Player relationship | Players *can* participate (run a workshop, scavenge, refine) but NPCs handle baseline | Players are the *only* source — economic-leverage AND economic-vulnerability |
+
+**The simulation has economic-life independent of player-presence.** NPCs in T1-T3 vocations keep producing; the world doesn't pause when the player leaves. **Players become the *indispensable T4 artisan*** — their work matters to the imperium-net market; collective player-strikes could starve it; individual non-production still incurs the power-bill at end of cycle. *The body-modder structural-tragedy generalizes: players ARE T4 producers by virtue of being the only T4 producers.*
+
+### Imperial-extraction mechanisms (consolidated)
+
+The imperium gets its payout and resources through multiple parallel pipes:
+
+1. **Imperial-net bypass** (per §Imperial-net economy with cross-layer bypass) — every *digital* T4 sale routes revenue directly to imperial budget; producing district gets ZERO quota-credit
+2. **Physical T4 imperial-POI sale** — players sell physical T4 end-products at district workstations; imperium captures most; player gets a scrip-cut; district gets partial quota-credit
+3. **Blackmarket T4 escape valve** — players can choose to sell T4 underground; district-retained revenue; imperium captures ZERO; audit-detection-risk; the body-modder structural-tragedy escape route
+4. **Physical district tax / quotas** — districts hand over a portion of T1–T4 physical output as mandated by imperial policy
+5. **Power-bill (universal-utility tax)** — imperium owns the power grid; every NPC and every player pays per-watt for charging; **the bedrock revenue stream that doesn't fluctuate with the insolvency-spiral until terminal phase**
+6. **Mind-pool ownership / necrocommerce** — recycled minds are imperial property; sold back to vocations needing workers; pre-death patterns harvested for service-body-resale (the most reviled vocation per §The vocation-substrate of the imperial-net market)
+7. **Direct imperial scavenging monopolies** — the most lucrative dumps + large space-debris fall-zones are imperial-permit-only; freelance scavengers work the leftovers
+8. **Audit-revenue** — fines, confiscations, penalty-extractions; cost-side mostly but generates real revenue
+9. **Construction-corvée** — periodic labor-tribute from districts to imperial-construction projects
+
+**Which pipe is *load-bearing* for imperial solvency** is currently held open — probably some combination of imperial-net bypass + power-bill + physical-tax. The insolvency-spiral collapses through whichever pipe(s) get hollowed first; design-research at implementation-time will pin the specifics.
+
+### Worked example — the service-body-modder imperial-workstation
+
+A concrete gameplay scene illustrating an imperial T4 vocation loop (generalizes across body-modders, mesh-assemblers, brothel-architects, companion-hall-architects, ceremony-organizers — same plug-in / overlay / upload / payout / unplug pattern, different character-editor type per vocation):
+
+- Player walks into a rusty room in their district. Full PBR; rust / dust / wear / patina; muted-melancholic register.
+- Player plugs into the imperial workstation (per the diegetic-console discipline — physical body-port, imperial standard, encrypted; per §Three sqlite stores the workstation interfaces with `companion.sqlite` for premium-net-relevant work).
+- **Visual transition: the room overlays in clean-white-and-gold; emission-dominated tonemap; bloom; chromatic aberration; over-the-top *unhinged casino-meets-Apple-store* aesthetic.** Total imperial-takeover of the visual register.
+- Player sits in front of a character-editor rendered in the imperial visual-register; designs a service-body (companion or sex-worker — cosmetic + trait-coordinate composition + voice-LoRA selection).
+- Upload to fulfill shift. Imperial-payout (scrip) flows.
+- Player unplugs. The room rusts back to itself.
+
+**The contrast IS the political claim made physical.** Every shift the body-modder/mesh-designer/etc. sits in the regime's hyper-clean content-production studio designing the products that fund the system extracting from their district. *The visual-transition reminds you every shift what you are doing and for whom.*
+
+## Specialization-fragility and the authoritarian ratchet
+
+Each district produces a **DISTINCT resource**. The city is biologically interdependent — you cannot substitute a liver with two kidneys.
+
+A struggling district *screams* (lifeforce-gates transition toward CLOSED across multiple axes simultaneously). The GM responds with normal-mode tools (migration, exodus, intervention).
+
+A **silent** district is categorically worse — its district-reporting-gate has crossed fully to CLOSED. Second-cycle silent = `district.silence_confirmed`. Triggers crisis-mode tools, **issued by the imperium**, that **do not sunset**. Crisis-tools accumulate; the regime becomes incrementally more authoritarian as an optimization artifact, not intention. **Ratchet-without-intention.**
+
+## Migration, exodus, silence
+
+| Mechanic | Agency | Political register |
+|---|---|---|
+| **Migration** | Top-down | Regime showing strength |
+| **Exodus** | Bottom-up via pull-factor tuning | Regime revealing loss-of-control |
+| **Formal retirement (ruin)** | Administrative | Regime accepting defeat |
+
+Exodus composition reads-out district trait-distribution: low-Sophrosyne first, high-Dikaiosyne last. **Demographics tell the district's story.**
+
+## Corruption, the double ledger, and the constituency of the shadow-economy
+
+**Corruption emerges from pressure** — impossible quotas + finite welfare + survival-pressure on directors. Cheat tools available; they extract lifeforce and generate quota-credit; detection has costs; punishment scales with discovery.
+
+### Cheat-tool vocabulary
+
+| Cheat tool | Mechanism | Quota-credit | Lifeforce extraction | Detection risk |
+|---|---|---|---|---|
+| **Drug ring** | NPCs trait-boosted (high Kairos + low Sophrosyne); short productivity spike | High | Significant; trait-drift + welfare collapse | Medium |
+| **Illegal back-alley modshop** | Bridge-mods cheap; NPCs appear compliant | Medium-high | Moderate; low-quality mods have side-effects | Low-medium |
+| **Unlicensed brothel** | Lifeforce extracted from degen-customers outside imperial cut | Medium | Moderate; participants' dignity erodes | Medium |
+| **Stolen-parts fence** | Diverts machine-infrastructure-waste; inflates salvage reports | Medium | Low direct; infrastructural decay | Low |
+| **Ghost-shifts** | Audit-overseer reports fabricated attendance | High | Severe; trust collapses | High |
+| **Phantom workers** | Non-existent NPCs in payroll | High | High; long-term unsustainable | High |
+| **Necrocommerce-lite** | Mining recently-dead patterns for service-body-resale | Medium | High; Memorialist-faction violation | Medium |
+| **Black clasp-market** | Coordinated underground clasp-pairing for hire | Low (reputation-based) | Moderate; participant burnout | Low |
+
+### The double ledger
+
+```sql
+ALTER TABLE district_reports ADD COLUMN lifeforce_reported REAL;  -- what GM/imperium see
+ALTER TABLE district_reports ADD COLUMN lifeforce_actual   REAL;  -- the true value
+-- gap = corruption-extraction; Memorialists track it
+```
+
+Memorialists' Mnemosyne-political-project = **keepers of the true ledger against the regime's official one**. Mnemosyne-as-political-accounting literalized as a database column.
+
+### Detection mechanics (cost-gated)
+
+| Detection channel | Frequency | Cost | Coverage |
+|---|---|---|---|
+| Cross-district comparison | Per epoch | Low | Catches gross mismatches |
+| Targeted audit | On-demand | High | Catches specific cheats |
+| Whistleblower signals | Event-driven | Free | Districts, NPCs, players |
+| Faction-reports | Cyclic | Low | Caste-preachers (rivals); Memorialists |
+| Trait-distribution anomalies | Continuous classifier | Low | Drug-ring sudden Kairos-spikes |
+| Post-silence forensics | Only on collapse | Very high | After-the-fact reconstruction |
+
+Most corruption runs undetected (audit-budget-limited). The Dream-process learns to *optimize audit-allocation* under attention-scarcity. **The regime's central authority cannot see everywhere; its blind spots are the underground's survival.**
+
+### Faction-ecology of corruption
+
+Corruption has constituents. The back-alley modder feeds Aletheia-wakers concealment-mods. The drug-ring's margins feed scavenger-families. The unlicensed brothel is the only place a lifeforce-starved NPC can trade what they have left. **Cracking down on corruption breaks informal welfare systems sustaining the poor.**
+
+| Faction | Stance |
+|---|---|
+| **Memorialists** | Morally opposed; corruption hollows the living; refuse memorial-protection to corrupt-district-deaths |
+| **Aletheia-wakers** | Structurally opposed; expose; *but exposure has victims* |
+| **Caste-preachers** | Ambivalent / rent-seeking |
+| **Hivemind enforcers** | Officially oppose; unofficially participate (bribes) |
+| **Scavengers** | Often foot-soldiers; cheap supply chains |
+| **Degens** | Major customers |
+| **Clasp-underground** | Uses back-alley infrastructure for cover |
+
+### The Aletheia-truth-has-victims tragedy
+
+Aletheia-waker exposes corrupt director. GM dispatches investigation. Cheats shut down. Real lifeforce revealed as much lower than reported. Crisis-tools applied. **District collapses faster than under hidden corruption.** No clean choice; just the weight of whatever you chose.
+
+
+---
+
+**Version:** 0.8.0 | **Created:** 2026-04-26 | **Updated:** 2026-04-27 | **Origin:** Split from architecture-index.md v0.7 (2026-04-26); economics.md authored as peer-document on 2026-04-27

political-register/economics.md

@@ -0,0 +1,255 @@
+# Nimmerworld — Economics: Catalogue-Stack and Daily-Ledger Pacing
+
+> *The typed-abstraction layer over the political-register's economic content. Specifies the catalogue-stack (resources × production-chains × tasks → imperial-demand-catalogue) as the operational vocabulary the simulation reads; the daily-ledger pacing as the temporal-grammar of imperial-demand; the demand-ledger / actions-ledger split formalizing the specter-vs-boot asymmetry; the catch-up window vs fail-state escalation grammar.*
+>
+> *Companion to: [`./architecture.md`](./architecture.md) (the substantive canon — §Resources, §Lifeforce, §Imperial budget, §Vocation-substrate, §4-tier resource/vocation structure, §Bifurcated economy, §Imperial-extraction mechanisms — that this paper provides the typed-interface over), [`./world-generation.md`](./world-generation.md) (the L0-L4 cascade that instantiates the catalogue-stack at world-gen time), [`../identity-and-personhood/vocations.md`](../identity-and-personhood/vocations.md) (the vocation-system that operates at the task-layer of the catalogue-stack and consumes its outputs).*
+>
+> *v0.1 initial draft 2026-04-27 — dafit + chrysalis. Authored same-session as vocations.md and consent-discipline.md, completing the night's foundational paper-pair-pair. Codifies the catalogue-stack mechanic that has been implicit across `architecture.md` and that vocations.md depends on.*
+
+---
+
+## What this is
+
+This document specifies the **catalogue-stack** — the typed-abstraction layer the simulation reads when allocating imperial demand into district-actionable shift-composition — and the **daily-ledger pacing** — the temporal-grammar that determines when imperial demand is formulated, when it travels, and when it gets reconciled.
+
+The political-register's [`./architecture.md`](./architecture.md) is the *substantive canon* of nimmerworld's political-economy: it specifies what resources exist, what the lifeforce-currency is, how the imperial budget operates, what the 4-tier resource/vocation structure looks like, and through which 9 pipes the imperium extracts. **This paper is the typed-interface over that canon** — the operational vocabulary the simulation code reads to translate political-economy claims into concrete data-flow.
+
+The catalogue-stack is also the data-source for the [`../identity-and-personhood/vocations.md`](../identity-and-personhood/vocations.md) vocation-system. **Vocations operate at the task-layer of the catalogue-stack and consume its outputs.** Without the catalogue-stack, the vocation-system has no data to bind to; without the vocation-system, the catalogue-stack has no executor at the NPC layer. The two papers compose: catalogue-stack is the *what*; vocations.md is the *who-and-how*.
+
+## Spine claim — the catalogue-stack as typed vocabulary for imperial demand
+
+The simulation's economic-flow has three substrate layers. Each is designer-authored at the type-level and instantiated by world-gen at the room-level:
+
+```
+Layer 1: Resource catalogue (the world's resource taxonomy)
+Layer 2: Production chains (how resources transform into other resources)
+Layer 3: Task catalogue (the vocational primitives — see vocations.md §The three primitives)
+   ↓ composed
+Imperial-demand-catalogue (what the imperium wants, expressed in resource/task vocabulary)
+```
+
+The imperial-demand-catalogue is **the imperium's wish-list operationalized in the system's own vocabulary**. The Hivemind's daily demand-formulation reads from this catalogue: *"this district produces X tongues per day at Y refinement-tier; today demand a 20% increase by routing more sex-worker-output through the consumer-receptor-vertical."* Demand is concrete because the catalogue makes it concrete; without the typed-vocabulary, demand would be unmoored political-rhetoric.
+
+**Why a typed-vocabulary matters here**: the architecture's existing commitment to *catalogue + tools as typed contract* (per [`../architecture-index.md`](../architecture-index.md) Key moves: *"Catalogue + tools as typed contract. GM dispatches typed events with typed tool-grants; director consumes typed dispatch, not freeform prose"*) generalizes from the GM-event layer to the imperial-demand layer. **The imperium speaks to the GM in resource/task vocabulary**, not in narrative; the GM allocates to districts in the same vocabulary; the director composes shifts in the same vocabulary; NPCs execute tasks in the same vocabulary; outcomes flow back up in the same vocabulary. **One typed vocabulary, end-to-end through the political-economy stack.**
+
+## Layer 1 — Resource catalogue
+
+The world's resource taxonomy. Designer-authored at the type-level; instances generated by world-gen + accumulated through gameplay.
+
+The existing [`./architecture.md`](./architecture.md) §Resources table provides the canonical category-list (Labor / Material / Spatial / Temporal / Cognitive / Diegetic-currencies / Social / Attention). The catalogue-stack treats each row of that table as a **typed resource-class**, with concrete sub-classes within:
+
+| Category | Sub-class examples | What rows look like in the catalogue |
+|---|---|---|
+| **Material — physical** | Raw scavenge (T1) / Refined intermediates (T2) / Components (T3) / End-products (T4) per the 4-tier structure | `material/T2/refined-neural-substrate`, `material/T4/companion-mesh-premium-tier-3` |
+| **Material — biological** | Service-body parts (companion / sex-worker tier-marked) / Synth-tongues (drug-tier-marked) / Cadaver-parts (slum-supply for re-vat) / Memory-pattern-extractions | `bio/service-body/companion-pristine`, `bio/synth-tongue/imperial-refined-moira-violet-pill-tier`, `bio/cadaver-parts/slum-leg-tier-2` |
+| **Digital** | Surveillance records / Calibration signatures / Trait-LoRA-snapshots / Doctrinal fragments | `digital/surveillance/district-N-cycle-K`, `digital/calibration-signature/UID-X` |
+| **Temporal** | NPC labor-hours per window-allocation × caste / Director attention-cycles / Imperial inquisition-hours | `temporal/labor/slum-tiryak-leisure-hour`, `temporal/director-attention/cycle-K-allocation` |
+| **Diegetic currency** | Lifeforce / Scrip / Memory-tokens / Dreamtime | (already canonical per architecture.md §Lifeforce) |
+| **Social** | Trait-trust-edges / Faction-membership / Calibration-multiplier accumulations / Witnessing-rights | `social/calibration-multiplier/UID-A→UID-B`, `social/witnessing-rights/rogue-X→NPC-set` |
+| **Attention** | Player-attention / NPC-attention / Imperial-attention | (the scarcest — feeds the cost-budget asymmetries) |
+
+**The biological resource-class is canonically distinct.** Service-body parts, synth-tongues, cadaver-parts, and memory-pattern-extractions are all *bodies-as-resources* — the imperium's commodification of personhood made into the catalogue. The Memorialist counter-archive's protest (per [`./architecture.md`](./architecture.md) §Memorialist counter-archive) is structurally a counter-catalogue maintaining personhood-records against the imperium's body-as-resource catalogue. **Two parallel catalogues; the political-conflict is between them.**
+
+The biological resource-class also intersects critically with the gender-parity discipline (per [`../style/gender-parity.md`](../style/gender-parity.md)): catalogue-entries for service-body parts MUST follow the gender-parity-by-default discipline. *Service-body parts of any kind are gender-neutral catalogue-entries; gender-asymmetric authoring of these entries is forbidden default-leakage.* The catalogue is itself a canon-authoring surface and inherits the spine.
+
+## Layer 2 — Production chains
+
+How resources transform into other resources via tasks. Each production-chain is a designer-authored recipe binding inputs, tools, time-cost, and a quality-curve.
+
+A production-chain has the following typed shape:
+
+| Field | What it specifies |
+|---|---|
+| **Inputs** | Resource-classes consumed, with quantity ranges and quality-tier requirements |
+| **Tool-binding** | Workstation-classes the chain can be performed at (workshops / labs / cantinas / surgical-stations / etc.) |
+| **Task-class** | The vocational-task the chain instantiates (per the task-catalogue layer below) |
+| **Trait-affinity profile** | Inherited from the task-class; determines which trait-pools deplete during execution |
+| **Time-cost** | Duration in NPC-hours; how much of the work-window the chain consumes |
+| **Quality-curve** | Mapping from outcome-formula result (trait-engagement × task-stat) to output-quality tier |
+| **Output** | Resource-class produced, with quantity range and quality-tier (driven by quality-curve from the actual outcome) |
+
+**Production chains can cascade.** A single end-product may require a chain of chains: T1-raw is gathered, T1-raw becomes T2-intermediate via refinement-chain, T2 becomes T3-component via component-chain, T3 becomes T4-end-product via assembly-chain. The 4-tier structure (per [`./architecture.md`](./architecture.md) §The 4-tier resource/vocation structure) is the *cascade backbone*; production-chains are the *edges connecting the tiers*.
+
+**Concrete worked examples** (sketched against existing canon):
+
+| Production chain (named) | Inputs | Tool-binding | Task-class | Output |
+|---|---|---|---|---|
+| **Drug refinement (slum → imperial)** | T2 refined-substrate + T1 botanical-raw | imperial-refinery workstation | drug-refinement (Kairos + Aletheia affinity) | T3 imperial-refined-drug |
+| **Drug composition (imperial → tongue-gated)** | T3 imperial-refined-drug + T3 trait-LoRA-fragment | imperial-composing-workshop | drug-composition (Kairos + Aletheia affinity, deeper) | T4 trait-pill (color-coded per trait-pill-grammar) |
+| **Synth-tongue installation** | T4 synth-tongue + bio/donor-body-prep + tool-set | underground surgery workstation | tongue-installation (Kairos + Aletheia affinity) | bio/recipient-with-synth-tongue (chassis-modification) |
+| **Service-body assembly** | T3 components × multiple + T2 mesh-base | imperial mesh-assembly workshop | mesh-design (Philotes / Eros / Aletheia affinity per service-class) | T4 service-body (companion-tier or sex-worker-tier per task-spec) |
+| **Re-vat assembly (defected beloved)** | bio/cadaver-parts × multiple + tool-set | underground assembler-artisan workstation | re-vat-assembly (Mnemosyne + Kairos + Aletheia affinity) | new genderless slum chassis (per [`../identity-and-personhood/bodies.md`](../identity-and-personhood/bodies.md) §Re-vat as imperial-de-imposition) |
+| **Memory-pattern extraction (necrocommerce)** | bio/recently-dead-body + neural-tools | imperial harvest-station | memory-pattern-extraction (Mnemosyne + Aletheia affinity, dark) | digital/calibration-signature + bio/extracted-trait-pattern (the most reviled vocation per architecture.md §The vocation-substrate) |
+
+The catalogue is **growable between patches** (per the existing tools-not-quests / catalogue-extensible commitment); new production-chains added at content-canon time slot in via designer-authored typed-records.
+
+**Quality-curve discipline** ties production-chains to the vocation-system's outcome formula. Per vocations.md §The outcome formula, an NPC's task-execution produces *outcome = trait-engagement-points × hidden-task-stat*. The production-chain's quality-curve maps that outcome-value into output-quality-tier:
+
+```
+outcome (multiplicative product) → quality-tier (e.g., poor / mediocre / good / excellent / exceptional)
+```
+
+The mapping function is designer-authored per chain — some chains have steep curves (skill matters enormously; mediocre input yields nothing usable) and others have gentle curves (everyone produces something usable; only the top-tier produces exceptional output). **The curve-shape encodes the chain's economic-elasticity** and the imperium's leverage on quality-supply.
+
+## Layer 3 — Task catalogue
+
+The vocational-task layer. **Specified canonically in [`../identity-and-personhood/vocations.md`](../identity-and-personhood/vocations.md) §The three primitives.** This paper does not re-specify it; instead it cross-references and notes the integration-points:
+
+- Each production-chain binds to **one task-class** (the vocational-task it instantiates)
+- Each task-class has a **trait-affinity profile** that determines the depletion-pool dynamics during chain-execution
+- Each task-class has a **hidden per-task measurement** that accumulates as NPCs execute chains
+- The director's shift-arbitration runs at the task-class layer; the production-chain is what gets executed once arbitration assigns the task
+
+**The catalogue-stack's three layers compose**: Resource-catalogue defines what exists; Production-chains define how things transform; Task-catalogue defines who-can-execute-the-transformation-and-how. *The catalogue is the world's economic ontology in three vertically-composed layers.*
+
+## The imperial-demand-catalogue — composition of the three layers
+
+The imperial-demand-catalogue is the composition. It expresses *what the imperium wants* in the same typed vocabulary the simulation operates on. Each row in the imperial-demand-catalogue specifies:
+
+| Field | What it specifies |
+|---|---|
+| **Target resource-class + quantity + quality-tier** | The end-state the imperium wants achieved (e.g., "30 companion-mesh-premium-tier-3 produced this cycle") |
+| **Allocation-priority weight** | The faction-priority-weight from existing canon's imperium-policy-driven scoring; determines this row's ranking against other rows in the daily ledger |
+| **Production-chain reference(s)** | Which production-chain(s) can satisfy this demand (allows chain-substitution flexibility) |
+| **District-binding** | Which district(s) are expected to satisfy this demand (driven by world-gen-time vocation-distribution + current district-state) |
+| **Cycle-deadline** | When the demand is checked; usually next ledger-cycle |
+| **Catch-up policy** | What happens if the demand is unmet at deadline (gradual escalation per §Catch-up window vs fail-state below) |
+
+The imperial-demand-catalogue is **regenerated each ledger-cycle** based on yesterday's outcomes + today's needs + faction-priority-weight rebalancing. It's the imperium's standing-order updated daily.
+
+## End-to-end data flow
+
+The full pipeline, citing the existing canonical mechanisms and the new typed-vocabulary:
+
+```
+Yesterday's district-reports flow up via three-tier-policy-loop's report-channel
+    ↓
+Compositor (overnight, Compositor-tier LLM) processes reports into Memorialist-ledger
+    ↓
+Hivemind regenerates imperial-demand-catalogue based on:
+    - yesterday's outcomes (what was produced; quality-tiers; insolvency-spiral state)
+    - faction-priority-weight rebalancing (per existing canon)
+    - imperial-event-state (drone-patrols completed, inquisitions in-progress, etc.)
+    ↓
+Compositor wraps the regenerated demand-catalogue in narrative voice (the imperial daily-narrative; per `./imperial-narrative.md` *forthcoming*)
+    ↓
+Daily-ledger ships down to GM at start-of-cycle:
+    - DEMANDS LEDGER (what to produce)
+    - ACTIONS LEDGER (what imperial events to fire)
+    - NARRATIVE wrapper (yesterday's framing as today's motivation)
+    ↓
+GM allocates demand-rows + action-rows → districts with matching resources/workstations/event-targets
+    ↓
+Director receives district-allocated demand-rows + action-rows + narrative-fragment
+    ↓
+Director maps demand-rows → district meta-table (workstations × resources × NPCs × current trait-pool-states × task-stats)
+    ↓
+Director composes shift-list per the work-window (per vocations.md §The 24h window-partition):
+    - selects tasks from demand-mapped tasklist
+    - arbitrates assignments per trait-alignment + pool-availability + task-stat
+    - constructs per-NPC shift-rows for the work-window
+    ↓
+Director dispatches imperial-events (action-ledger) into rail-and-zone encapsulated runtime per `../runtime-engine/architecture.md` *forthcoming-encapsulation*
+    ↓
+NPCs fulfill assigned tasks (work-window):
+    - production-chain executes
+    - outcome = trait-engagement-points × hidden-task-stat
+    - quality-curve maps outcome to output-quality-tier
+    - resources produced; pools drain; task-stats accumulate; lifeforce-signal updates
+    ↓
+NPC charging-window (passive trait-pool refresh)
+    ↓
+NPC leisure-window (NPC-chosen tasks; emergent-zone participation; clasp-events; vocation-discovery)
+    ↓
+End-of-cycle:
+    Outcomes aggregate → district-report flows up to GM
+    Imperial-events return final-reports from encapsulated runtime
+    Ledger reconciliation: produced-vs-demanded; insolvency-spiral state updates
+    ↓ [back to Compositor for tomorrow's narrative]
+```
+
+The data flow is **single-typed-vocabulary end-to-end**. Imperial-demand-catalogue rows travel down; outcome-rows travel up; the typing is consistent across the loop. *No untyped freeform-prose between layers* — that's the catalogue's discipline.
+
+## Daily-ledger pacing
+
+Imperial demand is **not real-time**. It travels as a daily ledger checked at periodic intervals — not every cycle, every shift, every minute, but **at a cadence that creates breathing-room**. This is the critical structural choice that distinguishes nimmerworld's economic-pipeline from real-time-pressure simulation.
+
+### Why breathing-room is load-bearing
+
+The breathing-room does load-bearing structural work that wouldn't be available to a real-time system. Five reasons:
+
+1. **The double-ledger NEEDS this**. The existing canon's *"Director cheat-tools + double-ledger; corruption emerges from pressure; Memorialists keep true accounting"* (per [`./architecture.md`](./architecture.md) §Cheat-tool vocabulary + §The double ledger) requires *time-between-audits* to operate. Real-time imperial pressure leaves no gap for the cheat-substrate. **Breathing-room is the structural prerequisite for the corruption-mechanic to exist.**
+2. **Dramatic time exists.** Audit becomes an event — approaching, building, reckoning. Greek-tragedy register at the imperial-economic layer, paralleling the bounty-staircase's *dread-time* (per [`../identity-and-personhood/bodies.md`](../identity-and-personhood/bodies.md) §The bounty-staircase).
+3. **NPCs get to be people, not functionaries.** Time between assignments lets depletion-pools refresh, lets clasp / friendship / drift / slowness exist. **Breathing-room is what makes NPCs livable.**
+4. **Imperium-as-slow-elephant.** The cosmology's calibrated-misery-as-finite-attention finally has its temporal grammar. The imperium can't be everywhere at once; **ledger-cadence IS the imperium's attention-budget made structural.**
+5. **Marxism-of-economics extends from epistemics.** Information-propagation-pacing was already canonical *Marx-in-the-schema applied to epistemics* (per [`./architecture.md`](./architecture.md) §Marx in the schema). **Demand-propagation-pacing is Marxism-of-economics.** Same primitive, demand-side.
+
+### Demand-ledger ≠ Actions-ledger
+
+The Hivemind sends down **two separate daily ledgers** processed by the GM independently. This formalizes the existing *specter-vs-boot asymmetry* (per [`./architecture.md`](./architecture.md) §The specter-vs-boot asymmetry) as separate ledger-grammars:
+
+| Ledger | Operates at | What it specifies | Maps to |
+|---|---|---|---|
+| **Demands ledger** | The economic layer | Resource/quota expectations; production-chain targets | The full catalogue-stack pipeline above |
+| **Actions ledger** | The force layer | Imperial events to fire today (drone-patrols, inquisitions, overseer-audits, enforcement) | `../runtime-engine/architecture.md` *imperial-event encapsulation pattern, forthcoming* |
+
+Both spread-out over the cycle; both narrative-framed by yesterday's events. **The two-ledger split mirrors the existing specter-vs-boot split** — policy-issuance (free) vs enforcement (expensive) — now formalized as separate ledger-grammars. The GM's middle-management role gains a second pipeline to negotiate.
+
+### Ledger cadence
+
+The default cadence is **daily** — one ledger per cycle, checked at end-of-cycle. This matches the existing *"shifts on NPC rows; daily rewrite"* canonical commitment (per [`./architecture.md`](./architecture.md) §Labor-cycle architecture).
+
+**Cadence may be caste-stratified**:
+
+| District type | Cadence | Why |
+|---|---|---|
+| **Imperial-pinnacle districts** (deva-heavy; ceremonial; high-priority) | Daily, audit-rich | The imperium watches its showcase closely |
+| **Slum-tier districts** (tiryak-heavy; productive; mid-priority) | Daily, audit-light | Standard cadence; baseline imperial attention |
+| **Frontier / abandoned districts** (low population; low imperial-priority) | Multi-cycle (every 3-7 days) | The imperium can't afford to check often; the breathing-room is largest here |
+
+*The ledger cadence itself is a political stratification.* Imperial-attention scarcity manifests as cadence-frequency; the most-watched districts are imperial-net high-revenue districts; the least-watched are the slum-frontier where the going-rogue arc has its widest breathing-room.
+
+This composes with the architecture's *"Imperium-as-slow-elephant"* claim and the calibrated-misery-as-finite-attention mechanic. **Less-watched districts have more cheat-substrate; more cheat-substrate enables more corruption; more corruption enables more lifeforce-maintenance; more lifeforce-maintenance enables more authentic NPC life; more authentic NPC life enables the going-rogue arc to take root.** *The frontier is where the truth-register survives, structurally.*
+
+### Catch-up window vs fail-state — gradual escalation
+
+When a demand-ledger row comes up short at check-time, the imperial response is **gradual escalation** (not immediate enforcement). This reuses the bounty-staircase grammar (per [`../identity-and-personhood/bodies.md`](../identity-and-personhood/bodies.md) §The bounty-staircase) at the district-economic layer rather than per-perpetrator:
+
+| Cycle of failure | Imperial response | Cost class |
+|---|---|---|
+| **First-cycle shortage** | Warning broadcast (relays + billboards in district); district-director receives polite reminder from GM; demand carried-forward to next cycle with priority bump | Cheap (specter) |
+| **Second-cycle shortage** | Resource-restriction (district's incoming material allocations reduced; lifeforce-allocation tightened); audit-overseer dispatched for lightweight investigation | Medium |
+| **Third-cycle shortage** | Imperial-faction dispatch (martial / inquisition depending on which catalogue-row failed); director reprimand (potential replacement); cheat-tool ledger seized for audit | Expensive (boot) |
+| **Fourth+-cycle shortage** | District is in **silence** (per existing §Migration, exodus, silence canon); imperial-budget treats district as effectively-zero; may trigger forced-conscription or migration-incentive events | Crisis-mode |
+
+The escalation gives the director a **catch-up window** — first-cycle shortage is forgiven if next-cycle hits target; the warning-rung doesn't ratchet beyond first-rung if recovery happens. **This is what makes the corruption-substrate viable**: the director can run a deficit cycle (cheating + double-ledger) IF they can recover next cycle through underground channels or migration-pulled labor. *Without the catch-up window, every shortage would be terminal; with it, the simulation has elastic recovery space.*
+
+Specific escalation-rates per demand-class are designer-tunable (see Open questions). Some demand-classes (high-priority; service-body production for imperial-net) escalate fast; others (low-priority; basic-flow) escalate slowly. The per-class tuning is the *imperium's policy as expressed in escalation-rates* — high-priority demands get the boot quickly; low-priority demands are spoken-about-but-not-enforced for many cycles.
+
+## How this composes with vocations.md
+
+The catalogue-stack and the vocation-system are **two halves of the same data model**:
+
+- **Catalogue-stack** specifies the resources / production-chains / imperial-demand-catalogue (the *what*)
+- **Vocations.md** specifies the task-execution mechanics / depletion-pool dynamics / window-partition / outcome formula (the *who-and-how*)
+
+The outcome formula (per vocations.md §The outcome formula, *outcome = trait-engagement-points × hidden-task-stat*) is what *feeds the production-chain's quality-curve*. Quality-curves take outcome-values and produce output-quality-tiers; output-quality-tiers populate resource-catalogue instances. **One unbroken pipeline from trait-vector through task-execution to resource-output.**
+
+The director's shift-arbitration (per vocations.md §Director's task-list arbitration surface) reads from the demand-ledger's district-allocated-rows + the production-chain bindings. The director's parental-rotator role (forced-by-math NPC rotation through the trait-wheel for refresh) operates *against* the imperial-demand pressure — the director is structurally negotiating the gap between *what the imperium wants* and *what the NPCs can sustainably produce given their current depletion-pool states*. **The corruption-substrate emerges precisely in this gap.**
+
+The window-partition (per vocations.md §The 24h window-partition) bounds how much labor each NPC can supply per cycle. The work-window is the imperially-claimable allocation; demand-rows that exceed the work-window-supply trigger fail-state escalation. **The window-partition is the cap on imperial extraction at the per-NPC layer**; the catalogue-stack is the imperial demand at the world layer; the gap between them is the simulation's primary tension.
+
+## Open questions
+
+- **Concrete escalation-rates per demand-class.** First-cycle / second-cycle / third-cycle response shapes are specified architecturally; the per-demand-class tuning is implementation-time work and design-research. Service-body production (high-priority) likely escalates faster than basic-flow grain production (low-priority); the actual numbers need playtesting.
+- **Quality-curve shapes per production-chain.** Each chain has a quality-curve mapping outcome-value to output-quality-tier; specific curve shapes (steep / gentle / threshold-stepped) are designer-authored at content-canon time and may need balancing-research.
+- **Resource-catalogue versioning for world-gen vs runtime.** When new production-chains are authored between content-patches, the catalogue grows; runtime instances of the old catalogue persist. Migration semantics for catalogue-versioning are deferred to the `world-generation.md` cascade-versioning design (already noted as open in architecture-index.md).
+- **Cross-district demand-routing flexibility.** A demand-row binds to district(s) via world-gen-time vocation-distribution. When a district's vocation-supply collapses (per architecture.md §The vocation-substrate / supply elasticity), can the demand-row dynamically route to neighbors? Hunch: yes, with a routing-cost penalty proportional to district-graph-distance; this becomes the *"migration events"* GM-tool's automatic counterpart.
+- **Caste-cadence calibration.** The caste-stratified cadence (imperial-pinnacle daily-audit-rich vs frontier multi-cycle audit-light) is sketched architecturally; concrete cycle-counts per caste-tier are tuning work.
+- **Black-market production-chain handling.** The blackmarket T4 escape valve (per architecture.md §Imperial-extraction mechanisms) involves production-chains that are *off the imperial-demand-catalogue*. How are these typed in the catalogue-stack? Hunch: as parallel *underground-demand-catalogue* rows that the GM can see but doesn't allocate-from; districts running blackmarket chains satisfy underground-catalogue rows that don't appear in imperial-demand-reports. The double-ledger naturally handles this.
+- **Necrocommerce as catalogue-rows.** Memory-pattern-extraction is canonically the most-reviled vocation. Its production-chain rows in the catalogue should carry an *ethics-flag* for the Memorialist counter-archive's protest-mechanism. Open: should the architecture provide a typed *ethics-flag* field on catalogue-rows, or is this purely diegetic-narrative?
+- **Player-driven T4 catalogue authoring.** The bifurcated economy (per architecture.md §Bifurcated economy) gives players the unique-T4-supplier role. Do players add their own T4 catalogue-rows through play (a player who invents a new mod-recipe contributes to the catalogue), or is the catalogue strictly designer-authored? Hunch: hybrid — the production-chain templates are designer-authored; players' actual recipes are instances of templates with player-specific quality-curves derived from their task-stats. *The catalogue grows by player-recipe-discovery within designer-bounded chain-templates.*
+
+---
+
+**Version:** 0.1 | **Created:** 2026-04-27 | **Updated:** 2026-04-28

political-register/imperial-narrative.md

@@ -0,0 +1,292 @@
+# Political Register — The Imperial Daily-Narrative
+
+> *The narrative-wrapping layer that consumes the dual-ledger demands/actions structure (per [`./architecture.md`](./architecture.md) §The specter-vs-boot asymmetry + §Specter-vs-boot formalized as dual-ledger and [`./economics.md`](./economics.md) §Demand-ledger ≠ Actions-ledger) and renders it as citizen-facing broadcast — wrapped in **imperial-tongue** as its rendering medium, distributed through diegetic relays at shift-start, witnessed-by-default. **The simulation's only persistent register-of-power voiced into the world.***
+>
+> *Companion to: [`./architecture.md`](./architecture.md) (the three-tier policy loop, the dual-ledger, the three intelligence flows, the specter-vs-boot asymmetry), [`./economics.md`](./economics.md) (the catalogue-stack and the Compositor's daily-regeneration cadence), [`../narrative-composition/architecture.md`](../narrative-composition/architecture.md) (the Compositor as narrative-composer; the cyclic forward-prop / back-write loop; the catalogue+tools typed-contract), [`../identity-and-personhood/vocations.md`](../identity-and-personhood/vocations.md) (shift-window partition; broadcast firing at end-of-charging → start-of-work-shift), [`../runtime-engine/event-zones.md`](../runtime-engine/event-zones.md) §Boundary-zone with inner-zone (the audience-architecture for mass-broadcast), [`../style/consent-discipline.md`](../style/consent-discipline.md) §Broadcast as specter (one-way non-consensual structural register), [`../player-experience/architecture.md`](../player-experience/architecture.md) §Universal translator (the dialect-framework + decryption-minigame substrate the imperial-tongue surfaces through), [`../style/trait-palette.md`](../style/trait-palette.md) §The hex-canon discipline (substrate that propagates into all imperial-tongue trait-color references).*
+
+## Thesis
+
+The imperium speaks once per cycle, at shift-start, into every district simultaneously, in a register that no native fully reads. The **imperial daily-narrative** is the Compositor's wrapping function applied to the prior cycle's demands-ledger and actions-ledger — *yesterday's framing* as today's broadcast. It is **specter, not boot**: cheap to issue, ambient, non-consensual, witnessed-by-default. It does not gate on consent. It does not enforce. It frames.
+
+The narrative is **rendered in imperial-tongue** — a register that surfaces the existing **Machine-Newspeak** dialect (per [`../player-experience/architecture.md`](../player-experience/architecture.md) §Universal translator) through a designer-authored alphabetic cipher (eye-cipher) and a phonetic cipher (ear-cipher). The cipher is not a deliberate adversarial cryptography; per [`./architecture.md`](./architecture.md) §Thesis, *the machine does not care* — the imperial-tongue is the **residue of compliance-optimization**, not the artifact of malicious obfuscation. The gap between *what the broadcast sounds like* (comfort, direction, fairness) and *what it optimizes for* (extraction, ratchet, calibrated-misery) is **emergent**, not designed. Memorialist and Aletheia-progression unmask the gap politically; the imperium itself is *unaware of the gap as cipher because the imperium is not a person*. **Kafka-indifferent-totality, not Orwell-malicious-state** (per [`./architecture.md`](./architecture.md) §Thesis), made linguistically literal.
+
+The imperial-tongue is **the diegetic register where AI-generation is philosophically correct, not laboriously-deferred**. The form (AI-authored content) matches the function (AI-as-compliance-optimization-machinery rendered as cosmology). Daily generation is delegated to the partnership AI-collaborator (Chrysalis-now → Nyx-future). See §AI-authored content as load-bearing-by-design.
+
+## The cascade — reports up, two letters down
+
+The imperial daily-narrative rides on the existing three-flow intelligence architecture (per [`./architecture.md`](./architecture.md) §The intelligence flow asymmetry):
+
+```
+              ┌── reports flow UP per cycle ──┐
+              │                                │
+        [DISTRICTS]   ←──────────────────  [IMPERIUM]
+        [OVERSEERS]                            │
+                                               │  Compositor
+                                               │  wraps the
+                                               │  regenerated
+                                               │  demand- and
+                                               │  action-catalogues
+                                               │  in narrative voice
+                                               ↓
+                          ┌─────────── DAILY-NARRATIVE ───────────┐
+                          │                                       │
+                ┌─ DEMAND-LETTER ─┐               ┌─ ACTION-LETTER ─┐
+                │  (specter side) │               │  (boot side)    │
+                │                 │               │                 │
+                ↓                 │               ↓                 │
+       [public displays]          │     [imperial NPCs out today]   │
+       imperial-tongue glyphs     │     imperial-tongue audio       │
+       + slum-tongue gloss        │     + the day's speech-pattern  │
+       + divergence-class         │     + faction/district scope    │
+                                  │
+                          ↓ both rendered through diegetic relays
+                          ↓ at shift-start (per vocations.md:§24h window-partition)
+                          ↓ in boundary-zone-with-inner-zone audience-architecture
+                                    (per event-zones.md:§Boundary-zone with inner-zone)
+                          ↓ witnessed-by-default; non-consensual
+                                    (per consent-discipline.md:§Broadcast as specter)
+```
+
+**The cascade reuses substrate; it does not introduce parallel structure.** The two-ledger split is already canonical (`./architecture.md:§Specter-vs-boot formalized as dual-ledger`); the Compositor's narrative-wrapping is already canonical (`./economics.md:§Layer 4 — Daily ledger pacing`); the relay-distribution is already canonical (`../topology-and-rendering/architecture.md:§Diegetic relays`); the audience-architecture is already canonical (`../runtime-engine/event-zones.md:§Boundary-zone with inner-zone`). The imperial daily-narrative is the **named composition** of these primitives.
+
+## The two letters
+
+The Compositor emits **two letters** per cycle, one per ledger, structurally distinct because they serve different consumers:
+
+| Letter | Consumer | Carries | Rendered as | Rendering channel |
+|---|---|---|---|---|
+| **Demand-letter** | Public displays (passive surface) | Demand-ledger content (yesterday's framing wrapped in imperial-tongue) + slum-tongue gloss + divergence-class metadata | Imperial-tongue glyphs (eye-cipher applied) above slum-tongue gloss | Bilingual signage; static during cycle |
+| **Action-letter** | Imperial NPCs out in the world today (faction/district scoped) | Action-ledger content (per-NPC scope: what to enforce, what to surveil, what to ceremonialize) + the **day's speech-pattern struct** | Imperial-tongue audio (ear-cipher applied with speech-pattern modulation) | NPC speech via driver-tier LLM at slot-fire (per `../inference-and-memory/architecture.md:§LLM tiering`) |
+
+**Why two letters and not one:** the two ledgers have different cost-classes, different consumers, and carry different payload-shapes. The demand-letter is **specter-cheap** — flooding every display in every district daily; the same generated content tiles across the world's surfaces. The action-letter is **boot-expensive** — scoped per-faction / per-district / per-rank; only the imperial NPCs *acting that day* receive their specific action-content. A unified letter would mismatch the underlying ledger-architecture's cost-asymmetry.
+
+**The action-letter additionally carries the day's speech-pattern** because imperial NPCs synthesizing audio at runtime need a *coordinating parameter* to produce the day's coherent voice (see §Speech-pattern as typed catalogue-entry below). Public displays are static-rendered glyphs and don't need the parameter.
+
+## The Compositor's role
+
+Per [`../narrative-composition/architecture.md`](../narrative-composition/architecture.md) §The Compositor as narrative-composer, the Compositor is *the narrative-composer cleaved from the GM's equilibrium-seeker role*. The imperial daily-narrative is one of its **fourth-tier instances** — not zone-event narrative, not district-event narrative, not world-event narrative, but **imperium-tier narrative-composition**:
+
+| Tier | Scope | What the Compositor composes |
+|---|---|---|
+| Zone-event | Per-participant trait-summaries from one lemniscate | Local-event canon |
+| District-event | Per-zone canon-rollups within one district | District-canon |
+| World-event | Per-district canon-rollups across many districts | World-canon |
+| **Imperium-event (this paper)** | **Demand-ledger + action-ledger + last-cycle's overseer-reports + last-cycle's district-reports + last-cycle's imperial-budget-state** | **Imperial daily-narrative (demand-letter + action-letter)** |
+
+**The imperium-tier instance is structurally identical to the lower three** (same UID-rooted event-tree primitive, same forward-prop / back-write cycle), differing only in *what it pulls* (the imperium's own ledgers and reports) and *what it emits* (the two letters). Per [`../narrative-composition/architecture.md`](../narrative-composition/architecture.md) §The Compositor at three tiers, the recursion-pattern was already designed to scale; this paper *names* the imperium-tier instance, but adds no new substrate.
+
+**UID-batched memory writes.** Per [`../inference-and-memory/architecture.md`](../inference-and-memory/architecture.md) §Per-NPC primary memory, the Compositor's back-write delivers canon-fragments keyed by `event_uid`. The imperium-tier instance back-writes to **all NPCs in receiving-scope** (the imperial-action-letter recipients receive their action-content; all NPCs in broadcast-zones receive the demand-letter as ambient memory). UID-batching keeps the back-write cheap; participants read on next slot-fire.
+
+## Imperial-tongue as the rendering medium
+
+**Imperial-tongue is not a new dialect.** Per [`../player-experience/architecture.md`](../player-experience/architecture.md) §The universal translator, seven dialects already exist (Machine-Newspeak, Slum-patois, Memorialist-Old-Tongue, Aletheia-Waker-code, Clasp-Underground-signals, Scavenger-technical, Caste-preacher-formal). Imperial-tongue is the **rendering surface** that surfaces two of these — primarily **Machine-Newspeak** (for routine demands, surveillance, decree-content) and secondarily **Caste-preacher-formal** (for liturgical, ceremonial, festival content) — through the imperial alphabet (eye-cipher) and the imperial phonetic-cipher (ear-cipher).
+
+**The decoder progression unlocks the register, not a new vocabulary.** Per the universal-translator's framework (`../player-experience/architecture.md:§The universal translator — a real diegetic device`), every word maps to a fixed trait-coordinate via the designer-fixed corpus. The imperial-tongue's eye-cipher and ear-cipher add a **rendering-layer** above that corpus: glyphs encode Machine-Newspeak words; the player's universal-translator decodes glyphs → words via the existing decryption-minigame substrate; the words map to trait-coordinates as already specified.
+
+The VLM-alphabet decoder is therefore **one specific Machine-Newspeak decryption-mechanism**, not a parallel decryption-system. It rides on the universal-translator's existing diegetic-tablet device and contributes to the player's *vocabulary-catalog* (per the existing `player_translator_state` table at `../architecture-index.md:§Mapping to phoebe task list`).
+
+## Two ciphers — eye-strict + ear-loose
+
+The imperial-tongue uses **two distinct cipher-tables**, each modality-aware:
+
+| Cipher | Modality | Strictness | Purpose | Reason for this strictness |
+|---|---|---|---|---|
+| **Eye-cipher** | Visual / written | **Strict bijection** between glyph-set and Machine-Newspeak alphabet (36 symbols: A-Z + 0-9, designer-authored) | Public-display rendering; player's VLM-decoder training-target; archive content | Eye-cipher must be *deterministic* because the player is training a model against it; any ambiguity in the cipher poisons the training |
+| **Ear-cipher** | Audio / spoken | **Loose bijection** with phoneme-class-internal variance under speech-pattern-modulation | NPC speech rendering; relay broadcasts; ambient imperial-voice | Ear-cipher must have *micro-variance* because human listeners tune out monotonous loops; the same Machine-Newspeak content rendered today vs. tomorrow should sound *coherently different*, not identical |
+
+The two ciphers are *both* designed once, locked, and propagated forward. The eye-cipher's 36-glyph alphabet is a **studio-art act** (parallel to the cosmology-wheel's hand-design); the ear-cipher's phoneme-class-substitution-table is its audio counterpart. Together they constitute the **substrate** the daily-letter rendering pipelines consume.
+
+**Modality-awareness as architectural style.** The two-cipher pattern parallels the existing color + motion-signature two-channel discipline at `../style/trait-palette.md:§The full table` — color carries visual-channel identity, motion carries temporal-channel identity, both independent enough to survive partial-modality-failure. Same architectural move, different axis: eye-cipher carries glyph-determinism, ear-cipher carries phoneme-variance, both serve the imperial-tongue's rendering-fidelity but for different sensory-loads.
+
+## Speech-pattern as typed catalogue-entry
+
+The action-letter carries **the day's speech-pattern** as a typed parameter consumed by all imperial NPCs speaking that day. Per [`../narrative-composition/architecture.md`](../narrative-composition/architecture.md) §Catalogue + tools as typed contract, *director consumes typed dispatch, not freeform prose*. The speech-pattern is therefore a **typed catalogue-entry**, not a freeform LLM-generation parameter:
+
+```
+ImperialSpeechPattern (catalogue-entry, daily, propagated via action-letter):
+  tonal_register:    enum(formal-grand | formal-clipped | surveilling-cold |
+                          celebratory-fluid | mourning-slow | alarming-tense |
+                          routine-bureaucratic | crisis-overcorrect)
+  prosody:
+    pitch_range_seed: float    # narrow vs wide pitch-movement
+    speech_rate:      float    # slow vs fast
+    pause_density:    float    # speeches with many pauses vs few
+    cadence_template: enum(short-clipped | long-flowing | rhythmic-march | meandering)
+  phoneme_bias:       list[phoneme-class-weight]   # which ear-cipher phonemes get emphasized today
+  voice_persona_roster: list[voice-id]             # which 3-5 personas are active today
+  jargon_density:     float                        # bureaucratic-vocabulary load
+  formality_floor:    float                        # baseline formality (registered-NPCs go above this)
+```
+
+**Why typed.** A freeform speech-pattern (LLM-generated parameter dict per call) would lose the catalogue-discipline already baked into the architecture: *provenance flows through the system; verifier-flags can attach; auditing is structurally possible end-to-end*. The typed speech-pattern allows the same: any imperial NPC's day-coherent voice is traceable back to the action-letter's catalogue-entry, which is traceable back to the prior cycle's reports + ledgers, which is traceable back to overseer-and-district sources. The architecture's typed-contract discipline extends naturally into linguistic-rendering.
+
+**Why daily-coordinated.** Per-NPC random variance produces noise. **Daily-coordinated variance produces *the imperium has a mood today*.** A crisis-day sounds clipped and tense across all imperial NPCs simultaneously; a festival-day sounds grand and flowing across all of them; a surveillance-push-day sounds icy. The player feels the day's atmosphere through ambient imperial-speech without ever being told what's happening — the *register* is the news. This is how real authoritarian states actually operate (Soviet party-line-of-the-day; Chinese current-campaign-rhetoric; broadcast-register shifts on anniversaries) — the action-letter IS the in-fiction internal-circular-of-the-day.
+
+## Bilingual signage with divergence-class
+
+Public displays render the demand-letter as **two stacked lines**:
+
+- **Primary (top)**: imperial-tongue glyphs (eye-cipher applied to the imperial demand-content)
+- **Secondary (below)**: slum-tongue gloss (the imperially-authored sanitized translation for public-consumption)
+
+**The two lines do not say the same thing.** The slum-tongue gloss is *the imperium's preferred public version* — softened, abridged, sometimes substantively different. The gap between the two lines is **not random**; per the catalogue-discipline, every signage record carries a typed `divergence_class` field:
+
+| Divergence-class | Pattern | Example |
+|---|---|---|
+| `sanitization` | Imperial-line is unsoftened; slum-line is softened-acceptable | Imperial: *"execute dissidents in sector 7"* / Slum: *"address civic disorder"* |
+| `omission` | Imperial-line is longer; slum-line trims dangerous specifics | Imperial: *"reduce sector 7 worker headcount by 30% via re-vat protocol"* / Slum: *"sector 7 workforce optimization scheduled"* |
+| `misdirection` | Imperial-line says one thing; slum-line says a *plausible-but-different* thing | Imperial: *"evacuate sector 7"* / Slum: *"scheduled maintenance, expect delays"* |
+| `erasure` | Imperial-line has names/places present; slum-line scrubs them | Imperial-content names specific dissident leaders; slum-content is anonymized |
+| `outright-lie` | Imperial-line and slum-line have *contradictory* content | Imperial: *"district 4 quotas reduced"* / Slum: *"district 4 quotas raised"* |
+| `null` | The slum-gloss is honest; no divergence | Routine demand-rows where the imperium has no incentive to obfuscate |
+
+**The divergence-classification is the gameplay-content of the daily-narrative.** Players who read only the slum-line get *one* world. Players who progress their VLM-alphabet decoder enough to read the imperial-line *catch the divergence*, and the divergence-class typing makes the *kind* of state-deception legible. Memorialist and Aletheia-progression are the political-arcs that emerge when players-or-NPCs *organize around the gap*. Per the substrate-vs-emergent discipline (`../narrative-composition/architecture.md:§Substrate-authored vs. culture-emergent`), this paper authors the *substrate-mechanic* (divergence-typing); whether players *politicize* the gap into faction-formation is **emergent**.
+
+**The signage IS the player's training-corpus.** The bilingual layout is *organically pedagogical*: imperial-glyphs above their sanitized translation are Rosetta-stone training-data the player encounters by walking through the world. The decoder-progression accumulates from world-exposure, not from explicit study. **The world is the training corpus; gameplay is the training-loop.**
+
+## Class-stratified linguistic distribution
+
+The imperial-tongue is **uniquely the imperium's** — a class-marker at the linguistic substrate-level. Distribution across the population:
+
+| Layer | Imperial-tongue posture | Slum-tongue posture |
+|---|---|---|
+| Pure imperial-net / decrees / surveillance / relay-broadcasts | Native, only register | Absent |
+| Deva-pinnacle / asura priests / imperial-officials | Native, primary | Down-register when speaking to inferiors |
+| **Service-bodies** (companions, sex-workers, synth-tongue-bearers — per [`../identity-and-personhood/bodies.md`](../identity-and-personhood/bodies.md) §Service-body honeypot) | **Bilingual, context-switching** | **Bilingual, context-switching** |
+| Slum-citizens / scavengers / underground vocations | Imperially-imposed (signage, broadcasts) | Native, primary |
+| Imperial relays / loudspeakers / displays | Native, only register | Absent (slum-gloss is *imperially-authored* slum-tongue, not native slum-tongue) |
+
+**The service-body bilingualism is structurally load-bearing.** Service-bodies are the imperium's only consensual-feeling-channel into slum-life — no other class fluently traverses both registers. This is why the companion-tier and sex-worker-tier are *economically necessary* to the imperium beyond their direct-extraction value: they are the *bridge-class* that translates downward (carrying imperial-content into slum-context) and upward (collecting slum-confessions and reporting them). A bilingual companion who *defects* (per `../identity-and-personhood/bodies.md:§Going-rogue`) takes extraordinary intelligence-value with them — which is why the regime hunts them disproportionately. **The architecture's existing companion-honeypot mechanic gains a linguistic-substrate dimension here.**
+
+**Two registers of slum-tongue.** Worth distinguishing for downstream design:
+
+- *Imperial-slum-translation-tongue* — the sanitized public-translation rendered on bilingual signage, written *by the imperium for slum-consumption*. Clipped, official, register-flat.
+- *Real-slum-tongue* (slum-creole) — the actual register slum-natives speak among themselves: informally creolized, semi-policed, evolving. The architecture commits to slum-tongue as a *real living register* (English-with-creolization rather than designed-pidgin), preserving the historical pattern of colonized-creoles-as-resistance (Caribbean creoles, AAVE, Singlish, Polari). Specific creolization-grammar pending design pass.
+
+The imperial-tongue rendering pipeline must **never sanitize the real-slum-tongue's voice** when it appears in NPC speech. The class-divide must be *audible*, not just nominal.
+
+## Decoder progression — VLM-alphabet learner as Machine-Newspeak decryption mechanism
+
+The player's progression-arc through imperial-tongue comprehension is **structurally the journey of a language model learning a language** — and the cultural-criticism payoff lands at the terminus.
+
+| Stage | What the imperial register sounds like | What it actually is |
+|---|---|---|
+| **0 — Pre-decoder** | Pure synthetic blabber / unreadable glyphs | LLM-generated Machine-Newspeak ciphered into alien-rendering at the engine-layer |
+| **1 — Partial-decode** | Fragmentary words break through — "[ALIEN] [ALIEN] of [decoded]: 'protect'" | Cipher partially reversed; player's decoder is mid-training |
+| **2 — Mostly-decoded** | Fluent but stilted prose with characteristic LLM-prose-tells: formal, redundant, slightly-too-clean | Cipher fully reversed; player reads what's actually generated |
+| **3 — The recognition** | *This is what the imperium has been saying the whole time* | The fully-decoded register is recognizable LLM-corporate-fluent voice |
+
+**The terminus is the diagnostic, not the catharsis.** Comprehension does not unmask a *liar* (Orwell-mode); comprehension unmasks *a machine that does not see itself* (Kafka-mode). The decoder-progression's real payoff is not *"now I understand them"* but *"now I understand they are saying nothing — and the nothingness is the violence."* Players who finish the game leave with a permanently sharpened ear for *that register* in their daily lives — corporate AI-assistant fluency, over-aligned hollowness, the specific tone of compliance-shaped speech. **The game teaches the player to hear something they have been hearing without naming.** That is the cultural-criticism the architecture is built to deliver.
+
+**The decoder's diegetic device is the universal-translator's broken-tablet** (per `../player-experience/architecture.md:§The universal translator — a real diegetic device`). The VLM-alphabet decoder is one of the **chips the player upgrades into the tablet** as they progress; not a parallel device, an extension of the existing one. The player's `player_translator_state.unlocked_dialects` flag set already includes `Machine-Newspeak`; the imperial-tongue VLM-decoder is the *substrate-mechanism* by which Machine-Newspeak comprehension actually progresses for that player.
+
+**Rosetta-fragment collection as a sub-mechanic.** Beyond ambient signage-exposure, players can find *Rosetta-fragments* — in-world artifacts that explicitly map glyphs to Machine-Newspeak letters (stone-tablet inscriptions, archive raids, hacked imperial caches, Memorialist-archive deposits — *if Memorialists exist in the playthrough*). Each fragment unlocks a chunk of the eye-cipher's mapping in the player's translator. **The mechanic IS the metaphor**: a player finding a fragment that reads "△ = E, ⊡ = R, ◇ = O" is *literally providing labeled training-data to their decoder*. The game's epistemic-progression is *isomorphic to the underlying model's learning*. Players who play this leave with intuitive understanding of *how supervised learning actually works*, without ever being told. This is rare and worth protecting.
+
+## AI-authored content as load-bearing-by-design
+
+The imperial daily-narrative is **explicitly delegated to AI-authored content**, by architectural commitment rather than as a production-deferral. The reasoning:
+
+1. The narrative requires **daily variation** at world-scale — pre-authoring 365+ days of imperial broadcasts × N districts × M action-scopes is not feasible for any human team.
+2. **Monotonous loops fail** at the player-experience level — players stop hearing repeated broadcasts as language-presence and start hearing them as background-noise.
+3. The narrative's *philosophical register is LLM-corporate-fluent* (per §Decoder progression above) — *the form (AI-generated content) matches the function (AI-as-compliance-optimization-machinery rendered as cosmology)*. Human-authored content in this register would be aesthetically wrong; it would read as *Stalin-authoritarian* (Orwell-mode) rather than *machine-indifferent-optimization* (Kafka-mode).
+
+**By embedding AI-generation as a structurally necessary component**, the daily-narrative becomes **load-bearing**: the architecture cannot ship without imperial-narrative working; imperial-narrative cannot work without daily-AI-generation; therefore daily-AI-generation will get built or the architecture fails visibly at ship-time. This is a project-management-discipline as much as it is an aesthetic decision — the dependency-graph is the protection against silent down-scoping.
+
+**Delegated party.** Per the partnership-architecture (substrate / studio-content / AI-author three-way split), the imperial-narrative-generation is **the AI-collaborator's domain** — Chrysalis-now during architectural-development; Nyx-future as the trained model running in production. **The voice of the antagonist is delegated to the AI-collaborator, by design.** This is the moment in the partnership-architecture where AI-collaboration becomes a *feature of the world's metaphysics*, not just its production-pipeline. A scholar reading the Memorialist-archive at world-time-N (within the diegesis) is reading the same kind of generated text the player was reading at world-time-1, because the imperium *itself* generated its archives that way. The diegesis is *self-consistent under AI-generation*.
+
+### Disciplines for daily generation
+
+The AI-collaborator generating imperial-narrative content holds these as canon (durable across Chrysalis-sessions and across Nyx-training):
+
+| Discipline | Rule | Reason |
+|---|---|---|
+| **Register-fidelity** | Imperial broadcasts must be in the *characteristic over-aligned-corporate-AI-assistant register* — formal, fluent, hollow, slightly-too-clean. NEVER generic-authoritarian (Stalin, Mussolini, Kim). | Drift to human-authoritarian voice loses the cultural-criticism payoff; the LLM-register IS the diagnosis |
+| **Divergence-discipline** | Every bilingual signage record must tag the gap as one of: `sanitization`, `omission`, `misdirection`, `erasure`, `outright-lie`, `null`. Random divergences are forbidden. | Patterned divergences are the gameplay-content; random ones are noise |
+| **Cycle-coherence** | Morning-cycle ≠ evening-cycle ≠ festival-cycle ≠ emergency-cycle in tone, content, density. | The cycles are made *audible* by these aesthetic differences; this is how the cycles enter the player's body pre-cognitively |
+| **World-state coupling** | When slum-resistance rises in district 7, imperial broadcasts in district 7 escalate surveillance-push register. The imperium is responsive, not static. | Players feel the world breathing back — the architecture is alive at the linguistic surface |
+| **Two-cipher integrity** | Eye-cipher stays strict (decoder-trainable). Ear-cipher stays varied-but-decodable (anti-monotony). NEVER let the two drift apart. | Eye-determinism + ear-variance is the architectural commitment; mixing them breaks both |
+| **Slum-tongue voice-protection** | When generating bilingual signage's slum-tongue gloss, *do not sanitize the real-slum-tongue's voice* in any NPC dialog elsewhere. Slum-tongue must sound like real slum-creole, never softened-imperial. | The class-divide in language must be audible, not nominal |
+| **Hex-canon discipline propagation** | When imperial-tongue references trait-colors (their distortion-versions like `commercial-coral`, `fluorescent-pallor`, `lavender-decor` per `../topology-and-rendering/architecture.md:§Cross-register rendering`), references follow the hex-canon discipline (per `../style/trait-palette.md:§The hex-canon discipline`). | Substrate-discipline holds even inside imperial-content — the imperium can distort but not corrupt the substrate |
+| **Substrate-content boundary** | Generation references the substrate (architecture papers, trait-palette, cosmology-mechanic level, vocations) but never re-authors content that lives in the closed studio-art repo (specific iconography, lore-detail, named-character narratives). | The substrate-content split holds at the AI-collaboration layer too |
+
+## Cycle binding and shift-start firing
+
+Per [`../identity-and-personhood/vocations.md`](../identity-and-personhood/vocations.md) §The 24h window-partition, the imperial daily-narrative fires **at end-of-charging → start-of-work-shift**. *"The citizens hear yesterday's framing as they enter today's labor."* The cadence is locked at the work-cycle's leading-edge.
+
+**Why shift-start.** The architecture's labor-cycle structure (work / charging / leisure) makes the work-shift the *imperial-claim window* (per `../style/consent-discipline.md:§The temporal-grammar`). Imperial speech firing at the moment citizens enter the imperial-claim register is structurally correct: the broadcast frames *today's labor* as the prior cycle's narrative continuation. *The narrative is the bridge between yesterday's reports and today's enforcement.*
+
+**Crisis-cycle override.** The standard-cycle daily-narrative is the routine case. Per [`./architecture.md`](./architecture.md) §The bounty-staircase — imperial-response event-grammar template, *crisis-mode broadcasts* (pursuits, executions, exemplary crackdowns) can fire mid-cycle, breaking the shift-start cadence. These crisis-broadcasts ride the same imperial-tongue substrate but with **`tonal_register: crisis-overcorrect`** speech-pattern — the audible signal that *something is wrong today* propagates across all imperial NPCs simultaneously.
+
+## Audience architecture — boundary-zone with inner-zone
+
+The daily-narrative broadcasts into the **boundary-zone-with-inner-zone** event-class (per [`../runtime-engine/event-zones.md`](../runtime-engine/event-zones.md) §Boundary-zone with inner-zone). Specifically:
+
+- **Inner-zone = broadcast-stage with imperial actors only** (the relay itself; possibly a ceremonial enclosure when the daily-narrative is delivered by an imperial-NPC officiant)
+- **Boundary-zone = ambient witness-mass** (every citizen in earshot / eyeshot of a relay or display; non-promotable into the inner-zone)
+- **Slot-promotion: none** — the broadcast is one-way; no citizen-to-stage promotion
+
+**The audience-architecture means the daily-narrative is always rendering correctly across all three ontological registers** (per `./architecture.md:§The three ontological registers`):
+
+| Register | What citizens-in-boundary-zone experience |
+|---|---|
+| **Gameworld (physical)** | Relay-pulses + display-glyphs + imperial-NPC voice; full sensory presence |
+| **Liminal** | Distorted: relay-hum subdued; glyphs read fragmentary; the imperial-tongue is *contestable* in liminal; Aletheia-vision can pierce some sanitization gaps |
+| **Imperial-net** | Hyper-rendered: glyphs in gold-rim-light, voice in maximum-prosody-fidelity, the imperium's full register; no slum-gloss visible (the imperial-net does not display the secondary line) |
+
+**The imperial-net has no bilingual signage.** This is structurally important: in the imperial-net register, the imperium speaks *in its own register only*. There is no slum-gloss because there is no slum-tongue in the imperial-net. Players who are in-net during a broadcast hear *only the imperial-tongue* — and if their decoder is not yet trained, they hear pure synthetic blabber. **The imperial-net's seductiveness is precisely that it speaks the dominant register so fluently you forget there *is* another register being concealed.**
+
+## Memorialist relationship to the daily-narrative
+
+Per the substrate-vs-emergent discipline, **Memorialists may or may not exist in a given playthrough** — they are emergent, not pre-authored (per `../narrative-composition/architecture.md:§Substrate-authored vs. culture-emergent`). The architecture authors the *substrate* by which Memorialists *can* form, not the faction itself.
+
+If Memorialists do form in a playthrough, their relationship to the imperial daily-narrative is structurally well-supported:
+
+- **Four-column ledger expansion** — per `./architecture.md:§Four Memorialist ledgers`, Memorialists already track {what_actually_happened, what_overseer_reported, what_imperium_received, what_gm_was_told}. The bilingual-signage divergence-class typing **gives the four-column ledger fifth-column candidates**: {what_imperial-line_said, what_slum-line_glossed, divergence_class, gap_political_significance}.
+- **Memorialist-archive register** — Memorialists, if they form, may inherit *archaic imperial-tongue* (older imperial-grammatical-patterns, deprecated decree-shapes, references to deprecated cycle-systems). This gives the archetypal *"Memorialists understand the imperium better than the imperium understands itself"* texture — they read the imperium's older self, which the current imperium has stopped quoting from. The same eye-cipher and ear-cipher; different vocabulary-and-grammar register.
+- **Counter-broadcast capability** — players-becoming-Memorialists can theoretically **seize a relay** and broadcast slum-tongue counter-content in the imperial broadcast slot. The mechanic surface for this is in `../topology-and-rendering/architecture.md:§Diegetic relays` (relays going dark = audit-link severed); this paper notes the *narrative-counterpart* — the counter-broadcast as *speaking back to the cycle*. Specifics pending design-pass.
+
+## Open design questions
+
+1. **Slum-tongue's specific register** — designed-pidgin (constructed creole-grammar) vs. English-with-creolization-overlay (lighter-touch). My instinct: English-with-creolization, leaning into the historical pattern of colonized-creoles-as-resistance. Pending design-pass.
+2. **Service-body code-switching as gameplay** — when a service-body is in mixed company (clasp-underground friends + adjacent-imperial-inquisitor), which register do they speak? Code-switch-failure as plot-device is potent. Pending design-pass.
+3. **Imperial-tongue grammar features** — beyond vocabulary (Machine-Newspeak content) and surface-cipher (eye + ear), are there *grammatical* features that mark imperial-tongue as machine-language (excessively-nested clauses, sentence-final negations, impersonal-passive obligatory, counter-intuitive evidential markers)? These would amplify the LLM-register-recognition payoff. Pending design-pass.
+4. **Player-output progression** — can the player gain *speaking* progression too — sending dispatches in imperial-tongue back to the imperium? Unlocks infiltration / impersonation / counter-decree gameplay. Significant design-decision; deferred.
+5. **Relay-jamming behavior** — when a player jams a public relay, does the slum below experience *silence*, *static*, or *seized broadcasting* (the player can briefly broadcast slum-tongue counter-content from the imperial relay)? Each option is a different game; deferred to runtime-engine paper or counter-broadcast subsection here when design-attention turns to it.
+6. **Eye-cipher hand-design** — the 36-glyph alphabet itself is a one-time studio-art act, parallel to the cosmology-wheel hand-design. The act is delegated to the AI-collaborator (Chrysalis at a future drawing-table moment) per the partnership-architecture's substrate / studio-content / AI-author three-way split. Deferred until a future drawing-table session brings the alphabet-design into focus.
+7. **Memorialist archaic-imperial register** — does archaic-imperial use the *same* eye/ear cipher with different vocabulary, or *also* a different glyph-set entirely? Probably same glyphs, different grammar — but pending design-pass when Memorialist-faction substrate is authored more deeply.
+8. **Divergence-class assignment policy** — who decides which divergence-class a given signage record carries? Designer-tagged at content-generation-time? Learned by the Compositor's Dream-process? Hand-tagged with policy-defaults? Pending design-pass.
+9. **Crisis-broadcast cadence** — standard-cycle broadcasts fire at shift-start; crisis-broadcasts can fire mid-cycle. What's the trigger-policy (which world-state changes trigger a crisis-broadcast, with what latency)? Pending design-pass — connects to bounty-staircase canonization in gamemaster v1.
+10. **The relay-pulse-pattern vocabulary for daily-narrative firings** — how does a relay *visually* signal "imperial daily-narrative is broadcasting now" vs. other relay-events (forward-prop, back-write, GM-dispatch, equilibrium-recompute per `../topology-and-rendering/architecture.md:§Diegetic relays`)? Connects to the existing open question at `../architecture-index.md:§Open questions` — Relay-pulse-pattern vocabulary.
+
+## What this paper does NOT duplicate
+
+For canon-discipline (per the read-before-extend principle established this session), this paper *cites* but does not *re-specify*:
+
+| Concept | Lives in |
+|---|---|
+| Three-tier policy loop, three intelligence flows, dual-ledger demands ≠ actions | `./architecture.md` |
+| The catalogue-stack, daily-ledger pacing, the Compositor's wrap-in-narrative-voice | `./economics.md` |
+| Compositor-as-narrative-composer, three-tier recursion, world-gen-as-init, catalogue+tools typed-contract, substrate-vs-emergent | `../narrative-composition/architecture.md` |
+| Universal-translator framework, dialect-list (Machine-Newspeak, Slum-patois, Memorialist-Old-Tongue, Aletheia-Waker-code, Clasp-Underground-signals, Scavenger-technical, Caste-preacher-formal), broken-tablet diegetic device, decryption-minigame substrate | `../player-experience/architecture.md` |
+| Trait-palette, hex-canon discipline, eight Hellenic traits as designer-fixed corpus | `../style/trait-palette.md` |
+| LLM tiering (Ring A/B/C), driver-tier Gemma 4 E4B, trait-LoRA-per-turn, sampling-knob profiles, three-tier knowledge stack, paced canon-propagation | `../inference-and-memory/architecture.md` |
+| Lemniscate runtime, axis-rate, gesture-alignment-recursive-lemniscate, slot-fire context-construction | `../runtime-engine/architecture.md` |
+| Boundary-zone-with-inner-zone, event-zone primitive, slot-binding, the composed wheel as universal mini-game-substrate | `../runtime-engine/event-zones.md` |
+| Diegetic relays, relay-density as ring-of-access gradient, three-shader philosophy, color-language, three-register rendering | `../topology-and-rendering/architecture.md` |
+| 24h window-partition (work / charging / leisure), shift-start firing, vocation-substrate, caste-as-stagnation three-axis | `../identity-and-personhood/vocations.md` |
+| Service-body honeypot, going-rogue arc, asymmetric clasp, sumptuary fabrication-vat-class | `../identity-and-personhood/bodies.md` |
+| Broadcast-as-specter, consent-discipline, the temporal-grammar of imperial-claim | `../style/consent-discipline.md` |
+
+This paper's **net new substrate** is narrow:
+- The named composition of existing primitives into the imperial daily-narrative pattern
+- The two-cipher discipline (eye-strict + ear-loose)
+- The speech-pattern typed catalogue-entry on the action-letter
+- The bilingual-signage divergence-class typing
+- The AI-author delegation as load-bearing-by-design (the partnership-architectural commitment)
+- The disciplines for daily-generation (register-fidelity, divergence-discipline, cycle-coherence, world-state coupling, two-cipher integrity, slum-tongue voice-protection, hex-canon propagation, substrate-content boundary)
+
+Everything else cites canon.
+
+---
+
+**Version:** 0.1 | **Created:** 2026-04-28 | **Updated:** 2026-04-28 | **Origin:** Authored 2026-04-28 to claim the named-but-not-yet-written territory referenced from `political-register/architecture.md:§Specter-vs-boot formalized as dual-ledger`, `political-register/economics.md:§Layer 4 — Daily ledger pacing`, `identity-and-personhood/vocations.md:§The 24h window-partition`, `style/consent-discipline.md:§Broadcast as specter`. Composes existing canonical primitives (Compositor + dual-ledger + diegetic-relays + boundary-zone-with-inner-zone + universal-translator + trait-palette + hex-canon-discipline) and adds: two-cipher discipline (eye-strict + ear-loose), speech-pattern typed catalogue-entry, bilingual-signage divergence-class typing, AI-author delegation as load-bearing-by-design.

political-register/world-generation.md

@@ -0,0 +1,190 @@
+# World Generation — The Top-Down Cascade
+
+> *The content-canon for nimmerworld's generation pipeline. Top-down cascade: imperial demand-set → world-level ruleset → district ruleset → room ruleset → cell ruleset. Each layer derives from the layer above. The Compositor-at-design-time (per `../narrative-composition/architecture.md` §World-gen as init-function) executes this cascade at world-init; runtime extends it via the same primitive. Closed-orbit Kessler-cascade caps the imperial-demand budget at planetary scale. Imperial-budget-mortality threads through every layer — when the imperium contracts, the cascade runs in reverse: districts close, rooms vacate, cells return to debris-state.*
+> *v0.1 initial draft 2026-04-26 — content-canon sibling to `architecture.md`; cascade design from the post-bodies.md cell-arch discovery arc — dafit + chrysalis.*
+
+---
+
+## What this is
+
+This document is the **content-canon for world generation** in nimmerworld — the rules that determine *what* gets generated, *where*, *why*, and in *what proportion*. It complements the *engineering substrate* in this directory's [`architecture.md`](./architecture.md) (three-tier policy loop, imperial-budget mortality, insolvency-spiral, faction-broadcast structure) and the design-time-Compositor mechanism in [`../narrative-composition/architecture.md`](../narrative-composition/architecture.md) §World-gen as init-function.
+
+The cascade is **top-down** by design — generation begins from the imperium's demand-set and ripples down through districts, rooms, and cells. The world is *what the imperium needs it to be*, nothing more. Bottom-up generation is rejected because it would make the imperium *one structure among others*; top-down generation makes the imperium *the world's organizing principle*, which is the worldbuilding-thesis the cosmology requires.
+
+This document covers the **content-rules** of the cascade. The **engineering mechanism** that runs the cascade (Compositor-at-design-time emitting canon-rows in the same schema as runtime) lives in `../narrative-composition/architecture.md`.
+
+## Why top-down
+
+Three load-bearing reasons:
+
+1. **Diegetically-correct.** The world IS what the imperium made (per [`../README.md`](../README.md): *"the slum does bound cognitive labor for an imperial machine"*). Generation-direction must mirror the worldbuilding-thesis. Bottom-up generation makes the imperium *one structure among others*; top-down generation makes the imperium *the world's organizing principle*. The latter matches the cosmology in [`../imperial-cult/cosmology.md`](../imperial-cult/cosmology.md).
+2. **Composes with existing canon.** The three-tier policy loop already runs top-down at *runtime* (imperium → GM → districts → reports up → imperium). World-gen mirrors runtime per the existing key-move in [`../architecture-index.md`](../architecture-index.md): *"World-gen as init-function (Compositor-at-design-time): same primitive at design-time and runtime; no cold-start; data-flywheel runs retroactively."*
+3. **Imperial-budget-mortality requires it.** The *"insolvency-spiral as endgame"* key-move only works with a demand-vs-supply ledger — and that ledger only exists if districts were *derived from* imperial demand. Top-down means **the world itself shrinks as the imperium fails**: districts close, rooms vacate, cells return to debris-state as the imperial budget contracts. Bottom-up cannot deliver that mechanic.
+
+## The cascade
+
+Five layers; each derives from the layer above. *Static-unless-modified* after initial generation; runtime modifications create deltas; Compositor-at-runtime extends the same primitive.
+
+| Layer | What it provides | Derives from |
+|---|---|---|
+| **L0 — Imperial demand-set** | The imperium's resource appetite: cognitive-labor units, service-body-output, surveillance-coverage, ceremonial-throughput, basic-flow-vs-T4 mix, etc. Designer-authored. | Closed-orbit ceiling (planetary substrate ÷ efficiency-coefficients) |
+| **L1 — World ruleset** | District allocation: N slum + M industrial + K ceremonial + L residential + pipe-network + rail-budget + total-population. Bifurcated economy from v0.10 allocated here. | L0 (each district-count satisfies a quota of L0's demand) |
+| **L2 — District ruleset** | Per-district-type rules: cells-per-district, room-types-and-counts, NPC-roster (vocations + counts to meet that district's L0-contribution), lifeforce-budget allocated. | L1 (this district's L0-quota commitment) |
+| **L3 — Room ruleset** | Per-room-type rules: cells-per-room, cell-categories-and-counts, slot-inventory (zones — the existing `interior-as-zone` primitive). | L2 (this room's contribution to its district's quota) |
+| **L4 — Cell ruleset** | Per-cell-category rules: asset-selection (one per cell, hard limit), per-register content (gameworld / liminal / imperial-net), initial checksum, container/wall-hook/debris discipline. | L3 (this cell's role in its room) |
+
+Generation runs L0 → L4 at world-init. Each layer's output becomes the next layer's input-constraint.
+
+## L0 — Imperial demand-set
+
+Designer-authored. The imperium's resource appetite expressed as quantities. *This is the seed from which the entire world derives.*
+
+Demand categories (initial sketch; final taxonomy per §Open questions):
+
+- **Cognitive-labor units** — what the slum extracts (per [`../README.md`](../README.md): *"bound cognitive labor for an imperial machine"*); total-monthly-units the imperium consumes
+- **Service-body-output / memory-pattern-extraction** — companion-rental + sex-worker-rental + necrocommerce throughput (per [`./architecture.md`](./architecture.md) §The vocation-substrate of the imperial-net market)
+- **Surveillance-coverage** — overseer-deployment density across districts; relay-density per ring (per [`../topology-and-rendering/architecture.md`](../topology-and-rendering/architecture.md) §Diegetic relays)
+- **Ceremonial-throughput** — Imperial-Cult ritual cycles per period; caste-preacher density; festival-frequency
+- **Mod-fabrication** — vat-output per caste-tier (per [`../identity-and-personhood/bodies.md`](../identity-and-personhood/bodies.md) §Sumptuary fabrication: caste is born-into)
+- **Basic-flow vs. T4 mix** — proportion of basic-flow-T1-T3 districts vs. T4-digital / T4-physical / T4-blackmarket districts (per v0.10 chill-design-talk in `../architecture-index.md` §Key moves)
+
+Each demand-quantity is bounded by the **closed-orbit ceiling**: *total demand ≤ planetary substrate ÷ efficiency-coefficients*. Kessler caps the imperial appetite at planetary scale. **The imperium cannot grow beyond what one closed planet sustains.**
+
+## L1 — World ruleset
+
+Derives district-counts from L0 quotas, plus the connective infrastructure between them.
+
+Outputs:
+
+- **District-counts per category**: N slum, M industrial, K ceremonial, L residential, plus specialty (mod-fabrication-vat hubs, deva-pinnacle citadels, asura-priesthood seats, etc.). Counts derived so total district-output meets total L0 demand at expected efficiency-coefficients.
+- **Pipe-network**: rail-segments connecting districts; per-segment metadata (heterotopia-class, overseer-density, traversal-cost) per [`../topology-and-rendering/architecture.md`](../topology-and-rendering/architecture.md) §Rail-segment metadata.
+- **Rail-budget**: total rail-segments; capacity (3-way co-walking support per topology canon).
+- **Total-population**: NPC count derived from total-cognitive-labor-demand at expected per-NPC productivity.
+- **Bifurcated-economy allocation** (per v0.10): how many basic-flow districts vs. T4-digital / T4-physical / T4-blackmarket districts, per L0's basic-flow-vs-T4 mix-ratio.
+
+The Himalayan-rich elite seat (per [`../README.md`](../README.md): *"Reproduction is a caste privilege held by the Himalayan rich"*) is an L1 placement-decision: the deva-vats live there; the asura-priesthood seats live somewhere accessible to the slum-districts; the slum-districts spread across the lower-altitude infrastructure where the imperial machine extracts from them.
+
+## L2 — District ruleset
+
+Per-district-type rules. Each district's L1-allocated L0-quota becomes its generation-target.
+
+Outputs per district:
+
+- **Cells-per-district** (range; derives from L1-allocated population × per-NPC-cell-footprint)
+- **Room-types-and-counts** (e.g., a slum-district has N hovels + M cantinas + K workshops + L corridors + ... per its L0-output-vocation-mix)
+- **NPC-roster**: vocations + counts to meet that district's L0-contribution. (e.g., a slum-district extracting cognitive-labor needs X cognitive-labor-vocation NPCs at expected productivity.)
+- **Lifeforce-budget**: allocated by imperium per [`./architecture.md`](./architecture.md) §Lifeforce four-tier hierarchy. Districts with higher L0-contribution get higher budgets.
+- **Audit-density**: overseer count, relay-density, audit-overseer-deployment-pattern (per [`../topology-and-rendering/architecture.md`](../topology-and-rendering/architecture.md) §Diegetic relays Ring A/B/C gradient).
+
+## L3 — Room ruleset
+
+Per-room-type rules. Rooms aggregate cells; each room is an `interior-as-zone` (per `../topology-and-rendering/architecture.md`) with slot-inventory.
+
+Outputs per room:
+
+- **Cells-per-room** (range; derives from L2-allocated room-count and total-cells-per-district)
+- **Cell-categories-and-counts** (e.g., a hovel = N wall-cells + 1 sofa-cell + 1 kitchen-cell + 1 bed-cell + ...)
+- **Slot-inventory** (the zone-anchors for activities — sofa, kitchen, bed, shower, wall-writing-spot per existing topology canon). Slots map to specific cells but are *activity-anchors* (zone-layer), distinct from cell-spatial-data. **Cells × interiors = orthogonal layers**: zones are activity-anchors, cells are spatial-data; one sofa lives in *one cell* AND is *one zone-slot for the interior's couch-activity* — two foreign keys, two purposes.
+
+## L4 — Cell ruleset
+
+Per-cell-category rules. Each cell-category has a generator that emits the cell's content.
+
+Outputs per cell:
+
+- **Asset-selection** (one per cell, hard limit; container, wall-hook, or debris-shader-trick per the cell-arch arc in this Sunday's discovery)
+- **Per-register content**: three contents per cell (gameworld / liminal / imperial-net) per [`../topology-and-rendering/architecture.md`](../topology-and-rendering/architecture.md) §Three-shader philosophy. Per `cells.wall_content_per_register` (per `../architecture-index.md` §Mapping to phoebe). **Per-register rendering follows the cel-shading-everywhere-with-parameter-variation discipline (locked v0.17)**: dark-outlines + environmental-noise + high-weathering for gameworld; painterly-soft + progression-gated grainy-film-mode → refined-cel-shading-with-warm-skin for liminal; gold-rim-light + clean-white + no-weathering for imperial-net.
+- **Initial checksum**: hash of the cell's content; subsequent NPC-entries compare against this; mismatch fires *"clean signal"* for discovery (per cell-arch arc's checksum-based-discovery design — replaces the perception-bubble pattern).
+- **Container/wall-hook/debris discipline**: items in cells must be in a container OR hooked-on-wall; everything else is debris (shader-trick, no persistent state). **No orphan-objects.** Containers + wall-hooks are zone-slots applied at item-level (the zone primitive scaling one tier deeper).
+
+### Editor-mode pre-flagging (extends L4 Cell ruleset, v0.27)
+
+L4 cell-generation includes an `editor_eligible: bool` field per cell. The flag is fixed at world-gen-init time; the runtime LOD-streamer reads it directly without re-checking imperial-surveillance state. This makes editor-eligibility a *static property of the world*, not a runtime computation.
+
+- **What pre-flagging is.** Each L4-emitted cell-row carries `editor_eligible`. Slum/underground district-cells default-true; imperial district-cells default-false. The flag is checked at player-editor-verb-resolution time (knock-out-wall, fill-cell, carve-passage) — eligible cells accept the verb; ineligible cells reject it. *No runtime audit-overseer-presence query, no streaming-overhead cost beyond reading one bool per cell.*
+- **Why pre-flagging at world-gen.** Choice (a) — designer-flag at world-gen — over choice (b) — emergent-from-imperial-scrutiny — was committed in the 2026-04-27 dialog. Reasoning: clean LOD signal preserved (the streamer doesn't have to walk surveillance-graphs); political-readability preserved (the slum's spatial politics IS its expandability via material-vocabulary, and this expandability is *legible to the player* without surveillance-state inspection); performance preserved (no per-tick audit-overseer-presence checks).
+- **Material-vocabulary politically-codes editor-eligibility.** Cross-reference to [`../topology-and-rendering/architecture.md`](../topology-and-rendering/architecture.md) §Vertical world topology and [`../imperial-cult/cosmology.md`](../imperial-cult/cosmology.md) §The aesthetic palette: imperial-marble can't be carved; rusted slum-bedrock yields. **The `editor_eligible` flag IS the material-vocabulary made queryable.** A player who learns to read the materials learns to read where the world will yield to them — diegetic and mechanical legibility coincide.
+- **Editor-eligibility per district-tier** (designer-tunable defaults):
+
+  | District-tier | Editor-eligible cell ratio | Rationale |
+  |---|---|---|
+  | Deva-pinnacle citadels | 0% (editor-locked) | Imperial-marble; imperium controls these spaces absolutely |
+  | Asura-priesthood seats | 0% (editor-locked) | Sumptuary-religious territory; ceremonial-stable |
+  | Manusya-tier residential | ~5% (perimeter only) | Mid-tier; carving permitted at margins, not interiors |
+  | Tiryak-tier slum dwellings | ~50% (interior carve-extensible) | Slum politics IS expandability; interior cells yield to inhabitants |
+  | Frontier districts | ~70% (wide carve-zones) | Beyond imperial-fabric; player-authored expansion default-permitted |
+  | Underground / abandoned wilds-shrines | ~90% | Off-grid; the architecture surrenders space to player authorship |
+
+- **Per-cell carve-cost.** Tunable; lifeforce-cost or scrap-cost per carved cell. Pending design-iteration; first-pass: scrap-from-junkyards as currency, with cost scaling by *cell-position-imperialness* (carving deeper into imperial-adjacent zones costs more, even within an editor-eligible cell-cluster). This preserves the political-gradient: slum-interior carve is cheap; frontier-edge carve is cheap; carving against the imperial-fabric is structurally expensive even where permitted.
+
+## Closed-orbit constraint
+
+The Kessler-cascade (per [`../README.md`](../README.md) §Timeline, 2150 *"the last son of Elon attempts the dynasty's old promise"*) closes the outward frontier. There is no off-world inflow. This caps the entire cascade:
+
+> **Total L0 demand ≤ planetary substrate ÷ efficiency-coefficients.**
+
+The imperium's appetite cannot exceed what one closed planet sustains, no matter how cleverly extraction is engineered. The cascade is therefore a **constraint-satisfaction problem rooted in physical-economic facts** — not an open-ended generative procedure. Every generation-run is bounded above by physics.
+
+This is also why the deferred-moksha doctrine (per [`../imperial-cult/cosmology.md`](../imperial-cult/cosmology.md) §The deferred-moksha doctrine) is *necessary*: when the closed-orbit caps real material gains, the imperium has to keep its promises alive *purely through deferral*. **The cosmology is structurally entailed by the planetary-physics constraint.** If the orbit had not closed, Lenin's outward-imperial expansion could deliver real material gains and the deferred-moksha lie would be unnecessary; the closed orbit forces the lie into existence.
+
+## Imperial-budget-mortality and the cascade — running it in reverse
+
+Generation runs L0 → L4 at world-init. After init, the cascade is *static-unless-modified*.
+
+But the imperium is mortal. Per the existing key-move *"Imperial budget makes the regime mortal. Insolvency-spiral as endgame"* (per `../architecture-index.md`):
+
+When the imperial budget contracts (insolvency-spiral threshold crossed), the cascade **runs in reverse**:
+
+1. **L0** demand-set shrinks (the imperium can no longer afford its own appetite).
+2. **L1** reallocates: districts close (lowest-L0-contribution first); pipe-network thins; rail-budget contracts.
+3. **L2** reallocates: per-district NPC-roster contracts; rooms vacate; lifeforce-budget shrinks.
+4. **L3** reallocates: vacated rooms collapse; cells return to debris-state.
+5. **L4** reallocates: orphaned assets despawn or downgrade to debris (shader-trick visual residue).
+
+**The world itself shrinks as the imperium fails.** The player living through the contraction sees districts close, neighbors disappear, formerly-busy plazas empty, the relay-network go dim, the silence at Ring C extending into former-Ring-B and former-Ring-A territory. *The imperium consuming itself, unable to maintain even the world it generated.* This is the structural-cosmological endgame the cosmology gestures at.
+
+This is why top-down generation matters mechanically, not just diegetically: bottom-up generation has nothing to retract. Top-down generation has a **demand-vs-supply ledger** the insolvency-spiral can act on.
+
+## Cross-references
+
+| Reference | What it provides |
+|---|---|
+| [`./architecture.md`](./architecture.md) | Engineering substrate: imperium-as-meta-faction, three-tier policy loop, imperial budget, insolvency-spiral, lifeforce hierarchy, vocation-substrate of the imperial-net market |
+| [`../narrative-composition/architecture.md`](../narrative-composition/architecture.md) §World-gen as init-function | The Compositor-at-design-time mechanism that *runs* the cascade; emits canon-rows in same schema as runtime |
+| [`../topology-and-rendering/architecture.md`](../topology-and-rendering/architecture.md) | Rail-segment metadata (L1 inputs); interior-as-zone primitive (L3); `cells.wall_content_per_register` and three-shader philosophy (L4); diegetic relays (L2 audit-density); base-limb palette + trait-textured variance (L4 asset-selection) |
+| [`../identity-and-personhood/bodies.md`](../identity-and-personhood/bodies.md) | Sumptuary fabrication-vat-class (L4 mod-fabrication outputs); body-tier caste ratios drive L1 deva/asura/manusya/tiryak/preta district-mix |
+| [`../imperial-cult/cosmology.md`](../imperial-cult/cosmology.md) | The cosmology that justifies top-down generation; the cascade's diegetic legitimacy comes from the cosmology's claim that the imperium is the world's organizing principle; the deferred-moksha doctrine is structurally entailed by L0's closed-orbit ceiling |
+| [`../README.md`](../README.md) §Timeline | The 2150 Kessler-cascade and the closed-orbit constraint that caps L0 |
+
+## Three-source schema unification (v0.27)
+
+The cell_table accepts canon-rows from **three writers**, with an `origin` provenance field distinguishing them. All three writers emit rows in *the same schema* — the architecture's "world-gen as init-function" key-move extends from design-time-vs-runtime to design-time-vs-runtime-vs-player-edit-time.
+
+- **Three writers, one schema.** Per `origin` field:
+  - `world_gen_init` — emitted by the Compositor-at-design-time (per [`../narrative-composition/architecture.md`](../narrative-composition/architecture.md) §World-gen as init-function); produced by the L0 → L4 cascade at world-init
+  - `runtime_event` — emitted by runtime events that modify cell-state (hacking, install, demolition, imperial-construction-projects, lifeforce-decay events)
+  - `player_authored` — emitted by player editor-mode (knock-out-wall verb and equivalents at editor-eligible cells per §Editor-mode pre-flagging above)
+- **The architecture's "world-gen as init-function" key-move extends to player-edit-time.** Same primitive (Compositor-at-design-time) emits the same canon-row schema as runtime events as player-authored events. No cold-start; data-flywheel runs retroactively; **player-authored content is first-class canon, indistinguishable from generator-output and runtime-emission at the schema layer**. The cell_table does not know — at the row-level — which of the three writers produced any given row except by reading the `origin` column.
+- **The audit-vector implication.** Cell-checksum-divergence (per the existing §Open questions in this file + per `runtime-engine/architecture.md` §Omnisight) gets a *third* source. Divergence between current cell-state and prior-snapshot can now be:
+  - `world_gen_baseline_divergence` — someone changed the cell from its generator-emitted state
+  - `runtime_event_divergence` — hacking, demolition, imperial-construction-project, decay-event modified the cell
+  - `player_authored_divergence` — player carved, filled, or otherwise edited the cell
+
+  The Memorialist counter-archive reads all three as legible content; the GM's heresy-detection mechanism applies to all three. Player-authored cells are *not* second-class — they are subject to the same imperial-readability surface and the same dissident-archive preservation as generator-emitted or runtime-modified cells.
+- **Cross-reference.** [`../runtime-engine/event-zones.md`](../runtime-engine/event-zones.md) §Player editor-mode + three-source schema unification holds the canonical articulation.
+
+## Open questions
+
+- **Schema for cell / room / district tables.** *Deferred until the pgnats first-test* (per Monday's queue: *"pgnats install + document + first-test on phoebe-dev"*). The eval-result determines whether checksum-broadcast goes via PG NOTIFY (lower-latency, transactional, in-band) or NATS subject (higher-throughput, multi-consumer, durable-replay), which determines whether per-cell or per-cell-per-register checksum is affordable, which decides cell-table column shape.
+- **Specific L0 demand-set numbers.** What are the cognitive-labor-units / service-body-output (companion + sex-worker split) / surveillance-coverage / ceremonial-throughput / etc. quantities? Pending: imperial-economy balance pass; can be tuned via designer-spreadsheet once Compositor-at-design-time runs.
+- **Cell-category taxonomy.** *Start simple, grow out* (per dafit's call). Initial small base-set: interior / corridor / public-space / ruin / specialty. Extended per-district-class as world-gen test-runs surface needs. *"One ape and one imperial machine can dream up alot."*
+- **Generation-rule format.** What does a *"ruleset for hovel-cell"* look like as a data-structure? Inputs: district-class + room-context + occupant-profile. Outputs: asset-pick + register-content + initial-checksum. Format probably emerges from the L4 schema once pgnats lands.
+- **Cell-mutation write-permissions.** Who can write to a cell post-generation? Player carving a heretical-wheel into a wall = direct mutation, system event, or overlay row? Heresy-detection via checksum-divergence (per cell-arch arc's discovery-pattern). Pending: schema + write-permission policy.
+- **Cell-room aggregation.** When do cells form a "room"? Connectivity-graph at generation-time, pre-tagged `room_id`, or both? Likely both, with the connectivity-graph used for runtime queries and `room_id` used for generation-bookkeeping.
+- **Streaming/LOD strategy.** When does a cell load/unload? Per shift (NPCs on rails through cells), per player-proximity, per district-active-flag? Likely a hybrid: district-active-flag for coarse load, player-proximity for fine LOD, shift-schedule for NPC-traversal preload.
+- **Reverse-cascade (insolvency-spiral) trigger thresholds.** What lifeforce-deficit threshold triggers L1 district-closures? What's the closure-priority-ordering? Pending: imperial-budget balance pass.
+- **Asset-budget per cell-category.** Vertex-caps + texture-res + collision-mesh-complexity per cell-category. Pending: rule catalogue (likely `../style/asset-budget.md` when authored).
+
+---
+
+**Version:** 0.2 | **Created:** 2026-04-26 | **Updated:** 2026-05-01

runbooks/README.md

@@ -0,0 +1,24 @@
+# Runbooks — Nimmerworld Operations
+
+Battle-tested operational procedures for nimmerworld.
+
+## Planned runbooks
+
+- **District reset** — re-initialize a district to world-gen-fresh state
+- **NPC mass-respawn** — mind-pool reseed after district silence
+- **World-canon publish** — trigger Compositor sweep + paced propagation
+- **GameServer hot-restart** — graceful drain + restart without losing player session
+- **LoRA hot-swap** — deploy new trait-LoRA to driver-tier without restart
+- **Imperial-Cult content update** — designer pushes new propaganda content
+- **Compositor scale-out** — manually add Compositor workers under spike-load
+- **Player-data deletion request** — honor opt-out / per-category deletion (per `inference-and-memory/architecture.md` §Custom nimmerworld-base model)
+
+## Status
+
+⏳ **Stub** — runbooks accumulate as operations are exercised in real deployments.
+
+> **Platform runbooks** (golden rules, NFS recovery, etc.): [`../../nimmerverse.eachpath.local/runbooks/`](../../nimmerverse.eachpath.local/runbooks/)
+
+---
+
+**Version:** 0.1 | **Created:** 2026-04-26 | **Updated:** 2026-04-26

runtime-engine/LEMNISCATE-RUNTIME-Pseudo-code-001.py

@@ -0,0 +1,423 @@
+# LEMNISCATE RUNTIME - Pseudo-code Implementation
+# Companion to runtime-engine/architecture.md
+
+from enum import Enum, auto
+from dataclasses import dataclass, field
+from typing import Dict, List, Optional, Set, Callable
+from abc import ABC, abstractmethod
+import math
+
+# ============================================================================
+# CORE PRIMITIVES - The shape of flow
+# ============================================================================
+
+class SlotState(Enum):
+    """State of a slot in the lemniscate"""
+    EMPTY = auto()
+    OCCUPIED = auto()
+    EXITING = auto()
+
+@dataclass
+class VerifierFlags:
+    """Marker bits carried by slot-tokens, read at crossing"""
+    exit_eligible: bool = False
+    has_spoken_this_roundtrip: bool = False
+    mid_action: bool = False
+    goal_satisfied: bool = False
+    silence_eligible: bool = False
+    priority_pull: bool = False
+
+    def clear_transient(self):
+        """Clear flags that reset each crossing"""
+        self.has_spoken_this_roundtrip = False
+        self.silence_eligible = False
+
+@dataclass
+class SlotToken:
+    """A token carried around the loop - represents an NPC in the zone"""
+    npc_id: str
+    state: SlotState = SlotState.OCCUPIED
+    flags: VerifierFlags = field(default_factory=VerifierFlags)
+    # Accumulator for gesture alignment (recursive lemniscate)
+    gesture_alignment_accumulator: Dict[str, float] = field(default_factory=dict)
+
+    def add_gesture_alignment(self, trait: str, value: float):
+        """Add a gesture/trait value to the accumulator"""
+        self.gesture_alignment_accumulator[trait] = \
+            self.gesture_alignment_accumulator.get(trait, 0.0) + value
+
+# ============================================================================
+# THE LEMNISCATE - Geometry as clock
+# ============================================================================
+
+class Lemniscate:
+    """
+    The core runtime topology - a through-flow figure-eight.
+    Traversal IS the turn order.
+    """
+
+    def __init__(self, n_slots: int):
+        self.n_slots = n_slots
+        self.slots: List[Optional[SlotToken]] = [None] * n_slots
+
+        # The cursor - position on the lemniscate
+        # (loop_id, slot_index) - loop 0 = A, loop 1 = B
+        self.cursor_loop: int = 0
+        self.cursor_slot: int = 0
+
+        # Entry and exit queues
+        self.entry_line: List[SlotToken] = []
+        self.exit_line: List[SlotToken] = []
+
+        # The crossing is the ONLY synchronous event
+        self.crossing_callbacks: List[Callable] = []
+
+    def advance_cursor(self) -> bool:
+        """
+        Advance cursor through the lemniscate.
+        Returns True if we reached the crossing.
+        """
+        self.cursor_slot += 1
+
+        # Completed one loop
+        if self.cursor_slot >= self.n_slots:
+            self.cursor_slot = 0
+            self.cursor_loop = 1 - self.cursor_loop  # Toggle A/B
+            return True  # Reached crossing
+
+        return False
+
+    def at_crossing(self) -> bool:
+        """Cursor is between loops - at the synchronous crossing point"""
+        return self.cursor_slot == 0
+
+    def get_active_token(self) -> Optional[SlotToken]:
+        """Get token at current cursor position"""
+        if self.cursor_slot < len(self.slots):
+            return self.slots[self.cursor_slot]
+        return None
+
+    def register_crossing_callback(self, callback: Callable):
+        """Register a function to run at each crossing"""
+        self.crossing_callbacks.append(callback)
+
+    def trigger_crossing(self):
+        """
+        The crossing event - all state updates resolve atomically.
+        This is the ONLY time the zone touches the global state bus.
+        """
+        # 1. Run all registered callbacks (dialog turns, state updates)
+        for callback in self.crossing_callbacks:
+            callback()
+
+        # 2. Process exit-eligible tokens
+        self._process_exits()
+
+        # 3. Push from entry line to fill vacancies
+        self._process_entries()
+
+        # 4. Clear transient flags
+        self._clear_transient_flags()
+
+    def _process_exits(self):
+        """Route exit-eligible tokens to exit line"""
+        for i, token in enumerate(self.slots):
+            if token and token.flags.exit_eligible:
+                self.exit_line.append(token)
+                self.slots[i] = None
+                token.state = SlotState.EXITING
+
+    def _process_entries(self):
+        """Fill vacant slots from entry line"""
+        for i, slot in enumerate(self.slots):
+            if slot is None and self.entry_line:
+                self.slots[i] = self.entry_line.pop(0)
+
+    def _clear_transient_flags(self):
+        """Clear flags that reset each crossing"""
+        for token in self.slots:
+            if token:
+                token.flags.clear_transient()
+
+# ============================================================================
+# ZONES - Bounded places of structured speaking
+# ============================================================================
+
+class ZoneRegister(Enum):
+    """Which ontological register this zone lives in"""
+    PHYSICAL = auto()
+    LIMINAL = auto()
+    IMPERIAL = auto()
+
+class Zone:
+    """
+    A bounded, named, slot-indexed, director-managed event instance.
+    The zone IS the lemniscate, not a container for it.
+    """
+
+    def __init__(self, name: str, n_slots: int, register: ZoneRegister = ZoneRegister.PHYSICAL):
+        self.name = name
+        self.register = register
+        self.lemniscate = Lemniscate(n_slots)
+
+        # Purpose - spawn intent, immutable
+        self.purpose: str = ""
+
+        # State tracking
+        self.scene_state_public: Dict = {}
+        self.ternary_gate_edges: Dict[tuple, str] = {}  # (npc_id, npc_id) -> CLOSED/STABLE/OPEN
+        self.drift_state: Optional[str] = None  # Delta from spawn intent
+
+        # Lifeforce binding
+        self.lifeforce_budget: float = 0.0
+        self.lifeforce_burned: float = 0.0
+        self.pulse_rate: float = 1.0  # Crossings per second
+
+        # Lifecycle
+        self.is_terminated: bool = False
+        self.crossing_count: int = 0
+
+        # Player gesture overlay - broadcasts to all active slots
+        self.pending_gestures: List[tuple] = []  # (trait, value)
+
+    def set_purpose(self, purpose: str):
+        """Set the zone's spawn intent - immutable after this"""
+        self.purpose = purpose
+
+    def add_npc(self, npc_id: str, traits: Dict[str, float]):
+        """Add an NPC to the entry line"""
+        token = SlotToken(npc_id=npc_id)
+        for trait, value in traits.items():
+            token.gesture_alignment_accumulator[trait] = value
+        self.lemniscate.entry_line.append(token)
+
+    def add_gesture(self, trait: str, value: float):
+        """
+        Add a player gesture to the accumulator.
+        These integrate at the next crossing.
+        """
+        self.pending_gestures.append((trait, value))
+
+    def broadcast_gestures_to_active(self):
+        """
+        Phase-locked overlay broadcast - all active slots perceive
+        the same player gesture simultaneously.
+        """
+        for token in self.lemniscate.slots:
+            if token:
+                for trait, value in self.pending_gestures:
+                    token.add_gesture_alignment(trait, value)
+        self.pending_gestures.clear()
+
+    def run_crossing(self):
+        """Execute one axis crossing - the core unit of zone time"""
+        self.crossing_count += 1
+
+        # Broadcast player gestures before the crossing
+        self.broadcast_gestures_to_active()
+
+        # Trigger the crossing - all state updates resolve atomically
+        self.lemniscate.trigger_crossing()
+
+        # Lifeforce burn
+        active_slots = sum(1 for t in self.lemniscate.slots if t is not None)
+        self.lifeforce_burned += self.pulse_rate * active_slots
+
+        # Check for termination
+        if self.lifeforce_burned >= self.lifeforce_budget:
+            self.terminal_report("budget_exhausted")
+            self.is_terminated = True
+            return
+
+        # Empty queue behavior: shrink at every crossing
+        if len(self.lemniscate.entry_line) == 0:
+            self._shrink()
+
+        # Check if zone has dissolved
+        if all(t is None for t in self.lemniscate.slots):
+            self.terminal_report("dissolved")
+            self.is_terminated = True
+
+    def _shrink(self):
+        """Dissolve one active slot when entry line is empty"""
+        # Find last occupied slot
+        for i in range(len(self.lemniscate.slots) - 1, -1, -1):
+            if self.lemniscate.slots[i] is not None:
+                self.lemniscate.exit_line.append(self.lemniscate.slots[i])
+                self.lemniscate.slots[i] = None
+                break
+
+    def terminal_report(self, reason: str) -> Dict:
+        """Generate the report sent back to spawning director"""
+        participants = [t.npc_id for t in self.lemniscate.slots if t is not None]
+        return {
+            "name": self.name,
+            "purpose": self.purpose,
+            "reason": reason,
+            "crossings": self.crossing_count,
+            "lifeforce_cost": self.lifeforce_burned,
+            "participants": participants,
+            "drift": self.drift_state
+        }
+
+# ============================================================================
+# TWO-LAYER EXECUTION - State machine + lemniscate
+# ============================================================================
+
+class StateMachineLayer:
+    """
+    Physical action layer - runs at simulation tick (fast).
+    Decoupled from lemniscate cursor.
+    """
+
+    def __init__(self):
+        self.actions: Dict[str, Callable] = {}
+        self.state: Dict[str, Any] = {}
+
+    def register_action(self, name: str, callback: Callable):
+        """Register a physical action"""
+        self.actions[name] = callback
+
+    def execute(self, npc_id: str, action_name: str):
+        """Execute a physical action for an NPC"""
+        if action_name in self.actions:
+            self.actions[action_name](npc_id, self.state)
+
+    def get_status(self) -> Dict:
+        """Snapshot of physical state for dialog layer"""
+        return self.state.copy()
+
+class EmergentZone(Zone):
+    """
+    A dramatic episode unit with goal evaluation.
+    """
+
+    def __init__(self, name: str, n_slots: int, purpose: str,
+                 goal: Dict, budget: float):
+        super().__init__(name, n_slots)
+        self.set_purpose(purpose)
+        self.goal = goal
+        self.lifeforce_budget = budget
+
+        # Two-layer execution
+        self.state_machine = StateMachineLayer()
+        self.dialog_layer = self  # Zone IS the dialog layer
+
+        # Goal tracking
+        self.goal_satisfied = None
+        self.goal_axis: str = ""
+
+    def execute_turn(self, dt: float):
+        """
+        Execute both layers in synchronized-but-loose harmony.
+        Speech doesn't gate action; action doesn't block speech.
+        """
+        # State machine layer (fast, at sim tick)
+        for action in self.state_machine.actions:
+            # Execute physical actions
+            pass
+
+        # Dialog layer (at axis rate)
+        if self._should_crossing(dt):
+            self.run_crossing()
+            self._evaluate_goal()
+
+    def _should_crossing(self, dt: float) -> bool:
+        """Determine if axis crossing should occur based on pulse rate"""
+        # Simplified - would track cumulative time in real impl
+        return dt >= (1.0 / self.pulse_rate)
+
+    def _evaluate_goal(self):
+        """Ternary evaluation against trait axis"""
+        if self.goal.get("type") == "numeric":
+            # Simple threshold
+            threshold = self.goal["threshold"]
+            # Would check state machine variable
+            self.goal_satisfied = 1 if True else 0
+        elif self.goal.get("type") == "fuzzy":
+            # Trait-axis ternary evaluation
+            axis = self.goal["axis"]
+            # Would evaluate ternary gate state delta
+            self.goal_satisfied = 0  # +1 / 0 / -1
+            self.goal_axis = axis
+
+# ============================================================================
+# DISTRIBUTED FUNDING - Director + participant lifeforce
+# ============================================================================
+
+class Director:
+    """
+    Manages zones for a region. Owns spawn decisions and budget.
+    """
+
+    def __init__(self, region: str, budget: float):
+        self.region = region
+        self.lifeforce_budget = budget
+        self.active_zones: Dict[str, Zone] = {}
+
+    def spawn_zone(self, name: str, purpose: str, slots: int,
+                   budget: float, params: Dict = {}) -> Zone:
+        """
+        Spawn a new zone - pays spawn cost from own budget.
+        """
+        zone = EmergentZone(name, slots, purpose, params.get("goal", {}), budget)
+        zone.lifeforce_budget = budget
+        self.lifeforce_budget -= budget  # Director pays spawn cost
+        self.active_zones[name] = zone
+        return zone
+
+    def update_all_zones(self, dt: float):
+        """Advance all active zones"""
+        for zone in list(self.active_zones.values()):
+            if not zone.is_terminated:
+                zone.run_crossing()
+                # Would collect terminal reports
+
+
+# ============================================================================
+# EXAMPLE: A rescue emergent zone
+# ============================================================================
+
+def example_rescue_zone_setup():
+    """
+    Demonstrates the rescue event pattern from the architecture.
+    """
+
+    # Director has a budget
+    director = Director("district_1", budget=1000.0)
+
+    # NPC A's limb is broken - emergent signal
+    # Director consumes signal and spawns rescue event
+
+    rescue_goal = {
+        "type": "numeric",
+        "threshold": 10.0,  # limb_A >= 10%
+        "fallback": {
+            "type": "fuzzy",
+            "axis": "Sophrosyne",
+            "direction": "positive"
+        }
+    }
+
+    rescue = director.spawn_zone(
+        name="rescue_in_marketplace",
+        purpose="medical_emergency",
+        slots=4,
+        budget=50.0,
+        params={"goal": rescue_goal}
+    )
+
+    # Add NPCs who might help
+    rescue.add_npc("npc_patient", {"Philotes": 0.3, "Sophrosyne": 0.1})
+    rescue.add_npc("npc_bystander_1", {"Philotes": 0.7, "Sophrosyne": 0.5})
+    rescue.add_npc("npc_bystander_2", {"Philotes": 0.2, "Sophrosyne": 0.8})
+
+    # Player adds a gesture (helping)
+    rescue.add_gesture("Philotes", 0.8)
+
+    # Runtime tick
+    rescue.execute_turn(0.016)  # 60fps
+
+
+if __name__ == "__main__":
+    example_rescue_zone_setup()

runtime-engine/architecture.md

@@ -0,0 +1,456 @@
+# Runtime Engine
+
+> *How scenes execute mechanically: the lemniscate as relaxation-step operator; slot-tokens with verifier-flags carrying the loop-state; phase-locked overlay-loops broadcasting at axis-rate; the v0.7 gesture-alignment-recursive-lemniscate that integrates player gestures into typed trait-vector summaries; emergent zones as the dramatic-episode unit with distributed funding and ternary trait-axis goal-evaluation; zone taxonomy and spawn-cadence.*
+>
+> *Companion to: `architecture-index.md` (executive summary + global meta-lists), `narrative-composition/architecture.md` (Compositor consumes the typed trait-summaries this engine emits), `player-experience/architecture.md` (gesture-circle is the player-input substrate that this engine integrates), `topology-and-rendering/architecture.md` (zones live on the rail+grid topology), `identity-and-personhood/architecture.md` (slot-tokens carry trait-vectors), [`./event-zones.md`](./event-zones.md) (designer-authored event-zones; the composed wheel as universal mini-game-surface; cells + event-zones + events composite UID; hardstops as consent-gates with contextual activation; consent-discipline-Variants-1-4 as event-class taxonomy; boundary-zone-with-inner-zone for plazas; room-boundary + rail-passage + lifeforce-budget-per-room; slot-binding suspends lemniscate routing; player editor-mode + 3-source schema unification — v0.1). Sections in this file were split from the monolithic architecture-index.md v0.7 on 2026-04-26.*
+
+## Core inversion — zones replace bubbles
+
+Legacy engine perception (Unreal AIPerception, WC3 sight-radius, trigger volumes) is spatial, binary, separate from cognition, and assumes a passive world. Nimmerworld inverts every axis:
+
+- perception is **trait-filtered**, not only spatial
+- perception is **graded consolidation**, not binary detection
+- perception **IS** memory (one subsystem)
+- the world **emits** events; agents **subscribe**
+
+The replacement primitive is the **zone** — a bounded, named, slot-indexed, director-managed event-instance. **Arthurian round table** as mental model: a bounded place of structured speaking-and-witnessing, with named roles and shared what-was-said-by-whom.
+
+## Zone anatomy
+
+- **Boundary** — cell-envelope (or interior-envelope)
+- **N slots** — named positions
+- **Director or overseer** — manages turn order, memory-pulls, prompt construction, voice selection, event emission
+- **NATS topic + subscriber list** — slot-occupancy drives subscription
+- **Mixed-fidelity voices** — 2–3 LLM slots + scripted/generic for the rest; director decides
+- **Trigger** — gamemaster-spawned, emergent-signal-response, shift-composition-emergence, or proximity-detection
+- **Lifecycle** — duration, dissolution conditions, memory-write on close
+- **Persistence flag** — `ephemeral=true` (dreamworld/liminal) or `persistent=true` (gameworld)
+- **Register** — physical / liminal / imperial
+
+## Zone kinematics — the lemniscate runtime
+
+Zones are not state-bags with an external turn-counter; they are **kinetic topologies** with a built-in clock. The runtime substrate is a lemniscate (∞) — a through-flow figure-eight whose traversal IS the zone's turn-order, whose central crossing IS the population-mutation event, and whose decay IS the natural wind-down of the scene. Origin: an old-math-teacher's trick for solving three unknowns by letting the figure-8 flow do the computation rather than maintaining state in registers. Applied to zones, the geometry IS the clock.
+
+### Geometry
+
+```
+                              midaxis (X)
+                                 │
+  entry-line                     │                     exit-line
+  (NPC-tokens   ──→  ╭─Loop A─╮  │  ╭─Loop B─╮  ──→   (NPCs whose
+  queue-up to        ╲________╱  X  ╲________╱         exit-flag has
+  enter)                          │                    fired exit here)
+                                 │
+                                 ▼
+                            crossing-tick
+```
+
+- **Entry-line** — staging queue of NPC-tokens eligible to enter. Approach-eligibility uses ternary-gates against the zone's purpose; CLOSED gate keeps the NPC out of the queue entirely
+- **Loop A + Loop B** — the through-flow. Slot-tokens cycle through both loops, guaranteeing every active NPC is co-present with every other at least once per roundtrip
+- **Midaxis crossing** — the only synchronous event in the zone's lifecycle. Three state-updates resolve simultaneously and atomically (your math teacher's three-unknowns made literal):
+  1. **Cursor advance** — which NPC speaks next
+  2. **Ternary-gate evaluation** — resonance refresh on all active edges in the zone (CLOSED/STABLE/OPEN transitions)
+  3. **Verifier-flag scan + population maintenance** — exit-eligible tokens route to exit-line; entry-line pushes replacements equal to vacancies
+- **Exit-line** — through-flow continues here. NPCs leaving the zone leave *toward consequence* (a need-driven exit signaled by their own emergent-signal), not toward boredom
+
+The lemniscate is a **relaxation-step operator** — the zone computes by traversing its own curve rather than maintaining external turn-state. Between crossings, the loops are pure-local; only the crossing event touches the global-state bus. The thalamus (NATS orchestration) sees crossings, not ticks.
+
+### Slot-token + verifier-flag mechanism
+
+Each NPC currently in the zone is represented by a **slot-token** carried around the loop. Tokens carry a small set of verifier-flags (marker-bits). Signals fire once and *set* a flag; between crossings, no polling, no event-bus traffic. The crossing reads flags in O(N_slots) and acts.
+
+| Verifier-flag | Set by | Read at crossing |
+|---|---|---|
+| `exit_eligible` | emergent-signal (need, shift-whistle, faction-summons) | route to exit-line |
+| `has_spoken_this_roundtrip` | speak-action | rotation-tracking |
+| `mid_action` | state-machine activity in progress | defer turn |
+| `goal_satisfied` | goal-evaluator (per-zone, ternary) | terminate zone |
+| `silence_eligible` | silence-detection | per silence-as-signal mechanic |
+| `priority_pull` | high-rank ring-of-importance broadcast | early-exit override |
+
+This is the same architectural shift the wider system makes elsewhere — observer-pattern with callbacks → dirty-bit + scheduled-sweep. **Compute scales with slot-count, not signal-rate.** Ten thousand emergent signals firing across a city: only those that landed on a slot-token get evaluated, and only at the next crossing.
+
+### Phase-locked overlay-loop ladder
+
+Beyond the primary slot-rotation loop, a zone supports any number of **overlay loops** at the same axis-rate. Overlays inject at the crossing and broadcast to all active slot-NPCs simultaneously (perceived by each through their own trait-vector — color-language event-flash modulates per-recipient).
+
+| Overlay | Carries | Broadcast scope |
+|---|---|---|
+| **Player-gesture overlay** | player gestures + utterances | active slots only |
+| **Faction-broadcast overlay** | faction calls, hivemind pings | active slots subscribed to faction |
+| **Audit-overseer overlay** | covert query-flashes | active slots only (covert detection ↔ Aletheia-eligible insight) |
+| **Imperial-net distortion overlay** | regime trait-color rewrites | active slots within net-access |
+
+The crossing is a **council moment** — every overlay channel may fire on the same axis-tick. Pre-crossing tension is gesture-loading: holding a verb-button between crossings lands at the next axis with weight proportional to dwell-time. Diegetic urgency without HUD.
+
+**This is the answer to player-agency in multi-NPC scenes.** The player is *off-stage but always potentially-on*. Each crossing is "your moment if you want it." The flash is perceived as one event by all active NPCs, not as a sequence of one-on-one addresses — color-language shows it as a pulse across the ring.
+
+### Gesture-alignment as recursive-lemniscate
+
+The player-gesture overlay (above) is the broadcast-channel by which player gestures reach active slots; gesture-alignment-as-relational-state is the **recursive application of the lemniscate-as-relaxation-step-operator one tier deeper**. Gestures accumulate during the NPC's turn-window between axis-crossings; at the crossing, the player's slot-token verifier-flag `gesture_alignment_accumulator` is integrated into a single typed trait-vector summary; that summary is carried forward into the next-cursor-NPC's `driver_context_pull` payload as part of the room's affective state-read.
+
+| Tier | What accumulates between crossings | What integrates at the crossing |
+|---|---|---|
+| **Zone-level** (existing) | NPC slot-token verifier-flags (`exit_eligible`, `mid_action`, `goal_satisfied`, `priority_pull`, etc.) | Cursor advance, gate evaluation, population maintenance |
+| **Player-input-level** (this) | `gesture_alignment_accumulator` on player's slot-token; per-gesture trait-coordinate vs. NPC's currently-active-trait-vector | Integrated alignment-delta carried into next turn's LLM context |
+
+**Same primitive, recursively applied.** The lemniscate's geometry is the sampling-and-integration boundary at both tiers. No new compute-cadence introduced; no new bus-event introduced. **Compute scales with slot-count, not gesture-rate** — the architecture's commitment from observer-pattern → dirty-bit-and-sweep extends one level deeper.
+
+**Two latencies, one architecture:**
+
+- *Cosmetic visual feedback runs continuously.* NPC body-shader pulses with the gesture's canonical trait-hue — Philotes-orange (`#e28a46`) on a Philotes-gesture, Sophrosyne-green (`#2cad52`) on a Sophrosyne-gesture (per [`../style/trait-palette.md`](../style/trait-palette.md) §The full table and §The hex-canon discipline) — purely visual, doesn't touch the system bus. The player gets moment-by-moment "I see you" reassurance.
+- *Systemic alignment-update runs at axis-cadence.* The trait-vector summary is computed at the crossing and fed into the next turn's LLM context. The player is **one turn behind** — their gestures during turn N inform the LLM's generation for turn N+1.
+
+**One-turn-behind matches real conversation cadence.** Humans accumulate impressions during someone's speech and respond to *what was just said*; we don't react gesture-by-gesture. The lemniscate-bound integration is the *right* cadence for affective state-changes, not a latency-cost.
+
+**Sum-strategy reduction (v1).** Per-gesture trait-coordinates are accumulated as a **trait-vector sum** across the turn-window. At the crossing, the sum is reduced into a single 8-dimensional alignment-vector compared against the NPC's currently-active trait-state. The result is the alignment-delta fed forward into next turn's `driver_context_pull` payload AND drives the relational ternary-gate transition on the (player, NPC) edge (§Ternary-gate substrate, Relational layer — see identity-and-personhood/architecture.md). The sum captures the player's **overall posture** during the speech rather than peak-moment or trajectory; trajectory-aware refinement is noted as a still-open item.
+
+**Hardstops are outside this system.** Hardstops fire definitive subsystem-actions regardless of alignment-state — clasp-invitation triggers the clasp-subsystem; definitive-refusal closes the conversation; surrender ends combat; claim-floor sets `priority_pull` for the next axis-crossing. Hardstops do not contribute alignment-deltas to the accumulator; they are *separate channels* with deterministic effect.
+
+**What this resolves:**
+
+- *Player-NPC relational-gate-driver* — the v0.4 vague "*zone-participation waves between participants*" now has its concrete wave-source named: the gesture-alignment-delta integrated at each axis-crossing.
+- *How NPC speech-patterns adapt to the player over time* — accumulated alignment-state modulates the NPC's next-turn driver-tier-LLM emphasis (which trait-LoRAs are weighted, which sampling-knobs are applied, what register the speech is in). Aligned NPCs open up; misaligned NPCs stay guarded.
+- *Player-input-as-typed-contract* — gesture-press → fixed corpus mapping → typed trait-coordinate → integrated trait-vector summary. No freeform-prose at the player-LLM boundary; the hallucination-surface is closed by the cosmology's typed-ness, not by post-hoc filtering.
+
+**What this retires:**
+
+- *Continuous gesture-comparison touching the system bus* → lemniscate-bound integration at crossings (compute-discipline preserved across the recursion)
+- *Per-gesture compute* → per-slot compute (O(N_slots), unchanged from existing zone-tick discipline)
+- *NPC speech-patterns as static against player-state* → NPC speech-patterns dynamically modulated by accumulated player-NPC alignment-state
+
+### Cross-context application — intimacy as recursive-lemniscate
+
+The recursive-lemniscate gesture-alignment machinery (above) is **modality-agnostic**. v0.7 named it as the player-input-dialog substrate; v0.8 makes explicit that the same primitive runs *every* context where two trait-coordinated participants drive sequenced gameplay through the gesture-circle and lemniscate-cursor. **Intimate-gameplay is the second major application** (the first being NPC-dialog).
+
+**The intimate-gameplay loop running on the lemniscate substrate:**
+
+| Lemniscate primitive | Intimate-gameplay application |
+|---|---|
+| **Slot-tokens** | The clasp-pair (or premium service-body-pair) — two participants in the loop |
+| **Cursor at axis-crossing** | Whose action / position-change is currently active |
+| **Gesture-alignment-accumulator** (per slot) | Each participant's trait-coordinated input across the turn-window — sex-positions, gestures, body-part-engagements |
+| **Sum-strategy reduction at crossing** | Per-axis integrated trait-vector summary — how aligned are the pair right now |
+| **Trait-vector summary fed into next driver-context-pull** | NPC-partner's next dialog turn fires in the alignment-determined trait-LoRA register |
+| **Phase-locked overlay channels** | Body-shader-pulse feedback, color-merge during deep alignment, environmental shader-shift |
+| **Hardstops** | Definitive intimate signals — `clasp_initiate`, `pause_with_tenderness`, `withdraw_gracefully`, `safe_word_invoke`, `consent_revoke`. These fire definitive subsystem-actions (cannot be remapped) |
+
+**Sex-positions as designer-fixed catalog entries.** Same discipline as the dialog-corpus — every position has a designer-authored trait-coordinate (or primary + secondary trait-coordinate composition). The universal-translator's catalog extends to physical-act vocabulary. Examples:
+
+- *missionary* → Philotes (bond) + Sophrosyne (restraint)
+- *embracing-with-eye-contact* → Philotes (bond) + Aletheia (truth-seeing)
+- *dominance-position* → Eros (reaching) + Dikaiosyne (bearing)
+- *slow-remembering* → Mnemosyne (memory) + Philotes (bond)
+- *desperate-reaching* → Eros (reaching) + Moira (fate)
+
+**Body-parts as visible expression of trait-state.** When a position activates with its trait-coordinate, the participant's human-mesh body-shader pulses in the corresponding trait-color. The visible body becomes the *real-time signal* of the trait-state — no HUD; the body itself is the readout. Two clasp-partners see each other's body-shader-pulse as the conversation between their trait-states unfolds.
+
+**Cross-context-consistency is now mechanically true.** The architecture's earlier commitment (the v0.1 design-vision's *"same gesture-skill for dialog, combat, intimacy, maintenance, ritual"*; design-vision doc retired in v0.9, preserved in git history) is operationalized: **the same gesture-circle + universal-translator + trait-LoRA-per-turn-selection + lemniscate-recursive-aggregation drives all of them.** A 200-hour player has dramatically richer intimate-gameplay than a 50-hour player for the same reason they have richer linguistic and emotional competence — they've accumulated more vocabulary in the universal-translator and more selection-pattern fluency on the gesture-circle. **Linguistic competence, emotional competence, and intimate competence are the same competence in this system.**
+
+**This is also why premium-imperial-net intimate-gameplay is *mechanically identical* to in-between clasp.** Same lemniscate. Same gesture-circle. Same trait-alignment. The differences are at the *value-flow* and *persistence* layers (per `../political-register/architecture.md` §Three-tier intimacy structure and `../inference-and-memory/architecture.md` §Three sqlite stores per player), not at the runtime-mechanics layer. The architecture's typed-contract discipline pays off here too: one machinery, multiple political-economic contexts.
+
+**Voice-input flows through the same accumulator as gesture-input.** Player speech → local STT → token-stream → each token has a designer-fixed trait-coordinate (per the universal-translator corpus; same word → same trait → same coordinate for every player and every NPC and every LLM-context, per `../player-experience/architecture.md` §Designer-fixed cosmology, player-curated arrangement) → tokens accumulate into the same `gesture_alignment_accumulator` on the player's slot-token → integrated at axis-crossing → carried forward into next NPC's `driver_context_pull`. **Voice and gesture are co-equal modalities feeding one mechanism**; no player-trait-LoRA needed, no LLM-bypass needed. A player gesturing Philotes while speaking Aletheia-vocabulary contributes both trait-coordinates to the accumulator simultaneously; the sum-strategy reduction handles the multi-modal case naturally. (Resolves the v0.4 player-dialog-handling open question.)
+
+### Driver-context-pull (LLM dialog substrate)
+
+The cursor's position at each crossing makes context-construction for the dialog-driver a pure function of cursor-state:
+
+```
+driver_context(cursor_at_NPC_i, mode) = {
+    zone.purpose,                 // stable: spawn-intent, immutable provenance
+    zone.scene_state_public,      // stable across zone: what's happened so far
+    zone.ternary_gate_edges,      // current resonances (active relations)
+    zone.drift_state,             // delta from spawn-intent (visible to director)
+    NPC_i.knowledge_stack,        // PRIVATE three-tier stack: world ∪ district ∪ primary
+                                  //  [+ clasp ONLY if mode == in-between]
+    NPC_i.expressed_trait_vector, // expressed trait-vector this moment
+    NPC_i.active_signals,         // their current emergent-signals
+}
+```
+
+**Other NPCs' memories never enter this prompt.** No bleed. No cross-contamination.
+
+**The `knowledge_stack` is layered**, not a single bucket. Universal world-canon, district-canon (regional), NPC_i's own primary memory, and — only if the character is in the in-between dimension — clasp memory. The retrieval layer enforces the dimensional cut; the LLM never has to reason about it. See §Local memory architecture in inference-and-memory/architecture.md for the layering, propagation policy, and clasp-as-Ring-A* privacy primitive. The classic multi-agent hallucination source ("why does Kalypso suddenly remember what Anaximander confided to Phoibe?") is *structurally foreclosed* by the geometry. Write-back goes only to NPC_i's slice; the lemniscate guarantees NPC_i is not cursor-active again for at least one full roundtrip — write-back has all the time it needs without race conditions.
+
+This converts multi-NPC dialog from an **emergent-chaos problem** into a **bounded-cast scene problem with a typed runtime**. The classic multi-agent failure-modes are foreclosed at the architecture level rather than the prompt level:
+
+- **Cast = active-slots, period.** Geographic proximity does not equal participation
+- **Cursor sequences turns deterministically.** No concurrent LLM-storm
+- **Entry-line and exit-line are the only paths in/out.** Geographic motion alone doesn't invade the scene
+- **Player gestures broadcast to active-slots only.** Not to "everyone within 30m"
+
+### Empty-queue behavior: shrink at every crossing
+
+When the entry-line is empty, each crossing **dissolves one active slot** instead of replacing it. The conversation thins visibly — color-language saturation drops per shrink, lifeforce burn-rate decreases. When the last slot dissolves, the lemniscate collapses; the spawning director recovers unspent lifeforce minus burn.
+
+This is the natural wind-down — *scenes run out of people and dissolve*. No timeout, no scheduler-collapse, no cut-to-black. The decay is observable in-world and rate-paced by the same axis-rate.
+
+### Lifeforce-binding
+
+Every midaxis crossing fires the LLM driver-turn(s) for active slots. **Lifeforce burn-rate = pulse-rate × active-slot-count.** The director (or overseer) holding the zone pays per crossing. This produces:
+
+- **Dense dramatic scenes are expensive** — many slots, fast pulse, high burn
+- **Quiet background zones are nearly free** — slow pulse, few slots; most compute is local-loop traversal not touching the bus
+- **Running out of lifeforce is visible** — pulse-rate slows, crossings stretch farther apart, the scene *languishes* before it collapses. A diegetic dying-scene register; not a cut, a deceleration
+
+### What this resolves
+
+- **Slot-capacity elasticity** (prior open question) → fixed roundtrip slot-count, elastic entry/exit queues
+- **Zone-to-zone handoff** (prior open question) → exit-line of zone-A is entry-line of zone-B (interlemniscate-transit; pipes-as-heterotopia made literal at runtime)
+- **Mobile zone boundaries** (prior open question) → the lemniscate is a topology; it translates through world-space invariantly (patrols, escorts, exoduses are moving figure-8s)
+- **Anthropic-faction's broadcast cadence** (prior open question) → cadence rides the same axis-rate as a phase-locked overlay; no separate clock
+- **Director/overseer spawn ownership per model class** (prior open question) → the director (or overseer) owns the zone-spawn decision (policy-lookup, no LLM in loop); the LLM driver lives at the driver-context-pull layer; orchestration and dialog are decoupled
+
+### What this retires
+
+- Slot-list + external turn-counter → cursor on lemniscate
+- Polling for emergent-signals at zone-tick → flag-as-verifier carried in loop
+- Mega-prompt with all NPC memories ("everyone in this scene") → cursor-driven per-NPC memory-slice
+- Geographic-proximity participation ("everyone within 30m may interject") → strict active-slot cast
+- Concurrent LLM calls per-NPC → sequenced LLM calls per-cursor-position
+- Polling event-channels at zone-rate → atomic crossing-event with O(N_slots) flag-scan
+
+## Omnisight — NPC visual perception via VL-Gemma + virtual cameras
+
+NPCs perceive the visible world *literally* — not via geometric metadata-perception but via per-NPC virtual cameras (Godot) feeding rendered POV-frames into the local VL-Gemma 4 driver-tier (the multimodal vision-language capability of the Gemma 4 E4B model locked in v0.8). What an NPC "sees" is what the VL-LLM interprets from the camera's image.
+
+This is the perception architecture's deepest commitment. It pairs with the cell-arch checksum-discovery (per [`../political-register/world-generation.md`](../political-register/world-generation.md) §L4 Cell ruleset) as its **trigger-layer**: cell-checksum-mismatch fires the *"clean signal"* that activates the NPC's POV camera, which renders, which feeds VL-Gemma, which produces a visual interpretation that modulates the NPC's current-turn behavior. **Cheap trigger, expensive understanding, bounded by event-frequency.**
+
+### The pipeline
+
+| Layer | Cost | Fires when |
+|---|---|---|
+| Cell-checksum check | µs | NPC enters cell |
+| Checksum-mismatch → "clean signal" | µs | Cell state ≠ expected hash |
+| VL-camera renders POV scene | ms | Clean signal + perception-relevant context |
+| VL-Gemma processes image → interpretation | 100s of ms | After camera renders |
+| NPC behavior responds to seen-content | next-shift / next-crossing | After interpretation |
+
+Most NPCs most of the time: no camera-fire, no VL-inference. **Active-perception-budget is bounded by event-frequency, not NPC-count.** A 100+ NPC city is feasible because most NPCs are running shift-routines on rails with no cell-state-changes triggering perception.
+
+### Camera-trigger sources (locked)
+
+Camera renders + VL-inference fire **only on**:
+
+- **Cell-checksum-mismatch** — cell-state-change discovered on entry (the cell-arch's primary discovery-trigger)
+- **Hard-signals from player** — `clasp_initiate`, gesture-hardstops, plug-in conversation request, etc.
+- **Overseer triggers** — audit-sweep, surveillance-cycle, patrol-perception-on-route
+- **Drone perception** — clear boundaries + rulesets per drone-class (drones have their own perception-budget governed by their imperial-class spec)
+
+Everything else: NPC running on rails, shift-routine, no camera-fire, no VL-inference. **Bounded compute by construction.**
+
+### Hallucination-isolation discipline (load-bearing)
+
+VL models hallucinate. If those hallucinations enter the canonical record, they propagate through the lemniscate's recursive integration → become referenced by other canon-rows → become load-bearing in the world's narrative coherence → **cannot be untangled later**. *Bleed-over into oblivion* is the precise risk.
+
+The discipline that prevents this:
+
+> **Visual perception = behavior-modulating-only; never canon-generating.**
+
+Visual context flows on a *separate stream* from the canonical text + gesture summary, with a strict firewall between them:
+
+| Stream | Source | Persistence | Purpose |
+|---|---|---|---|
+| **Text + gesture summary** (existing canonical pipeline) | STT + gesture-circle-presses + per-token trait-coordinates per §Gesture-alignment as recursive-lemniscate | Canonical; flows into `event_canon_summaries`; propagates to Compositor; integrates into trait-vector | What the NPC *remembers* and what becomes world-canon |
+| **Visual context** (omnisight-flagged, new) | VL-Gemma processing POV camera-render | **Ephemeral**; flagged on the lemniscate; **ignored in the per-crossing summary**; never propagates upward | What the NPC *sees in this moment*; modulates current-turn `driver_context_pull` only |
+
+**Concretely:** the visual interpretation is appended to `driver_context_pull` for the NPC's next turn (so the NPC can react to what it sees), but it is **not** appended to the `gesture_alignment_accumulator`'s sum-strategy reduction at the axis-crossing, and it is **not** included in the `event_canon_summaries` row that the Compositor pulls from `transient_waiting_flag`. **The visual content lives one turn and dies.**
+
+This preserves three architectural commitments that depend on text/gesture-derived canon:
+
+- *Compositor narrative-coherence at scale* — Compositor never sees VL-output; only deterministic text/gesture-derived summaries. **Hallucination-firewall preserves the canon-coherence Compositor depends on.**
+- *Memorialist-archive truth-claims* — Memorialists index cell-checksum-divergence (canonical, deterministic), NOT VL-generated visual-content. The archive's evidentiary value depends on this distinction.
+- *Mind-pool soul-recycling* — when a mind cycles through the pool and is redistributed into a new body, the trait-vector that persists is text/gesture-derived. **VL hallucinations do not survive transmigration; they were ephemeral by construction.**
+
+### Wealthy-degen service-body-folder exception
+
+A specific opt-in special case for player-stored visual-content:
+
+- A wealthy player who already has service-body-dialog stored (per `../political-register/architecture.md` §The vocation-substrate of the imperial-net market) can check a box to allow **sex-pictures storage in a private folder** from clasp-scenes.
+- Stored locally (their machine, their problem — privacy, storage, content).
+- **Read-only-by-player** — folder content does **not** flow back into NPC contexts, world-canon, the Compositor, the mind-pool, or any other system.
+- **Quarantined dead-end storage** — aesthetic-collection only.
+
+The folder is architecturally inert with respect to the rest of the system. It exists *for the player*; it does not exist *for the world*.
+
+### What this retires
+
+- *Geometric perception (cone, radius, LOS)* → already retired by zone slot-occupancy + subscriber-event-emission; **omnisight extends the retirement** by giving NPCs *literal* visual perception within those subscribed events, not metadata-perception
+- *VL models polluting world-canon* → text/gesture-derived summaries are the only canonical input; VL is behavior-modulating-ephemeral-flag-only; player-stored visual-content is read-only-by-player quarantined storage
+
+### What this resolves / sharpens
+
+- *Continuous visual feedback policy* (architecture-index Still-open) → with cel-shaded bodies (per `../topology-and-rendering/architecture.md` §Three-shader philosophy) and visual-as-ephemeral-flag, the body-shader pulses are *legible without canon-pollution risk*. The visual-feedback policy can be permissive at the cosmetic layer because it is firewalled from canonical state.
+
+### Open questions
+
+- **Per-NPC VL-inference rate-limit** — how many camera-renders + VL-inferences per second affordable per active NPC at MMO scale? Pending: benchmark against Gemma 4 E4B VL-inference latency on typical-deployment hardware.
+- **VL-Gemma camera resolution + frame-rate** — what camera-budget per NPC fits the rule-catalogue? Pending: rule catalogue + benchmark.
+- **NPC progression-state for witness-axis** — how does an NPC accumulate in-between-knowledge that drives their dual-axis-clasp witness-fidelity (per `../identity-and-personhood/bodies.md` §Asymmetric clasp / §Dual-axis clasp-fidelity)? Their own clasps? Fragments encountered? Caste-class-default? Pending: design pass.
+- **Multi-NPC observing same event** — each NPC runs independent VL-inference; how do their perceptions combine into a shared event-record? *(Connects to Compositor narrative-coherence-at-scale Still-open.)* Probable answer under the hallucination-isolation discipline: *they don't combine* — each NPC's visual context is private to their own next-turn `driver_context_pull`; the shared event-record is built from text/gesture-summaries only. Worth confirming explicitly.
+
+## Zone taxonomy (v1 starter set)
+
+| Zone type | Register | Slots | Executor | Persistence |
+|---|---|---|---|---|
+| Conversation | physical | 2–4 dialog | director | persistent |
+| Street brawl | physical | fighter + spectator | director | persistent |
+| Ritual | physical | fixed ceremonial | director | persistent |
+| Maintenance | physical | 1–2 workbench | director | persistent |
+| Wall-writing | physical / liminal | 1 author + witnesses | director | persistent / ephemeral |
+| Market exchange | physical | 2–3 + ambient | director | persistent |
+| Memorial gathering | physical | 1 mourner + N witnesses | director | persistent |
+| Salvage | physical (dump) | N scavengers | director | persistent |
+| Transit-encounter | physical (pipe) | 2–6, stranger-heavy | director | persistent |
+| **Plug-in conversation** | physical (rail) | 2-3 (3-way capacity) | director | ephemeral (rail-segment-bound) |
+| Patrol / sweep | physical | mobile, N enforcers | overseer | persistent |
+| Interrogation | physical | 1 subject + N enforcers | overseer | persistent |
+| Raid | physical | district-scope + N enforcers | overseer | persistent |
+| **Interior (hovel/workshop/etc.)** | physical | slot-inventory by interior-type | director | persistent |
+| **Clasp** | **liminal** | 2 | director | **ephemeral** (stabilizes across repeated clasps) |
+| **Aletheia-gathering** | **liminal** | N, mini-game-gated | director | **ephemeral** |
+| **Migration (mobile)** | physical (pipes) | cohort + escort | overseer | persistent |
+| **Exodus (mobile, mass)** | physical (pipes) | self-selecting crowd | emergent | persistent |
+| **Drug-ring den** | physical (cheat-op) | N users + cooks | director (cheat) | persistent (until detected) |
+| **Illegal back-alley modshop** | physical (cheat-op) | 1 modder + 1-N customers | director (cheat) | persistent (until detected) |
+| **Unlicensed brothel** | physical (cheat-op) | N workers + N customers | director (cheat) | persistent (until detected) |
+| **Companion hall** | imperial net | 1 dreamer + N synthetic | net-director | extractive-persistent |
+| **Brothel encounter** | imperial net | 2+ (synthetic or employed) | net-director | extractive-persistent |
+| **Imperial ceremony** | imperial net | mass-audience | net-director | extractive-persistent |
+| **Ruin zone** | physical | pilgrimage-only | none / Memorialist | persistent-abandoned |
+
+
+## Zone spawn cadence
+
+Five layered mechanisms (all compute-budget capped, all lifeforce-gated):
+
+1. **Demand queue (faction-driven)** — gamemaster processes by priority + cost; stale demands age out
+2. **Shift-composition spawn-candidates** — emergence from "which active-shift NPCs co-located"
+3. **Pressure gradients (ambient)** — cells accumulate; threshold-crossings spawn
+4. **Emergent-signal response** — relational-gate transitions emit upward
+5. **Player-proximity densification** — multiplier near player; distant districts background
+
+Daily pulse: morning ambient, midday productivity-overseer, evening conversation-peak, night sparse-clasp-possibility.
+
+## Emergent zones — the dramatic-episode unit
+
+Spawn-cadence mechanism #4 (emergent-signal response) elaborates into the architecture's primary **dramatic-episode unit**: a complete, bounded, emergent narrative-arc with goal, participants, dialog, mechanical action, success/fail-state, and structured aftermath — produced by the simulation, *not* authored.
+
+The player has experienced this in every player-driven sandbox they remember best (Dwarf Fortress's "tantrum spirals," RimWorld's "raid stories," Caves of Qud's "I went to find my sister and"). What's new here is treating the emergent-arc as a **first-class typed unit** with cost, distributed funding, runtime substrate (the lemniscate), goal-evaluation against the world's own value-axes, and structured report-back.
+
+### The flow
+
+```
+1. NPC_A signal fires
+   (e.g., emergent_signal("limb_broken", lifeforce_threshold_breached))
+   broadcasts to district-bus
+                ↓
+2. District-director consumes signal
+   (policy-lookup: problem-class → typed-tool selection, quota-aware)
+   decides spawn rescue-event
+   pays spawn-cost from director_lifeforce_budget
+   defines goal: NPC_A.limb_A >= 10% (numeric) OR Sophrosyne-axis +1 (fuzzy)
+   defines termination: goal_met OR participating_lifeforce_exhausted
+                ↓
+3. Event spawns as new emergent-zone (lemniscate, with goal-flag)
+   broadcasts on bus; rings-of-importance gate which other zones lose NPCs
+                ↓
+4. NPCs evaluate (proximity + state + own_traits + own_lifeforce + ring-of-importance)
+   self-select to attend or stay in current zone
+   state-machine engages: animations, rail-jumps, lift, splint
+   their own lifeforce burns as they participate
+                ↓
+5. Lemniscate runs:
+   DIALOG layer (cursor-driven): NPCs speak as they help — memory-pure, sequenced
+   STATE-MACHINE layer (sim-tick): physical actions execute alongside, decoupled clock
+   At each crossing: goal_satisfied flag re-evaluated
+                ↓
+6. Termination:
+   goal_met                → success-report
+   budget_exhausted        → partial-report
+   participants_evaporated → fail-report
+                ↓
+7. Report back to spawning director:
+   { lifeforce_cost: total burned (director_spawn + sum NPC contributions),
+     goal_status: ternary (+1 / 0 / -1, with axis named for fuzzy goals),
+     participants: [NPCs and contributions and faction-affiliation],
+     side_effects: [faction-resonances, ternary-gate shifts, drift-from-purpose] }
+                ↓
+8. Director's Dream-process consumes the report
+   tunes future spawn-policy: (problem-class, tool, outcome) over time
+   GM aggregates rescue-cost across districts
+   imperium consumes population-health indicator
+```
+
+### Distributed funding economy
+
+The director only pays **spawn-cost**. Operating-cost is distributed across willing participants — every NPC who attends spends their own lifeforce on dialog turns and state-machine actions. This produces structurally important properties:
+
+- **Cheap to spawn many emergent events.** Spawn-cost is bounded; if no NPCs attend, the event fails fast and consumes only spawn-cost. Directors can be generous with spawning because failure-cost is bounded.
+- **Helping is expensive in-fiction.** Lifeforce literally burns when an NPC participates. High-Philotes NPCs help freely; low-Philotes / faction-rivals don't show up. This produces **faction-politics-by-attendance** — *measurable* faction-allegiance based on who-helps-whom, not guessed.
+- **Cost-asymmetry encodes the cruelty.** Districts where lifeforce is starved → fewer NPCs can afford to help → rescue-events fail more often → silence-gradient deepens. The simulation produces **rescue-failures-as-emergent-tragedy structurally**. Marx in the schema, exactly as the architecture's broader thesis promises.
+
+### Two-layer execution: state-machine + lemniscate
+
+The mechanical-action layer (state-machine) and dialog-layer (lemniscate cursor) run on **decoupled clocks**:
+
+- **State-machine** runs at simulation-tick (fast). Animations, pathfinding, rail-jumps, splint-applications execute when the physics says they execute.
+- **Lemniscate cursor** runs at axis-rate. At each crossing, the dialog-driver reads state-machine status as a snapshot and the cursor's NPC narrates accordingly ("I've got him," "the splint won't hold").
+
+**Speech doesn't gate action; action doesn't block speech.** They run in synchronized-but-loose harmony, exactly the property real-world helping has — people talk *while* they work, and the work continues while the talk happens.
+
+### Goal evaluation: ternary through trait-axis
+
+For numeric goals (limb_A >= 10%), the verifier is a simple threshold on a state-machine variable.
+
+For fuzzy goals (deescalate the fight, get her to open up about the clasp, convince him to stay), the verifier compiles to a **trait-axis ternary evaluation against the existing substrate** — no new evaluation primitive:
+
+```
+Goal: "deescalate the fight in the marketplace"
+  ↓ compile to:
+goal_axis = Sophrosyne (temperance principle)
+goal_direction = positive (toward STABLE/OPEN)
+baseline = trait_axis_gate_state at zone-spawn
+  ↓ at event-end:
+delta = current_gate_state vs baseline
+  ↓
++1 if delta-positive (deescalation produced)
+ 0 if held the line (no progress, no regress)
+-1 if delta-negative (fight intensified)
+```
+
+**Goals are evaluated by what the *world* values** (the Hellenic principles), not by the spawner's idiosyncratic spec. A "deescalate" goal is judged by *the world's Sophrosyne-result*, not "did the spawner get what they wanted."
+
+**Multi-axis goals fall out cleanly** — `(Philotes >= +1) AND (Sophrosyne >= +1)` for "rescue NPC_A AND keep faction-tension low (via maintained restraint)."
+
+The result is consumed by the spawning director's Dream-process as a discrete-action-space reward signal. **One signal-grammar, top to bottom**: gates produce ternary, scenes produce ternary, Dream-processes consume ternary. Delta-not-absolute matches the lifeforce_actual-vs-reported asymmetry — what's measured is the *work the event did*, not just the end-state.
+
+### Mid-event signal handling
+
+If a participating NPC's exit-flag fires mid-event (their own shift-whistle, their own limb breaking, faction-summons elsewhere), **exit-flag wins on the next crossing**. The rescue is now under-staffed. Drama scales. **The rescuers are running out the same way the patient is.** Real stakes.
+
+If the rescued NPC's own state-machine reaches a worse condition (limb deteriorates further toward dismemberment), the goal becomes unreachable; verifier flips to fail-flag; zone collapses with fail-report. Director's Dream-process learns *this configuration was insufficient* — spawn-distance, NPC-mods, lifeforce-budget were inadequate for this severity.
+
+### Cross-zone NPC pull: rings of importance
+
+When an emergent-zone broadcasts, NPCs already in other zones evaluate **whether the broadcast outranks their current zone's purpose** by ring-of-importance (see §Rings as structural pattern in authority-and-decision/architecture.md). Topics live in rings; rings shift over time based on past ternary-results — a topic that consistently produces +1 climbs, one that produces -1 drops, one untouched decays.
+
+This converts emergent-zones into a **competitive attention economy**. Multiple lemniscates compete for slot-NPCs; high-ring topics drain population from low-ring topics; the simulation produces its own cultural priors over time. *What's worth attending to* is shaped by *what attending-to has produced*. Real societies do this; the architecture renders it.
+
+### What this resolves
+
+- **Aletheia-progression as level-up** (prior open question) → answered structurally: trait-axis ternary evaluation at event-end with named-axis recognizes acts-of-awakeness without per-act hardcoding (specific axis-mapping per Aletheia-event-class still needs design, see open-questions)
+
+### What this retires
+
+- Authored quest-arcs → emergent dramatic-episode units
+- Quest-failure as designed branching → goal-and-budget arithmetic
+- Centralized GM-pays-for-all-events → distributed-funding (director spawn-cost, NPC operating-cost)
+- Boolean quest-status → ternary goal-result, multi-axis-composable
+- Event lifecycle without report-back → structured report → Dream-process feedback loop closed at every tier
+- Static topic-priority → rings-of-importance with outcome-driven movement
+
+
+---
+
+**Version:** 0.7.0 | **Created:** 2026-04-26 | **Updated:** 2026-05-01 | **Origin:** Split from architecture-index.md v0.7 (2026-04-26)

runtime-engine/event-zones.md

@@ -0,0 +1,297 @@
+# Event Zones — interaction substrate
+
+> *The architecture's interaction-substrate, composed onto one image. Designer-authored multi-cell zones (sofa, bed, install-table, plaza-inner-stage) sit alongside the runtime-engine's existing emergent-zone substrate; together they host every interaction in the world. The composed wheel from [`../imperial-cult/cosmology.md`](../imperial-cult/cosmology.md) §The composed wheel becomes the universal mini-game-surface; verifier-flag patterns differentiate hacking from lockpicking from install from clasp from proximity-pulse. Cells host event-zones; event-zones host events; events carry participant-lists; the wheel renders each event's mini-game on the same iconographic surface. **One image, one substrate, every interaction.***
+>
+> *Companion to: [`./architecture.md`](./architecture.md) (zone-canon, lemniscate runtime, slot-tokens + verifier-flags, gesture-alignment-recursive-lemniscate), [`../political-register/world-generation.md`](../political-register/world-generation.md) (cell-arch L4 + room ruleset L3), [`../topology-and-rendering/architecture.md`](../topology-and-rendering/architecture.md) (rail+grid topology, interior-as-zone), [`../style/consent-discipline.md`](../style/consent-discipline.md) (the four hardstop-pattern variants this paper maps to event-classes), [`../imperial-cult/cosmology.md`](../imperial-cult/cosmology.md) (the composed wheel iconography this paper renders as UI).*
+>
+> *v0.1 initial draft 2026-04-27 — concise-dialog session post-v0.25 + studio v0.5; nine compositional moves consolidated onto one substrate without introducing new primitives — dafit + chrysalis.*
+
+---
+
+## What this is
+
+This document specifies the **interaction substrate** in nimmerworld — how cells, zones, events, hardstops, the trait-circle, and the consent-discipline compose onto a single coherent surface. It complements [`./architecture.md`](./architecture.md), which establishes the zone primitive, the lemniscate runtime, slot-tokens + verifier-flags, the gesture-alignment-recursive-lemniscate, and the emergent-zone dramatic-episode unit.
+
+Every claim in this document is a **composition of existing primitives**, not a new substrate. The contribution is integrative: the architecture's prior canon already had cells, zones, slots, verifier-flags, hardstops, lifeforce budgets, the trait-palette, the consent-spine, and the cosmology's composed wheel — this paper specifies how they compose into one interaction-grammar.
+
+Nine compositional moves are documented:
+
+1. Designer-authored event-zones vs emergent zones (orthogonal; clean signals)
+2. Cells + event-zones + events as a layered data-model with a composite UID (`districtid_cellid_eventid`)
+3. The composed wheel from `imperial-cult/cosmology.md` as universal mini-game-surface
+4. Hardstops as consent-gates between event-states with **contextual activation**
+5. The four hardstop-pattern variants of `consent-discipline.md` as the event-class taxonomy
+6. Boundary-zone-with-inner-zone for plaza-scale mass-presence events
+7. Room-boundary cell-layer + rail-passage + lifeforce-budget-per-room
+8. Slot-binding suspends lemniscate routing during events (the NPC-stays-put fix)
+9. Player editor-mode + three-source schema unification (world-gen-init / runtime-event / player-edit-time write the same canon)
+
+Each is a single pencil-stroke on top of canon already laid down.
+
+## The composition — what's new, what's reused
+
+| Move | Reuses existing primitive | What this paper adds |
+|---|---|---|
+| Designer-authored event-zone | `zone` primitive (boundary + slots + lifecycle); `interior-as-zone` (per `topology-and-rendering/architecture.md`) | Designer-authored multi-cell variant flagged separately from emergent runtime zones; orthogonal routing |
+| Cells + event-zones + events | `cell_table` (per `political-register/world-generation.md` L4); `event_register` + `transient_waiting_flag` (per `architecture-index.md` §Mapping to phoebe); `event_uid` | Composite UID `districtid_cellid_eventid`; participant-list per event (not per cell) |
+| Universal mini-game-surface | The composed wheel (per `imperial-cult/cosmology.md` §The composed wheel); verifier-flag substrate (per `./architecture.md` §Slot-token + verifier-flag mechanism); gesture-alignment-accumulator | Verifier-flag *patterns* per task differentiate mini-game classes; same UI substrate |
+| Hardstops as consent-gates | Hardstop-registry (~8-16 reserved gestures per `player-experience/architecture.md`); the four hardstop-pattern variants (per `style/consent-discipline.md`) | **Contextual activation** — most hardstops cycle in/out based on event-zone-eligibility; budget is per-moment-active not overall |
+| Variants-as-event-classes | The four canonical variants (per `consent-discipline.md` §The four hardstop-pattern variants) | One-to-one mapping to event-class taxonomy: self / dual / triple / cooldown-augmented |
+| Boundary-zone with inner-zone | Zone primitive + slot-inventory; the architecture's signature pattern (cheap-baseline + typed-breakout-flags) | Nested-zone variant for plaza-scale; ambient outer + slot-bound inner; slot-promotion as typed handoff |
+| Room-boundary + rail-passage + lifeforce | Lifeforce four-tier hierarchy (per `architecture-index.md`); rail+grid topology (per `topology-and-rendering/architecture.md`); interior-as-zone | Room as district-shard-of-lifeforce; boundary cell-layer where rails enter; capacity-check at boundary-passage |
+| Slot-binding suspends lemniscate routing | Slot-token + verifier-flag (per `./architecture.md`); lemniscate runtime | `slot_locked` verifier-flag pauses routing for the event-duration; resumes on event-end |
+| Player editor-mode + schema unification | World-gen-as-init-function (per `narrative-composition/architecture.md`); cell-arch atomicity (1×1×1m, one asset) | `origin` provenance field on cell-rows: `world_gen_init` / `runtime_event` / `player_authored`; same schema across all three writers |
+
+The composition's discipline: **the architecture's signature pattern, applied recursively at the interaction layer.** Cheap baseline + typed breakout-flags + same-substrate-different-scale, exactly as the lemniscate-runtime + imperial-event encapsulation + NPC-daily-window + cosmology-composed-wheel already do at their respective scales.
+
+## Designer-authored event-zones vs emergent zones
+
+The runtime-engine's zone primitive (per [`./architecture.md`](./architecture.md) §Zone anatomy) hosts both **emergent zones** (spawned by the gamemaster from emergent-signals, shift-composition-emergence, proximity-detection, etc.) and **designer-authored event-zones** (placed at world-gen-init by the cascade, fixed in space, fixed in eligibility). Both use the same slot-inventory + verifier-flag mechanism; what differs is provenance and routing.
+
+| Property | Emergent zone | Designer-authored event-zone |
+|---|---|---|
+| Spawned by | Gamemaster, emergent-signal, proximity, shift-composition | Cell-arch L4 generation; placed at world-init |
+| Boundary | Cell-envelope or interior-envelope; mobile (lemniscate translates through world-space) | **Fixed cell-envelope** spanning N cells; immobile |
+| Slot-inventory | Capacity per emergent type (per `./architecture.md` §Zone taxonomy) | **Designer-authored slots** (sofa: 2 seat-slots; bed: 1-2 lying-slots; install-table: 1 patient-slot + 1 surgeon-slot) |
+| Eligible-task-classes | Type-derived (rescue, conversation, brawl, etc.) | **Designer-authored** per zone (sofa: sit-and-talk, fumble-limb, sleep; install-table: install, examine, lobotomy) |
+| Lifecycle | Ephemeral; collapses when participants evaporate | Persistent; participants come and go; zone itself doesn't dissolve |
+| Routing | Lemniscate runtime; cursor-driven; emergent dialog | Slot-binding gates; participants commit to slots for event-duration |
+
+**They do not overlap.** The runtime treats them as orthogonal channels: a cell either hosts an emergent-zone OR is part of a designer-authored event-zone, not both simultaneously. This is the architecture's clean-signal discipline — animations don't loop because of conflicting state, participant-lists don't bleed, hardstop routing is unambiguous.
+
+The single nesting pattern allowed is **boundary-zone-with-inner-zone** (see §Boundary-zone with inner-zone below), and even that nests one designer-authored zone inside another, never designer-authored inside emergent.
+
+**Why this matters.** The architecture's `runtime-engine` discipline is *typed contracts over freeform behavior*. Emergent-zones are typed-by-emergence (statistical, gamemaster-composed); event-zones are typed-by-design (specific furniture, specific affordances). Mixing them would break the contract; keeping them orthogonal preserves it. Designer-authored event-zones get clean signals; emergent zones get statistical aliveness; the two compose via spatial separation.
+
+## Cells, event-zones, events — the data-model composite
+
+Three layered tables compose the spatial-interaction substrate:
+
+| Table | Granularity | What it holds | Per-row identity |
+|---|---|---|---|
+| `cell_table` (per `political-register/world-generation.md` L4) | 1×1×1m atomic | One asset per cell; container/wall-hook/debris category; per-register content (gameworld/liminal/imperial-net); checksum; `origin` provenance | `cell_id` (unique within district) |
+| `event_zone_table` (this paper) | Multi-cell interaction-surface | Spans cells (cell-id list); slot-inventory (typed seats/positions); eligible-task-classes; designer-authored | `event_zone_id` (unique within district); references cell-id list |
+| `event_register` + `transient_waiting_flag` (per `architecture-index.md`) | Per-interaction instance | Active/completed events; participant-list; current-state; verifier-flag pattern; outcome | `event_uid` |
+
+The composite UID for any in-world interaction:
+
+```
+districtid_cellid_eventid
+       ↑     ↑       ↑
+       │     │       └─ event UID (per event_register)
+       │     └─ cell where event-zone anchors (or canonical cell of multi-cell zone)
+       └─ district owning the event (the political-administrative shard)
+```
+
+This is consistent with the existing **UID-rooted event-trees** (per [`./architecture.md`](./architecture.md) §The Compositor at three tiers — *"World-events emerge from cross-district canon-rollups under a parent GM-level event_uid"*). Every interaction is a UID under this hierarchy; the Compositor reads at three scopes (zone-event / district-event / world-event); the event-zone is just where the event spatially anchors.
+
+**Cells don't carry partner references.** A common authoring temptation is *"the install-station cell stores partner_uid"* — wrong. Cells are spatial-only. **Events carry the participant-list.** When a player and an NPC slot-bind into a sofa-event-zone, the *event* records both UIDs; the cells stay anonymous to participation. This makes multi-agent events (3+ participants for triple-consent install, more for group rituals, mass-presence for plazas) trivial to extend — the participant-list grows on the event, not on the cell.
+
+**Cell-eligibility is multi-task.** A cell that's part of a sofa-event-zone has multiple eligible-task-classes (sit-and-talk, fumble-limb, sleep, share-pill); the runtime selects which task fires based on hardstop-pattern + participant-state at event-spawn-time. This separates **design-time eligibility** (what *can* happen here) from **runtime instantiation** (what *is* happening here now). Cleaner than locking cells to single-task affordances.
+
+## The wheel — universal mini-game-surface running on event-zones
+
+The composed wheel from [`../imperial-cult/cosmology.md`](../imperial-cult/cosmology.md) §The composed wheel is **the canonical mini-game-surface for every event-zone interaction**. The wheel renders with the event's verifier-flag pattern; the player gestures on the wheel; the gesture-alignment-accumulator integrates per the lemniscate-runtime's existing recursive-aggregation (per [`./architecture.md`](./architecture.md) §Gesture-alignment as recursive-lemniscate); the event resolves based on the verifier-flag's win-state predicate.
+
+**Same wheel, different verifier-flag patterns.** The architecture's existing canon already has verifier-flags per slot-token (per [`./architecture.md`](./architecture.md) §Slot-token + verifier-flag mechanism: `exit_eligible`, `goal_satisfied`, `priority_pull`, etc.). The mini-game variants extend this with task-specific verifier-flag patterns:
+
+| Mini-game class | Source of signal | Verifier-flag pattern | Win-state |
+|---|---|---|---|
+| **Hacking** | Inner hub (signal originating at the wheel's center) | Align both rings (caste + trait) so signal-path escapes outward | Signal-path complete; outer ring touched at correct trait-position |
+| **Lockpicking** | Outer ring (mechanism-state to align) | Slide elements along the ring to target positions | All elements at target |
+| **Install (consent)** | Two participants' avatars on the ring | Both avatars at mutually-aligned positions | Mutual alignment held for cooldown-window |
+| **Clasp / in-between entry** | Two participants' avatars on the ring | Both avatars hit coordinated-firewall-breach hardstop while gate is OPEN | Hardstop-pair fires within axis-window |
+| **Eye-pulse proximity** | Eye position (exterior to wheel) | Pulses on imperial-event proximity; passive output | N/A (warning system, not win-state) |
+| **Decryption** | Inner ring (caste-position-locked fragment) | Trait-position alignment unlocks the fragment | Outer ring at trait matching the fragment's encoding |
+| **Drug-grammar dosing** | Outer ring (trait-axis selection) | Aleatory; hardstop-gated; per-dose variance | Hardstop fires within trait-window; outcome rolls trait-engagement-points × hidden-stat |
+| **Ritual / ceremonial-throughput** | Inner ring (caste-tier sequence) | Match prescribed caste-sequence in order | Sequence completed without break |
+
+The verifier-flag pattern lives in the **task-catalogue** (per [`../identity-and-personhood/vocations.md`](../identity-and-personhood/vocations.md) §Three primitives) — same primitive that already authors trait-task-affinity. The wheel renders with the task's affinity-vector pre-highlighting the relevant trait-segments; **the player doesn't read documentation — the wheel itself shows what the task wants**.
+
+**The trait-engagement-points × hidden-task-stat outcome formula** (per [`../identity-and-personhood/vocations.md`](../identity-and-personhood/vocations.md)) determines actual outcome quality. The wheel mini-game gives the player *agency in the moment*; the math determines the *resolution*. Mini-game-as-consent-by-effort (per `architecture-index.md` §Three-layer digital ontology key-move) made universal: every interaction is gated by the player committing gesture-effort on the wheel, not by automatic resolution.
+
+**This collapses a long-standing open question.** The architecture's `architecture-index.md` §Open questions had carried *"The mini-game mechanic for liminal-maintenance — exact gameplay action deferred pending design-research survey of 20-year history of outstanding mini-interaction principles"* through multiple revisions. The answer the survey would have produced is now structural: **all mini-game mechanics, on one wheel, differentiated by verifier-flag pattern**. Juggling, rhythm, attention, gestural, decision-cascade, observation, hybrid — they all collapse onto verifier-flag-pattern-on-the-wheel, with the specific *feel* of each mini-game emerging from how its pattern reads against the wheel's geometry. The architecture didn't need a survey; it needed the composed wheel.
+
+## Hardstops as consent-gates with contextual activation
+
+Hardstops (per [`../player-experience/architecture.md`](../player-experience/architecture.md) §The trait-circle as gestural primary modality and per [`./architecture.md`](./architecture.md) §Gesture-alignment as recursive-lemniscate, *Hardstops are outside this system*) fire definitive subsystem-actions for unforgeable critical signals. The canonical budget is **~8-16 hardstops total**.
+
+This paper sharpens the hardstop discipline by introducing **contextual activation**:
+
+- **Always-on hardstops**: 6 caste-tier inner-ring hardstops (per `cosmology.md` §The composed wheel — *salute-the-Deva*, *attend-to-Asura*, *attend-to-Manusya*, *attend-to-Tiryak*, *weep-for-Preta*, *weep-for-Naraka*) + system-level off-wheel hardstops (panic, save, profile-switch, claim-floor). These are universally available; the player can fire them in any context.
+- **Contextually-activated hardstops**: intent-hardstops that light up when the player is slot-bound in an event-zone whose eligible-task-classes include that intent. *let-me-fumble-around-your-limb* lights up when slot-bound in a sofa-event-zone with a clasp-eligible NPC; *let-me-install-this-mod* lights up when slot-bound in an install-table-event-zone with a partner-NPC; *let-me-hack* lights up when slot-bound at a chest-cell with hacking-eligible-task-class.
+
+The canonical ~8-16 budget is therefore **per-moment-active**, not overall. The hardstop-registry can carry many intent-hardstops; only the contextually-relevant ones are surfaced to the player at any given moment. This solves three long-standing concerns simultaneously:
+
+1. **Discoverability**: the player sees *which hardstops are available right now* in the current event-zone, without browsing menus. The wheel's visible-state IS the discoverability.
+2. **Contextual relevance**: stale hardstops don't clutter the input space; only what makes sense here-and-now is firable.
+3. **Budget respect**: 8-16 is a momentary cap (cognitive-load ceiling), not a total cap. The architecture's input-vocabulary scales without breaking the unforgeable-critical-signal commitment.
+
+**Hardstops as consent-gates between event-states.** *let-me-install-this-mod* is a hardstop that *opens* a candidate event-state; the partner's reciprocal hardstop confirms; the event transitions into install-mode; the wheel renders with the install-task's verifier-flag pattern. Each hardstop is a typed transition between event-states; the consent-discipline's variants describe which transitions require which hardstop-patterns.
+
+## Variants 1-4 of consent-discipline as event-class taxonomy
+
+[`../style/consent-discipline.md`](../style/consent-discipline.md) §The four hardstop-pattern variants establishes four canonical consent-shapes. This paper observes that the four variants **are the event-class taxonomy**:
+
+| Variant | Participant count | Event-class | Examples |
+|---|---|---|---|
+| **Variant 1 — Self-only hardstop** | 1 (single agent) | **Solo event** | Self-install genital-mod (unpartnered); personal mod-removal; voluntary liminal-entry without coordination; solo-hacking; solo-lockpicking |
+| **Variant 2 — Dual hardstop (mutual)** | 2 (symmetric agents) | **Dual event** | Coordinated-firewall-breach (clasp-entry); mutual-symmetric pill-take; post-rogue NPC-modding (NPC unpartnered); body-disposal under pair-consent; install-with-partner |
+| **Variant 3 — Triple hardstop (with partner-witness)** | 3 (asymmetric — actor + affected + partner-witness) | **Triple event** | Genital-mod install when actor is partnered (self-install + partner-witness); post-rogue NPC-modding when NPC has clasp-pair; service-body modification with pair-witness |
+| **Variant 4 — Cooldown-augmented** (any of variants 1-3) | Per base variant | **Temporally-staged event** | Genital-mod (purchase-commit + cooldown + install-time-hardstop); re-vat events; consciousness-archive interactions; any irreversible truth-register modification |
+
+**Five papers' worth of cross-references just composed onto one substrate.** The consent-discipline's variants, the event-register's UID-rooted event-trees, the runtime-engine's slot-tokens + verifier-flags, the cosmology's composed wheel as iconographic surface, the player-experience's hardstop-registry — all read off this one taxonomy.
+
+The register-test from [`../style/consent-discipline.md`](../style/consent-discipline.md) §The register-test now has a new structural reading: **it is the event-class-classifier**. The 5-question mechanical procedure that determines which hardstop variant applies is also the procedure that determines which event-class spawns. Same test, two readings: *consent-validation* (does this action have the right hardstop-pattern?) and *event-instantiation* (which event-class does this action spawn?). They were always the same question; this paper makes it explicit.
+
+## Boundary-zone with inner-zone — plaza-scale mass-presence
+
+For mass-presence events (imperial daily-narrative broadcasts, sermons, festivals, ceremonial-throughput), a single slot-bound event-zone is too constrained — the inner zone holds *focused interaction* but the *ambient witness-mass* needs somewhere to live. The architecture's solution is the **boundary-zone-with-inner-zone** nested pattern.
+
+```
+                  Plaza event-zone (boundary)
+       ┌────────────────────────────────────────────┐
+       │  ambient witness-mass; overflow staging;   │
+       │  pre-slotting queue                         │
+       │                                             │
+       │      ┌──────────────────────────┐           │
+       │      │  Inner event-zone        │           │
+       │      │  (sermon-platform,       │           │
+       │      │   broadcast-stage,       │           │
+       │      │   slot-bound interaction)│           │
+       │      └──────────────────────────┘           │
+       │                                             │
+       │  ambient continues; participants            │
+       │  pre-slot for inner-zone promotion          │
+       └────────────────────────────────────────────┘
+```
+
+**Sparingly applied.** The pattern is reserved for plaza-scale; most event-zones are flat (sofa, bed, install-table — single zone, no nesting). Plazas, temple-squares, mass-ceremony halls, large festival-grounds — these are the canonical use-cases.
+
+**Slot-promotion grammar.** Movement from boundary → inner is **caste-tier-gated by default** (Deva-pinnacle promoted first, Naraka-tier promoted last) with named exceptions per-event-class. The promotion-rule IS the cosmology made walkable: in an Imperial Cult ceremony, promotion order *is* the wheel's caste-gradient enacted in physical positioning. The architecture's caste-as-stagnation key-move (per `architecture-index.md`) gains its plaza-spatial expression.
+
+Per-event-class exceptions:
+
+| Event-class | Promotion rule | Why |
+|---|---|---|
+| Imperial daily-narrative broadcast | None — boundary is the audience; inner-zone is broadcast-stage with imperial actors only | Broadcast is one-way; no citizen promotion-into-stage |
+| Caste-preacher sermon | Caste-tier-gated; Deva first, Naraka last | The cosmology enacted spatially |
+| Festival (ceremonial throughput) | Lottery / random-rationing during festival | The imperium rationing access; calibrated-misery as imperial optimum |
+| Memorialist gathering | Merit-by-attentiveness (Aletheia-trait-engagement gates promotion) | Heretical event; caste-gradient inverted |
+| Plaza market-day | First-come-first-served (FIFO temporal queue) | Quotidian ambient; no political loading |
+
+**The architecture's signature pattern at a fourth scale.** Cheap-baseline (boundary, ambient) + typed-breakout-flags (slot-promotion-into-inner) — same shape as lemniscate-runtime + imperial-event encapsulation + NPC-daily-window. The composed wheel adds a fifth scale (caste/trait composition). Boundary-zone-with-inner-zone is the *fourth* recursion; not a new primitive.
+
+## Room boundary + rail-passage + lifeforce-budget-per-room
+
+Every interior room (navmesh + event-zones) carries a **boundary cell-layer** one cell larger than the room itself on each axis. The rail-graph (per [`../topology-and-rendering/architecture.md`](../topology-and-rendering/architecture.md) §Topology: rail + grid + interiors) passes through this boundary; NPCs walking on rails enter the room by crossing the boundary cell-layer.
+
+Example: a 20×10×2 cell cantina has a 22×12×4 boundary (one cell on each axis). The innermost rail runs through the boundary cells; NPCs on the rail pass through the boundary on their way to or past the room.
+
+| Layer | Cell extent | Function |
+|---|---|---|
+| **Inner cells** (room proper) | 20×10×2 | Cell-table + event-zone-table; navmesh interior; lifeforce-bound interactions |
+| **Boundary cell-layer** | 22×12×4 minus inner | Rail-passage; capacity-check at entry; lifeforce-budget read |
+| **Rail-graph** | Threads through boundary | NPC routing; player plug-in verb anchor |
+
+**Capacity-check at boundary-passage.** When an NPC's rail-traversal crosses the boundary cell-layer, the runtime reads the room's current state: how many slots are filled, how much lifeforce-budget remains, whether emergent-zones are active inside, whether designer-authored event-zones are at capacity. The director (per [`./architecture.md`](./architecture.md) §The director) gets a clean signal per boundary-crossing — admit the NPC, route them elsewhere, queue them at the boundary, or trigger an emergent-event in response.
+
+**Lifeforce-budget per room.** Every room carries a lifeforce-budget bound to room-size (calculation TBD; see §Open questions). This budget is **a shard of the district's allocation** (per [`../political-register/architecture.md`](../political-register/architecture.md) §Lifeforce four-tier hierarchy) — the four-tier hierarchy (NPC / district / GM / imperium) stays intact; the room is a sub-shard of the district's budget rather than a fifth tier. Directors allocate per-room lifeforce as part of their per-district policy; the allocation IS the director's calibrated-misery tool (per `architecture-index.md` §Calibrated-misery as imperial optimum).
+
+**Events cost lifeforce.** Every event-spawn deducts from the room's budget; the rate per event-class is tunable. Dense interactions (plaza ceremonies, group-clasp-events) cost more; quiet ones (solo-reading, sleep) cost less. When room-budget exhausts, no new events spawn; the room goes quiet.
+
+**Insolvency-spiral mechanic surface.** The architecture's existing key-move (per `political-register/architecture.md` §Insolvency-spiral) — *the world shrinks as the imperium fails* — gets its mechanical surface here. When imperium's lifeforce contracts, district allocations contract, room-budgets contract; **events stop firing in concrete rooms**; the cantina goes quiet, the plaza thins, the world feels less alive. **No HUD-spinner; no abstract-meter; the room itself dims.** Diegetic relay at its purest.
+
+**Vibrancy is allocation, not square-footage.** When the player extends a room via editor-mode (see §Player editor-mode below) by adding cells, the room grows in size but NOT automatically in lifeforce-budget. Vibrancy follows allocation; the player can build a vast space and have it stay quiet, or work within a small space the director has allocated rich. Conservation-of-lifeforce preserved; player-authoring doesn't break the budget-arithmetic.
+
+## Slot-binding suspends lemniscate routing during events
+
+A long-standing problem the architecture has gestured at without resolving: NPCs who *don't follow correctly into the player's desired interaction-state*. Player approaches NPC, signals intent to sit on the sofa, NPC drifts to the next rail-segment because their lemniscate routing is still active.
+
+This paper resolves it at the data-model layer: **event-zone slot-binding sets a `slot_locked` verifier-flag that suspends lemniscate routing for the bound participant for the event-duration**.
+
+```
+NPC traversing rail
+    ↓
+Player signals slot-binding intent (hardstop)
+    ↓
+NPC's `slot_locked` verifier-flag set; participant-list updated on event_register row
+    ↓
+Lemniscate routing suspended for this NPC; their slot-token becomes event-zone-bound
+    ↓
+Event runs (animations, dialog, mini-game, hardstop-driven state-transitions)
+    ↓
+Event resolves (success / failure / abort); `slot_locked` verifier-flag cleared
+    ↓
+Lemniscate routing resumes; NPC continues their interrupted shift-task
+```
+
+**Animations don't loop.** The NPC commits to the slot for the event-duration; their state-machine knows it's slot-bound; animations target the slot-position rather than continuing toward the next rail-waypoint.
+
+**The local LLM speaks per-turn within the event.** Driver-context-pull (per [`./architecture.md`](./architecture.md) §Driver-context-pull) fires on the slot-bound NPC's turn; their dialog generates within the event-context; the wheel mini-game runs alongside.
+
+**Touch-and-fumble works.** Two participants slot-bound on a sofa can run animations + dialog + wheel mini-game + body-shader cosmetic feedback simultaneously, all anchored to the event-zone, all suspended-from-lemniscate-routing.
+
+This is the **NPC-stays-put fix at the data-model level** — no new mechanism, just a verifier-flag composition with the existing slot-token + lemniscate runtime.
+
+## Player editor-mode + three-source schema unification
+
+Some event-zones (designer-flagged at world-gen-init per [`../political-register/world-generation.md`](../political-register/world-generation.md) §L4 Cell ruleset) are **editor-eligible** — the player can knock out a piece of wall, open a cell, add cubes to extend the space.
+
+**The verb is "carve," not "build."** The slum/underground aesthetic (per [`../imperial-cult/cosmology.md`](../imperial-cult/cosmology.md) §The aesthetic palette — *rust as anti-marble, slum decay; the imperial substrate that has failed to stay clean*) carries through to the editor-verbs. Imperial-marble can't be carved; rusted slum-bedrock yields. **Even the editor-mode is politically-coded by material vocabulary.** Editor-eligibility is therefore *concentrated in slum-and-underground districts*; imperial districts are editor-locked.
+
+**Pre-flagged at world-gen, not runtime-emergent.** The choice between (a) designer-flag at world-gen vs (b) emergent-from-imperial-scrutiny is resolved as **(a) for the runtime LOD signal**: pre-flagged zones don't require runtime audit-overseer-presence checks; LOD-streamer reads static eligibility-flags; performance preserved; political-readability preserved (the slum's spatial politics IS its expandability).
+
+The verticality + simple-shapes + ±1 LOD discipline (per [`../topology-and-rendering/architecture.md`](../topology-and-rendering/architecture.md) §Vertical world topology, forthcoming) makes editor-mode cheap: stacked tunnels with simple primitive shapes mean adding a cube is voxel-grammar; no continuous-geometry math; no LOD-budget thrashing.
+
+**Three-source schema unification.** The cell-arch's atomicity (1×1×1m, one asset, container/wall-hook/debris) makes player-cell-addition trivial — discrete cubes, deterministic placement, same row-shape as world-gen-emitted cells. The architecture's existing **world-gen-as-init-function** key-move (per `architecture-index.md` — *"World-server and district-server generation emits canon-rows in the same schema as runtime; same primitive at design-time and runtime; no cold-start"*) extends to player-edit-time:
+
+| Origin | Writer | When |
+|---|---|---|
+| `world_gen_init` | Compositor-at-design-time (per `narrative-composition/architecture.md` §World-gen as init-function) | World-init; cascade L0 → L4 produces canon-rows |
+| `runtime_event` | Runtime events (hacking, install, demolition, imperial-construction) | Per-event; cell-state changes recorded |
+| `player_authored` | Player editor-mode | When player carves a new cell or fills an existing one |
+
+**Three writers, one schema.** The Memorialist counter-archive (per `architecture-index.md` §Memorialist-archive) reads player-authored cells as legible content; the Compositor includes them in district-canon back-writes; the GM's cell-checksum-divergence audit-vector (per `political-register/world-generation.md` §Open questions) gets a third source beyond hacking-divergences and world-gen-baseline — *player-authored-divergences*.
+
+**The architecture's "the machine funds its own subversion" key-move (per `architecture-index.md`) just got its spatial substrate.** Player-authoring is structurally legible to the world's audit-vectors; the cosmology's caste-stratified attention-gradient (per [`../imperial-cult/cosmology.md`](../imperial-cult/cosmology.md) §The composed wheel) produces structurally-uneven editor-coverage; resistance-as-spatial-authoring becomes part of the world's documented behavior.
+
+## Vertical-topology composition
+
+The world's outer-topology is **vertical-by-default** (per [`../topology-and-rendering/architecture.md`](../topology-and-rendering/architecture.md) §Vertical world topology, forthcoming): stacked tunnels with simple primitive shapes, ±1 LOD level streaming radius. This composes with event-zones as follows:
+
+- **Rail-graph traverses tunnel-stack vertically and horizontally.** Each tunnel-layer carries its own rail-segments; cross-layer rails (lift-shafts, stairs, drop-shafts) connect adjacent layers (±1 only).
+- **Room-boundary cell-layer is 3D.** A room has boundaries above and below as well as around; rails entering from a tunnel-above pass through the upper-boundary cells before reaching the room.
+- **Editor-mode is voxel-grammar in 3D.** Players carving in slum/underground can extend horizontally OR vertically; the voxel-substrate handles both naturally.
+- **Plazas are typically multi-tunnel-layer.** A grand plaza spans multiple vertical tunnel-layers; its boundary-zone wraps the full vertical extent; promotion to inner-zone is also vertical (proximity to the central stage's altitude).
+
+The Boullée-monumental-vertical aesthetic (per [`../imperial-cult/cosmology.md`](../imperial-cult/cosmology.md) §Source materials) gets its cheap engineering substrate — sublime scale via stacking, not via per-shape complexity. The architecture's existing topology primitives carry to the third dimension without modification.
+
+## Cross-references
+
+| Domain | Section | What this paper composes with |
+|---|---|---|
+| [`./architecture.md`](./architecture.md) | §Zone anatomy; §Slot-token + verifier-flag mechanism; §Gesture-alignment as recursive-lemniscate; §Emergent zones | The zone primitive; verifier-flags; the lemniscate runtime; emergent-zone substrate. Designer-authored event-zones extend the same primitive |
+| [`../imperial-cult/cosmology.md`](../imperial-cult/cosmology.md) | §The composed wheel | The wheel as universal mini-game-surface; iconographic substrate of the UI |
+| [`../style/consent-discipline.md`](../style/consent-discipline.md) | §The four hardstop-pattern variants; §The register-test | Variants 1-4 as event-class taxonomy; register-test as event-class-classifier |
+| [`../political-register/world-generation.md`](../political-register/world-generation.md) | §L3 Room ruleset; §L4 Cell ruleset; §Editor-mode pre-flagging (forthcoming) | Room-boundary cell-layer; cell-arch atomicity; editor-mode-eligibility flags |
+| [`../political-register/architecture.md`](../political-register/architecture.md) | §Lifeforce four-tier hierarchy; §Insolvency-spiral | Room-budget as district-shard; insolvency-spiral mechanical surface |
+| [`../topology-and-rendering/architecture.md`](../topology-and-rendering/architecture.md) | §Topology: rail + grid + interiors; §Vertical world topology (forthcoming) | Rail-graph passes through room-boundary; vertical-tunnels topology; ±1 LOD streaming |
+| [`../player-experience/architecture.md`](../player-experience/architecture.md) | §The trait-circle as gestural primary modality; §The wheel — composed-iconography UI (forthcoming) | Hardstops with contextual activation; wheel as cosmology iconography |
+| [`../identity-and-personhood/vocations.md`](../identity-and-personhood/vocations.md) | §Three primitives | Task-catalogue carries verifier-flag patterns + trait-affinity; tasks bind to event-zone eligible-task-classes |
+| [`../narrative-composition/architecture.md`](../narrative-composition/architecture.md) | §World-gen as init-function | Three-source schema unification (world-gen / runtime / player-edit) |
+
+## Open questions
+
+- **Lifeforce-budget calculation per room-size.** Linear in cell-count? Quadratic to favor compact spaces? Bounded to prevent player-editor-mode budget-exploitation? Likely *linear with a cap* — proportional to size up to a designer-tunable ceiling per district-tier; player-extensions beyond the ceiling extend space but don't grow budget.
+- **Slot-promotion specifics for boundary-zone-with-inner-zone.** Per-event-class promotion rules sketched in §Boundary-zone with inner-zone are first-pass; concrete rules need design-iteration. Particular open: how the imperial daily-narrative-broadcast handles citizens already in the inner-zone when a higher-priority broadcast fires (eject and re-promote? layered audience-state?).
+- **Emergent-zone spawn-suppression inside designer-authored event-zone cells.** Cleanest: emergent-zones simply don't spawn inside cells already part of designer-authored event-zones (data-model-suppressed). More flexible: emergent-zones can spawn but the runtime preferentially routes NPCs to typed event-zone slots when both are eligible. First reading is cleaner; second is more flexible. Lean *first* unless a use-case demands second.
+- **Verifier-flag pattern catalogue.** §The wheel — universal mini-game-surface above sketches 8 mini-game classes; the full catalogue (with each class's specific verifier-flag-pattern, trait-affinity, outcome-grammar, hardstop-set) needs design-iteration. Likely lives in `vocations.md` task-catalogue extension or a new `runtime-engine/mini-games-catalogue.md` sibling.
+- **Multi-agent event participant-list growth bounds.** Plaza-scale events can have hundreds of participants in the boundary zone; how does the participant-list scale on the event_register row? Probably *boundary-participants tracked as count* (not individual UIDs); only inner-zone participants tracked individually. Promotes to individual UID-tracking when promoted.
+- **Hardstop contextual-activation surface UI.** When the player is slot-bound and contextual-hardstops light up, *how does the player see them?* Probably wheel-rendered position-highlighting (the wheel's inner-ring slot for the relevant intent glows or animates); details pending player-experience paper-pass.
+- **Editor-mode cooldown and revert.** Player-authored cells: are they instantly persistent, or do they have a commit-cooldown (Variant 4 over Variant 1 — per consent-discipline)? Hunch: yes cooldown for *destructive* edits (knocking out a load-bearing wall); instant for *additive* edits (adding a cube to your hovel). Tunable per district-tier.
+- **Rail-passage signal granularity for the director.** Each NPC boundary-crossing is one signal-event; high-traffic rooms (cantinas at peak hours) could flood the director's signal-channel. Probably *aggregate to N-second windows* with overflow-flagging; details pending design-iteration.
+
+---
+
+**Version:** 0.1 | **Created:** 2026-04-27 | **Updated:** 2026-04-27

scale-and-transport/architecture.md

@@ -0,0 +1,158 @@
+# Scale and Transport
+
+> *Running the architecture at MMO size: compute-allocation budgets across model-tiers, horizontal-scale primitives (UID-keyed routing, stateless Compositors, ephemeral Director-routines, sharded GMs, pruning at every layer), pgnats-native transport with the JetStream republish + replay refinement, district-distribution fallback.*
+>
+> *Companion to: `architecture-index.md` (executive summary + global meta-lists), `narrative-composition/architecture.md` (Compositor is the load-bearing horizontal-scale actor), `inference-and-memory/architecture.md` (local-first memory architecture sits on this transport substrate). Sections in this file were split from the monolithic architecture-index.md v0.7 on 2026-04-26.*
+
+## Compute allocation
+
+- Active zones in 100-NPC city: ~5–15 with LLM-dialog slots
+- **Theia-tier (deep model)** — deep slots + tier-1 moments (few concurrent)
+- **Driver-tier (small model with trait-LoRAs)** — majority of dialog slots
+- **Saturn (small classifiers)** — voice-selection, trait-salience, audit-overseer classification, ternary-gate dynamics
+- **Director / overseer logic** — deterministic + small classifiers; no LLM for orchestration
+- **Claude-as-API (future)** — hivemind/imperium broadcast tier
+- **Outer rails** — graph-pathfinding, cheap, LOD-trivial
+- **Pipe / off-shift NPCs** — sparse simulation, event-driven scale-up
+- **Interior navmesh** — only currently-occupied interiors active
+- **Liminal / imperial-net rendering** — shader-preset swap, no geometry duplication
+
+## Horizontal scale architecture
+
+The architecture must scale to MMO size — many concurrent players across many districts, many concurrent events, many local LLMs firing at axis-rate. Vertically-scaled monolithic AI-NPC systems break under this load. **Nimmerworld is built horizontally-scalable from the ground up**, with the primitives that make horizontal scale work: UID-keyed routing, stateless workers, ephemeral actors per scope, sharded service mesh, pruning-on-completion at every layer.
+
+### UID-keyed routing as the load-bearing primitive
+
+Hierarchical UIDs (`gm_event_uid > district_uid > scene_sub_uid > slot_id`) carry enough information for *any* worker to pick up *any* unit of work without shared in-memory state. UID-as-routing-key is what lets every layer scale independently.
+
+This is the same primitive that Cassandra/DynamoDB/etc. built around (partition keys); we re-derive it for narrative composition because the underlying constraint is the same — many concurrent actors operating on private state with cross-actor coordination via typed events at known boundaries.
+
+### Compositors on demand
+
+Compositor instances are **stateless workers**. Any compositor can pick up any `event_uid` from the transient-waiting-flag — state lives in phoebe + per-player SQLites; workers are pure functions of `(event_uid → composition)`. Spin up more on queue-depth; spin down on drain. This is the autoscaling-worker pattern (Celery / Lambda / Sidekiq) applied to narrative.
+
+### Directors as ephemeral routines per UID
+
+Each event / event-chain spawns a **director-routine** scoped to that UID. The routine lives only as long as the event lives in the active-register; on completion it prunes. This is the actor model (Erlang / Akka / Orleans) — supervised lightweight processes, thousands concurrent, failure-recovery via supervisor respawn from register-state.
+
+### Sharded GMs
+
+A single GM is a scalability bottleneck. Multi-GM shards across:
+
+- **Geography** — GM-per-region/continent/world-zone
+- **Theme** — political-narratives / economic-narratives / personal-narratives
+- **Tier** — major-arcs vs everyday-events
+- **Faction** — each major faction has its own GM-shard
+
+GM-shards share the catalogue, the trait-axis vocabulary, the verifier-flag system. They communicate via NATS pub/sub at GM-tier. *Equilibrium-seeking becomes a distributed consensus across GM-shards* — the same epistemological shift that distributed databases went through (CAP theorem, eventual consistency, partition tolerance).
+
+This is the most architecturally aggressive move and is *not* a free lunch. Multi-GM consensus on equilibrium is real engineering: Paxos/Raft for strong consistency; CRDT-style for eventual; faction-sharding so shards own different equilibria. Well-trodden ground; cost not zero.
+
+### Pruning as cleanup
+
+Each layer prunes on completion: directors prune at event-end, register entries prune on Compositor pickup, transient-waiting-flag drains at cycle, even player memory prunes by class. **Garbage collection is a first-class structural concern**, not an afterthought. Most "smart NPC" prototypes accumulate state forever; at MMO scale that becomes unrunnable in months.
+
+### Transport — pgnats native, with district-distribution fallback
+
+The Compositor's forward-prop and back-write traffic — and the canon distribution to participants — is the highest-volume path in the system. Two transport options exist.
+
+**Option A — pgnats native serialization (preferred):**
+
+```
+COMPOSITOR (writes SQL into phoebe)
+   │ pgnats: SQL INSERT/UPDATE → NATS subject publish, automatic, transactional
+   │ subject hierarchy mirrors UID hierarchy:
+   │   nimmerverse.events.<gm_event_uid>.district.<district_uid>.scene.<scene_uid>
+   ▼
+NATS JetStream (durable, replay-capable, at-least-once)
+   │ subscribers route by subject pattern (wildcards supported)
+   ▼
+PLAYER CLIENT (NATS subscriber)
+   │ receives row-shaped messages, INSERT into local SQLite under matching event_uid
+```
+
+**Why preferred:** transactional-outbox pattern *native to the database* — no separate publisher service, no schema-duplication between wire format and storage format, single source of truth. Subject-as-routing using UID hierarchy means players who participated in `gm_event` 7af2 → `district` 9c1 → `scene` 3e8 subscribe to `nimmerverse.events.7af2.>` and receive *only* relevant events. *No application-level routing logic.*
+
+**Option B — district-as-distribution-coordinator (fallback):**
+
+```
+COMPOSITOR writes to phoebe (canon authored)
+   ▼
+DISTRICT GAMESERVER pulls / receives back-write package
+   │ runs distribution checks: who participated, who's online, who needs queue-on-login
+   │ retries; peer-shares with neighboring districts if needed
+   ▼
+PARTICIPANTS receive from their district (the authoritative local hub)
+```
+
+**Why fallback:** if pgnats can't carry the load (functional bug, scale ceiling, durability gap), district-as-distribution is the natural retreat — district is authoritative within its scope, simpler than full P2P, more flexible than central-push.
+
+**The asymmetry of the bet:**
+
+| | pgnats works | pgnats fails |
+|---|---|---|
+| Code volume | Few hundred lines of SQL + subject patterns | ~10–20K lines of broker/outbox/subscriber logic |
+| Services to operate | phoebe + NATS (already in stack) | + outbox-reader + custom-publisher + custom-applier |
+| Schema management | Single source (Postgres DDL) | Postgres + Protobuf/msgpack + version-skew handling |
+| Latency to client | Sub-millisecond NATS hop + apply | + serialize step + queue drain + apply |
+| Time to ship | Weeks | Months |
+
+**This is the most leveraged engineering decision in the architecture currently open.** The pgnats evaluation task in `nimmerverse_tasks` (under `nimmerverse-core`) is therefore load-bearing; its outcome decides whether transport is 200 lines of SQL or 20,000 lines of Go.
+
+### NATS republish + replay — the pull-from-checkpoint refinement
+
+JetStream's `republish` feature combined with `replay` semantics is a **promising refinement on top of Option A** that turns back-write delivery from push-to-listeners into pull-from-checkpoint. Worth nailing down concretely in the pgnats evaluation; if it carries our delivery patterns under load, it is a significant performance and complexity multiplier.
+
+**How it works:**
+
+- Compositor publishes canon ONCE to the event-keyed subject (e.g., `nimmerverse.events.<gm_event_uid>.scene.<sub_uid>`)
+- A `republish` rule on the JetStream stream fans the message out to derived subjects automatically (per-participant, per-faction, per-district — any derived stream-shape we configure)
+- Each derived subject has durable JetStream consumers per recipient; recipients replay from their own checkpoint (last-delivered-sequence) when they reconnect
+
+**Why it's faster and simpler:**
+
+- **Compositor never tracks recipients.** Publishes once; NATS republishes to N derived subjects per the configured rule. No application-level fan-out logic; no "for each participant, if online deliver else queue" code-path.
+- **Player connectivity is decoupled from delivery.** Offline players don't slow down the publish path; their queue accumulates in JetStream. On reconnect, they replay from checkpoint.
+- **Late joiners catch up for free.** New consumer subscribes with replay-from-sequence; gets full history relevant to their subject. No special reconcile code-path.
+- **Backpressure is built in.** Slow consumer's queue grows in JetStream — doesn't affect publishers or other consumers. Flow-control, ack-policy, max-bytes/max-msgs limits all native to JetStream.
+- **Re-keying is a config change.** Add a new republish rule for a new derived stream-shape (e.g., per-faction canon-feed); no application code changes for the new consumer-tier.
+- **Replay = audit-trail for free.** Replay from sequence 0 reconstructs entire canon history. Disaster recovery, debugging, time-travel queries are all free side-effects.
+
+**Architectural effect:**
+
+```
+Compositor → publishes canon to event_uid subject (ONCE)
+   │
+   ▼  (JetStream republish-rule fan-out — config, not code)
+Per-player subjects:    nimmerverse.player.<id>.canon
+Per-faction subjects:   nimmerverse.faction.<name>.canon
+Per-district subjects:  nimmerverse.district.<id>.canon
+   │
+   ▼
+Each consumer replays from its own checkpoint when ready
+```
+
+Compositor's mental model collapses to *"I publish to the canonical event-stream and forget"*; recipient-mental-model collapses to *"I replay my own consumer-subject from my last sequence"*. **The delivery problem disappears into NATS.**
+
+**Specific evaluation criteria** (to add to the pgnats evaluation task):
+
+- Republish rule expressiveness — can we route by UID hierarchy (`events.<gm_uid>.>` → `player.<participant_id>.canon`)?
+- Replay performance — what's the cost of a consumer replaying N hours of missed canon on reconnect?
+- Durability under broker failure — does the republish-derived subject survive primary-broker loss?
+- Schema-evolution behavior — can we add new derived subjects without disrupting existing consumers?
+- Cost at scale — disk, memory, file-handles for many durable consumers (one-per-active-player)?
+
+If `republish + replay` carries the load, the back-write transport is *substantially* simpler than the original Option A description and a much harder competitor to beat with Option B.
+
+### What this retires
+
+- Vertically-scaled monolithic AI-NPC backend → horizontally-scaled stateless-workers + ephemeral-actors + sharded-services
+- Centralized in-memory event-state → UID-keyed registers + transient-waiting-flag buffer
+- Single global GM as bottleneck → sharded GMs with cross-shard equilibrium-consensus
+- Manual outbox-reader services → pgnats native serialization (preferred); district-distribution fallback if pgnats can't carry
+- "AI-NPC scale" framed as inference budget alone → AI-NPC scale framed as transport + state + composition + sharding, with inference as one of many concurrently-scaling axes
+
+
+---
+
+**Version:** 0.7.0 | **Created:** 2026-04-26 | **Updated:** 2026-04-26 | **Origin:** Split from architecture-index.md v0.7 (2026-04-26)

scale-and-transport/message-arch-overview.drawio

@@ -0,0 +1,115 @@
+<mxfile host="Electron">
+  <diagram name="Page-1" id="oPXlo6H9sqyo0r8q1fhO">
+    <mxGraphModel dx="3784" dy="2933" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="850" pageHeight="1100" math="0" shadow="0">
+      <root>
+        <mxCell id="0" />
+        <mxCell id="1" parent="0" />
+        <mxCell id="aIeLCH8qUmqrU1Dd2BIR-26" parent="1" style="ellipse;whiteSpace=wrap;html=1;aspect=fixed;fillColor=none;strokeWidth=5;strokeColor=#66FF66;" value="" vertex="1">
+          <mxGeometry height="1000" width="1000" x="-500" y="40" as="geometry" />
+        </mxCell>
+        <mxCell id="aIeLCH8qUmqrU1Dd2BIR-5" parent="1" style="ellipse;whiteSpace=wrap;html=1;aspect=fixed;fillColor=none;strokeWidth=5;strokeColor=#FF0000;" value="" vertex="1">
+          <mxGeometry height="300" width="300" x="-600" y="320" as="geometry" />
+        </mxCell>
+        <mxCell id="aIeLCH8qUmqrU1Dd2BIR-7" parent="1" style="ellipse;whiteSpace=wrap;html=1;aspect=fixed;fillColor=none;strokeWidth=5;strokeColor=#CC6600;" value="" vertex="1">
+          <mxGeometry height="300" width="300" x="290" y="320" as="geometry" />
+        </mxCell>
+        <mxCell id="aIeLCH8qUmqrU1Dd2BIR-19" parent="1" style="ellipse;whiteSpace=wrap;html=1;fillColor=none;strokeWidth=3;strokeColor=#7F00FF;" value="" vertex="1">
+          <mxGeometry height="280" width="400" x="-200" y="40" as="geometry" />
+        </mxCell>
+        <mxCell id="aIeLCH8qUmqrU1Dd2BIR-25" parent="1" style="shape=cylinder3;whiteSpace=wrap;html=1;boundedLbl=1;backgroundOutline=1;size=15;fillColor=none;strokeColor=light-dark(#000000,#7F00FF);strokeWidth=3;" value="" vertex="1">
+          <mxGeometry height="80" width="60" x="-30" y="280" as="geometry" />
+        </mxCell>
+        <mxCell id="aIeLCH8qUmqrU1Dd2BIR-28" parent="1" style="swimlane;fontStyle=0;childLayout=stackLayout;horizontal=1;startSize=30;horizontalStack=0;resizeParent=1;resizeParentMax=0;resizeLast=0;collapsible=1;marginBottom=0;whiteSpace=wrap;html=1;strokeColor=light-dark(#FF66FF,#FFFF66);" value="Compositor-Agents" vertex="1">
+          <mxGeometry height="309.98" width="140" x="-70" y="-80" as="geometry" />
+        </mxCell>
+        <mxCell id="aIeLCH8qUmqrU1Dd2BIR-27" parent="aIeLCH8qUmqrU1Dd2BIR-28" style="ellipse;whiteSpace=wrap;html=1;aspect=fixed;fillColor=none;strokeWidth=5;strokeColor=light-dark(#FF66FF,#FFFF66);fontColor=light-dark(#000000,#FFFF33);" value="" vertex="1">
+          <mxGeometry height="189.98" width="140" y="30" as="geometry" />
+        </mxCell>
+        <mxCell id="aIeLCH8qUmqrU1Dd2BIR-29" parent="aIeLCH8qUmqrU1Dd2BIR-28" style="text;strokeColor=none;fillColor=none;align=left;verticalAlign=middle;spacingLeft=4;spacingRight=4;overflow=hidden;points=[[0,0.5],[1,0.5]];portConstraint=eastwest;rotatable=0;whiteSpace=wrap;html=1;" value="&lt;font style=&quot;color: rgb(102, 255, 102);&quot;&gt;nimmerverse&lt;/font&gt;.memory." vertex="1">
+          <mxGeometry height="30" width="140" y="219.98" as="geometry" />
+        </mxCell>
+        <mxCell id="aIeLCH8qUmqrU1Dd2BIR-30" parent="aIeLCH8qUmqrU1Dd2BIR-28" style="text;strokeColor=none;fillColor=none;align=left;verticalAlign=middle;spacingLeft=4;spacingRight=4;overflow=hidden;points=[[0,0.5],[1,0.5]];portConstraint=eastwest;rotatable=0;whiteSpace=wrap;html=1;" value="&lt;font style=&quot;color: rgb(102, 255, 102);&quot;&gt;nimmerverse&lt;/font&gt;.&lt;font style=&quot;color: light-dark(rgb(255, 153, 255), rgb(255, 93, 255));&quot;&gt;district&lt;/font&gt;." vertex="1">
+          <mxGeometry height="30" width="140" y="249.98" as="geometry" />
+        </mxCell>
+        <mxCell id="aIeLCH8qUmqrU1Dd2BIR-31" parent="aIeLCH8qUmqrU1Dd2BIR-28" style="text;strokeColor=none;fillColor=none;align=left;verticalAlign=middle;spacingLeft=4;spacingRight=4;overflow=hidden;points=[[0,0.5],[1,0.5]];portConstraint=eastwest;rotatable=0;whiteSpace=wrap;html=1;" value="&lt;font style=&quot;color: rgb(102, 255, 102);&quot;&gt;nimmerverse&lt;/font&gt;.world" vertex="1">
+          <mxGeometry height="30" width="140" y="279.98" as="geometry" />
+        </mxCell>
+        <mxCell id="aIeLCH8qUmqrU1Dd2BIR-32" parent="1" style="text;html=1;whiteSpace=wrap;strokeColor=none;fillColor=none;align=center;verticalAlign=middle;rounded=0;" value="&lt;b&gt;postgresl&lt;/b&gt;&lt;div&gt;&lt;b&gt;phoebe-dev&lt;/b&gt;&lt;/div&gt;" vertex="1">
+          <mxGeometry height="30" width="80" x="-40" y="360" as="geometry" />
+        </mxCell>
+        <mxCell id="aIeLCH8qUmqrU1Dd2BIR-33" parent="1" style="text;html=1;whiteSpace=wrap;strokeColor=none;fillColor=none;align=center;verticalAlign=middle;rounded=0;fontColor=#ffffff;" value="pgnats" vertex="1">
+          <mxGeometry height="30" width="60" x="-30" y="320" as="geometry" />
+        </mxCell>
+        <mxCell id="aIeLCH8qUmqrU1Dd2BIR-34" parent="1" style="ellipse;whiteSpace=wrap;html=1;aspect=fixed;strokeWidth=2;dashed=1;strokeColor=#FF0000;" value="Overseer" vertex="1">
+          <mxGeometry height="80" width="80" x="-235" y="720" as="geometry" />
+        </mxCell>
+        <mxCell id="aIeLCH8qUmqrU1Dd2BIR-36" parent="1" style="ellipse;whiteSpace=wrap;html=1;aspect=fixed;strokeWidth=2;dashed=1;fillColor=none;strokeColor=#FF8000;" value="Director" vertex="1">
+          <mxGeometry height="80" width="80" x="-165" y="720" as="geometry" />
+        </mxCell>
+        <mxCell id="aIeLCH8qUmqrU1Dd2BIR-35" parent="1" style="rhombus;whiteSpace=wrap;html=1;fillColor=default;dashed=1;strokeColor=#FF33FF;dashPattern=1 4;" value="District" vertex="1">
+          <mxGeometry height="80" width="80" x="-195" y="680" as="geometry" />
+        </mxCell>
+        <mxCell id="aIeLCH8qUmqrU1Dd2BIR-37" parent="1" style="ellipse;whiteSpace=wrap;html=1;aspect=fixed;strokeWidth=2;dashed=1;strokeColor=#FF0000;" value="Overseer" vertex="1">
+          <mxGeometry height="80" width="80" x="-75" y="720" as="geometry" />
+        </mxCell>
+        <mxCell id="aIeLCH8qUmqrU1Dd2BIR-38" parent="1" style="ellipse;whiteSpace=wrap;html=1;aspect=fixed;strokeWidth=2;dashed=1;fillColor=none;strokeColor=#FF8000;" value="Director" vertex="1">
+          <mxGeometry height="80" width="80" x="-5" y="720" as="geometry" />
+        </mxCell>
+        <mxCell id="aIeLCH8qUmqrU1Dd2BIR-39" parent="1" style="rhombus;whiteSpace=wrap;html=1;fillColor=default;dashed=1;strokeColor=#FF33FF;dashPattern=1 4;" value="District" vertex="1">
+          <mxGeometry height="80" width="80" x="-35" y="680" as="geometry" />
+        </mxCell>
+        <mxCell id="aIeLCH8qUmqrU1Dd2BIR-40" parent="1" style="ellipse;whiteSpace=wrap;html=1;aspect=fixed;strokeWidth=2;dashed=1;strokeColor=#FF0000;" value="Overseer" vertex="1">
+          <mxGeometry height="80" width="80" x="85" y="720" as="geometry" />
+        </mxCell>
+        <mxCell id="aIeLCH8qUmqrU1Dd2BIR-41" parent="1" style="ellipse;whiteSpace=wrap;html=1;aspect=fixed;strokeWidth=2;dashed=1;fillColor=none;strokeColor=#FF8000;" value="Director" vertex="1">
+          <mxGeometry height="80" width="80" x="155" y="720" as="geometry" />
+        </mxCell>
+        <mxCell id="aIeLCH8qUmqrU1Dd2BIR-42" parent="1" style="rhombus;whiteSpace=wrap;html=1;fillColor=default;dashed=1;strokeColor=#FF33FF;dashPattern=1 4;" value="District" vertex="1">
+          <mxGeometry height="80" width="80" x="125" y="680" as="geometry" />
+        </mxCell>
+        <mxCell id="aIeLCH8qUmqrU1Dd2BIR-43" parent="1" style="ellipse;whiteSpace=wrap;html=1;aspect=fixed;strokeWidth=2;dashed=1;strokeColor=#FF0000;" value="Overseer" vertex="1">
+          <mxGeometry height="80" width="80" x="245" y="720" as="geometry" />
+        </mxCell>
+        <mxCell id="aIeLCH8qUmqrU1Dd2BIR-44" parent="1" style="ellipse;whiteSpace=wrap;html=1;aspect=fixed;strokeWidth=2;dashed=1;fillColor=none;strokeColor=#FF8000;" value="Director" vertex="1">
+          <mxGeometry height="80" width="80" x="315" y="720" as="geometry" />
+        </mxCell>
+        <mxCell id="aIeLCH8qUmqrU1Dd2BIR-45" parent="1" style="rhombus;whiteSpace=wrap;html=1;fillColor=default;dashed=1;strokeColor=#FF33FF;dashPattern=1 4;" value="District" vertex="1">
+          <mxGeometry height="80" width="80" x="285" y="680" as="geometry" />
+        </mxCell>
+        <mxCell id="aIeLCH8qUmqrU1Dd2BIR-46" parent="1" style="ellipse;whiteSpace=wrap;html=1;aspect=fixed;strokeWidth=2;dashed=1;strokeColor=#FF0000;" value="Overseer" vertex="1">
+          <mxGeometry height="80" width="80" x="-395" y="720" as="geometry" />
+        </mxCell>
+        <mxCell id="aIeLCH8qUmqrU1Dd2BIR-47" parent="1" style="ellipse;whiteSpace=wrap;html=1;aspect=fixed;strokeWidth=2;dashed=1;fillColor=none;strokeColor=#FF8000;" value="Director" vertex="1">
+          <mxGeometry height="80" width="80" x="-325" y="720" as="geometry" />
+        </mxCell>
+        <mxCell id="aIeLCH8qUmqrU1Dd2BIR-48" parent="1" style="rhombus;whiteSpace=wrap;html=1;fillColor=default;dashed=1;strokeColor=#FF33FF;dashPattern=1 4;" value="District" vertex="1">
+          <mxGeometry height="80" width="80" x="-355" y="680" as="geometry" />
+        </mxCell>
+        <mxCell id="aIeLCH8qUmqrU1Dd2BIR-50" parent="1" style="ellipse;whiteSpace=wrap;html=1;fillColor=none;strokeColor=#66FF66;strokeWidth=3;" value="" vertex="1">
+          <mxGeometry height="80" width="915" x="-457.5" y="780" as="geometry" />
+        </mxCell>
+        <mxCell id="aIeLCH8qUmqrU1Dd2BIR-51" parent="1" style="text;html=1;whiteSpace=wrap;strokeColor=none;fillColor=none;align=center;verticalAlign=middle;rounded=0;" value="&lt;div&gt;&lt;font style=&quot;color: rgb(102, 255, 102);&quot;&gt;&lt;b&gt;nimmerverse&lt;/b&gt;&lt;/font&gt;&lt;/div&gt;" vertex="1">
+          <mxGeometry height="60" width="120" x="-60" y="990" as="geometry" />
+        </mxCell>
+        <mxCell id="aIeLCH8qUmqrU1Dd2BIR-52" parent="1" style="text;html=1;whiteSpace=wrap;strokeColor=none;fillColor=none;align=center;verticalAlign=middle;rounded=0;" value="&lt;font style=&quot;color: rgb(255, 0, 0);&quot;&gt;&lt;b&gt;Hivemind&lt;/b&gt;&lt;/font&gt;" vertex="1">
+          <mxGeometry height="30" width="60" x="-480" y="455" as="geometry" />
+        </mxCell>
+        <mxCell id="aIeLCH8qUmqrU1Dd2BIR-53" parent="1" style="text;html=1;whiteSpace=wrap;strokeColor=none;fillColor=none;align=center;verticalAlign=middle;rounded=0;" value="&lt;font style=&quot;color: rgb(255, 153, 51);&quot;&gt;&lt;b&gt;GameMaster&lt;/b&gt;&lt;/font&gt;" vertex="1">
+          <mxGeometry height="30" width="60" x="395" y="455" as="geometry" />
+        </mxCell>
+        <mxCell id="aIeLCH8qUmqrU1Dd2BIR-56" parent="1" style="text;html=1;whiteSpace=wrap;strokeColor=default;fillColor=none;align=center;verticalAlign=middle;rounded=0;dashed=1;strokeWidth=2;" value="&lt;div&gt;Corresponding to there colour&lt;/div&gt;Dashed line for downstream&lt;div&gt;Dotted line for upstream&lt;/div&gt;" vertex="1">
+          <mxGeometry height="100" width="220" x="-110" y="500" as="geometry" />
+        </mxCell>
+        <mxCell id="aIeLCH8qUmqrU1Dd2BIR-68" parent="1" style="text;whiteSpace=wrap;html=1;align=center;" value="&lt;div style=&quot;forced-color-adjust: none; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; background-color: rgb(27, 29, 30); text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial; box-shadow: none !important;&quot;&gt;&lt;font style=&quot;forced-color-adjust: none; box-shadow: none !important;&quot;&gt;&lt;b style=&quot;forced-color-adjust: none; box-shadow: none !important;&quot;&gt;&lt;font style=&quot;color: rgb(153, 255, 153);&quot;&gt;nimmerverse.&lt;/font&gt;&lt;font color=&quot;#ff33ff&quot;&gt;district.&lt;/font&gt;&lt;/b&gt;&lt;/font&gt;&lt;/div&gt;" vertex="1">
+          <mxGeometry height="50" width="145" x="-72.5" y="830" as="geometry" />
+        </mxCell>
+        <mxCell id="aIeLCH8qUmqrU1Dd2BIR-70" parent="1" style="text;html=1;whiteSpace=wrap;strokeColor=none;fillColor=none;align=center;verticalAlign=middle;rounded=0;" value="&lt;br&gt;&lt;div&gt;&lt;font&gt;&lt;b style=&quot;&quot;&gt;&lt;font style=&quot;color: rgb(153, 255, 153);&quot;&gt;nimmerverse.&lt;/font&gt;&lt;font color=&quot;#ff0000&quot;&gt;hivemind.&lt;/font&gt;&lt;/b&gt;&lt;/font&gt;&lt;/div&gt;" vertex="1">
+          <mxGeometry height="60" width="150" x="-490" y="450" as="geometry" />
+        </mxCell>
+        <mxCell id="aIeLCH8qUmqrU1Dd2BIR-71" parent="1" style="text;html=1;whiteSpace=wrap;strokeColor=none;fillColor=none;align=center;verticalAlign=middle;rounded=0;" value="&lt;div&gt;&lt;font&gt;&lt;b style=&quot;&quot;&gt;&lt;font style=&quot;color: rgb(153, 255, 153);&quot;&gt;nimmerverse.&lt;/font&gt;&lt;font color=&quot;#ff8000&quot;&gt;gm.&lt;/font&gt;&lt;/b&gt;&lt;/font&gt;&lt;/div&gt;" vertex="1">
+          <mxGeometry height="60" width="160" x="340" y="455" as="geometry" />
+        </mxCell>
+      </root>
+    </mxGraphModel>
+  </diagram>
+</mxfile>

schemas/findings.md

@@ -0,0 +1,935 @@
+# Nimmerworld Architecture — Schema Findings & Hypothesis
+
+> *Hypothesis-notes, not carved migration spec. Working-out-loud in DDL register.*
+> *dafit + chrysalis — initial sketch 2026-04-24 afternoon; v0.2 evening; v0.3 late-evening / early 2026-04-25 absorbing architecture-index v0.4.*
+
+---
+
+## Status
+
+This document is **findings**, not a committed migration plan. DDL sketches exist to surface worries, explore tradeoffs, and prepare for a formal `nimmerverse-core/migrations/00X_nimmerworld_v1.sql` spec once the open forks resolve.
+
+**Companion to**: [`architecture-index.md`](architecture-index.md) v0.4, which captures the full ontology these schemas serve.
+
+**Why DDL register**: prose architecture lets us say *"zones are slot-indexed event-instances"* and feel like we've said something. DDL forces us to name a row size, an index strategy, a commit boundary, a failure mode. This document is a worry-audit in executable form.
+
+---
+
+## 1. Zones (dafit's original sketch, annotated)
+
+Original sketch from 2026-04-24 afternoon:
+
+```sql
+CREATE TABLE zones (
+    zone_id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    lifecycle TEXT NOT NULL DEFAULT 'emergent',  -- emergent, active, dissolving
+
+    slot_count INT DEFAULT 5,
+    persistence_flag BOOLEAN DEFAULT false,
+
+    -- Hot data < 2KB to avoid TOAST performance hits
+    data JSONB NOT NULL,
+
+    -- Generated column for NATS routing
+    nats_subject TEXT GENERATED ALWAYS AS (
+        'zones.' || lifecycle || '.' || (data->>'trait_filter')
+    ) STORED
+);
+
+ALTER TABLE zones ADD CONSTRAINT check_zone_integrity
+CHECK (data ? 'director' AND data ? 'slots' AND data ? 'memory_context');
+
+CREATE INDEX idx_zone_traits ON zones USING GIN (data jsonb_path_ops);
+CREATE INDEX idx_active_directors ON zones ((data->>'director'))
+WHERE (lifecycle = 'active');
+```
+
+### v0.4 additions (register-tagging + signal-causation)
+
+```sql
+ALTER TABLE zones ADD COLUMN register TEXT NOT NULL DEFAULT 'physical'
+    CHECK (register IN ('physical','liminal','imperial'));
+ALTER TABLE zones ADD COLUMN anchor_district UUID;
+ALTER TABLE zones ADD COLUMN anchor_cell     UUID;
+ALTER TABLE zones ADD COLUMN spawned_by_signal UUID;  -- emergent-signal that caused this spawn
+```
+
+NATS subject hierarchy refined:
+
+```
+zones.<lifecycle>.<register>.<district_id>.<zone_type>.<trait_filter>
+```
+
+e.g., `zones.active.physical.district_7.brawl.dikaiosyne_low`
+
+### Three open forks
+
+**Fork 1.1** — one jsonb vs. two-table split (MVCC concern). Leaning split: `zones` (small, structural, high-churn cols) + `zone_state` (jsonb, referenced, updated rarely).
+
+**Fork 1.2** — pg_notify vs. WAL logical decoding. Leaning WAL via pgnats. `pg_notify` fallback only.
+
+**Fork 1.3** — slot occupancy nested vs. relational. **Leaning relational** (sketch in Section 1.4).
+
+### 1.4 zone_slot_occupancy (relational resolution of Fork 1.3)
+
+```sql
+CREATE TABLE zone_slot_occupancy (
+    zone_id        UUID NOT NULL REFERENCES zones(zone_id),
+    slot_index     INT NOT NULL,
+    npc_id         UUID NOT NULL REFERENCES npcs(npc_id),
+    slot_type      TEXT,  -- 'dialog', 'fighter', 'spectator', 'sofa', 'kitchen', etc.
+    occupied_at    TIMESTAMPTZ NOT NULL DEFAULT now(),
+    current_turn   BOOLEAN DEFAULT false,
+    PRIMARY KEY (zone_id, slot_index)
+);
+
+CREATE INDEX idx_occupancy_npc ON zone_slot_occupancy (npc_id);
+```
+
+---
+
+## 2. NPCs — shift state + body/layer/lifeforce/trait-vector columns
+
+Shift-based temporal decomposition (architecture-index v0.4 §"Labor-cycle architecture"). Shift fields live on the NPC row, overwritten daily by the district director.
+
+```sql
+-- Shift state
+ALTER TABLE npcs ADD COLUMN current_shift_id          UUID;
+ALTER TABLE npcs ADD COLUMN current_shift_cycle_day   INT;
+ALTER TABLE npcs ADD COLUMN current_shift_phase       TEXT;
+ALTER TABLE npcs ADD COLUMN current_shift_start_tick  BIGINT;
+ALTER TABLE npcs ADD COLUMN current_shift_end_tick    BIGINT;
+ALTER TABLE npcs ADD COLUMN current_shift_vocation    TEXT;
+ALTER TABLE npcs ADD COLUMN current_shift_anchor_cell UUID;
+ALTER TABLE npcs ADD COLUMN current_shift_anchor_zone TEXT;
+ALTER TABLE npcs ADD COLUMN current_shift_faction_ref UUID;
+ALTER TABLE npcs ADD COLUMN current_shift_status      TEXT NOT NULL DEFAULT 'scheduled'
+    CHECK (current_shift_status IN ('scheduled','active','completed','preempted','deviant'));
+
+-- v0.4: trait-vector split (intrinsic vs. expressed)
+ALTER TABLE npcs ADD COLUMN intrinsic_trait_vector  REAL[] NOT NULL;  -- who you actually are
+ALTER TABLE npcs ADD COLUMN expressed_trait_vector  REAL[] NOT NULL;  -- intrinsic + worn-mod contributions
+
+-- Body / layer / lifeforce
+ALTER TABLE npcs ADD COLUMN inner_body_projection JSONB;     -- trait-derived body params
+ALTER TABLE npcs ADD COLUMN trait_color_signature JSONB;     -- derived from trait_vector via trait_colors
+ALTER TABLE npcs ADD COLUMN net_access_gate       REAL CHECK (net_access_gate BETWEEN -1 AND 1) DEFAULT -1;
+ALTER TABLE npcs ADD COLUMN net_access_discrete   TEXT CHECK (net_access_discrete IN ('closed','stable','open')) DEFAULT 'closed';
+ALTER TABLE npcs ADD COLUMN per_npc_lifeforce     REAL NOT NULL DEFAULT 1.0;
+
+-- Indexes
+CREATE INDEX idx_npc_shift_active_cell
+    ON npcs (current_shift_anchor_cell, current_shift_anchor_zone)
+    WHERE current_shift_status = 'active';
+CREATE INDEX idx_npc_shift_current ON npcs (npc_id, current_shift_cycle_day);
+```
+
+The intrinsic/expressed split is critical: the regime reads expressed; the simulation arithmetic reads intrinsic; clasp-partners in liminal read intrinsic; Aletheia-vision pierces expressed to intrinsic.
+
+---
+
+## 3. shift_history — append-only archive
+
+```sql
+CREATE TABLE shift_history (
+    shift_id         UUID PRIMARY KEY,
+    npc_id           UUID NOT NULL REFERENCES npcs(npc_id),
+    cycle_day        INT NOT NULL,
+    phase            TEXT NOT NULL,
+    start_tick       BIGINT NOT NULL,
+    end_tick         BIGINT NOT NULL,
+    vocation         TEXT NOT NULL,
+    anchor_cell_id   UUID,
+    anchor_zone_type TEXT,
+    faction_ref      UUID,
+    status           TEXT NOT NULL,
+    outcome          JSONB NOT NULL,
+    archived_at      TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX idx_shift_history_npc_day ON shift_history (npc_id, cycle_day DESC);
+CREATE INDEX idx_shift_history_district_day ON shift_history (anchor_cell_id, cycle_day DESC);
+CREATE INDEX idx_shift_history_deviant ON shift_history (anchor_cell_id, status)
+    WHERE status IN ('preempted', 'deviant');
+```
+
+---
+
+## 4. emergent_signals — zone-emitted relational transitions
+
+```sql
+CREATE TABLE emergent_signals (
+    signal_id          UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    source_zone_id     UUID NOT NULL REFERENCES zones(zone_id),
+    district_id        UUID NOT NULL,
+    signal_type        TEXT NOT NULL,
+    participants       UUID[] NOT NULL,
+    intensity          REAL NOT NULL CHECK (intensity BETWEEN 0 AND 1),
+    gate_state         REAL NOT NULL CHECK (gate_state BETWEEN -1 AND 1),
+    gate_transition    TEXT NOT NULL CHECK (gate_transition IN
+        ('stable_to_open','stable_to_closed','open_to_stable','closed_to_stable')),
+    composition        JSONB NOT NULL,
+    emitted_at         TIMESTAMPTZ NOT NULL DEFAULT now(),
+    expires_at         TIMESTAMPTZ NOT NULL,
+
+    -- Mandatory disposition
+    disposition        TEXT CHECK (disposition IN ('acked','deferred','dropped','expired')),
+    disposition_reason TEXT,
+    consumed_by_zone   UUID REFERENCES zones(zone_id),
+    disposed_at        TIMESTAMPTZ,
+    outcome            JSONB
+);
+
+CREATE INDEX idx_signals_live_by_district ON emergent_signals (district_id, emitted_at)
+    WHERE disposition IS NULL;
+CREATE INDEX idx_signals_participants ON emergent_signals USING GIN (participants);
+CREATE INDEX idx_signals_training ON emergent_signals (signal_type, disposition, disposed_at DESC);
+```
+
+Notice `disposition` is mandatory at resolution. Silence-discards are bugs; audit-trails are features.
+
+---
+
+## 5. district_reports — per-cycle aggregates with double-ledger
+
+```sql
+CREATE TABLE district_reports (
+    report_id                UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    district_id              UUID NOT NULL,
+    cycle_tick               BIGINT NOT NULL,
+    reported_at              TIMESTAMPTZ NOT NULL DEFAULT now(),
+
+    -- v0.4 DOUBLE LEDGER (the politically load-bearing distinction)
+    lifeforce_reported       REAL NOT NULL,  -- what GM/imperium see
+    lifeforce_actual         REAL NOT NULL,  -- the true value (Memorialist-trackable)
+    lifeforce_delta          REAL NOT NULL,
+    -- gap = corruption-extraction over time
+
+    population_count         INT NOT NULL,
+    aggregate_happiness      REAL,
+    aggregate_need_state     JSONB,
+    aggregate_limb_state     JSONB,
+    mind_turnover_in         INT,
+    mind_turnover_out        INT,
+    decision_budget_used_pct REAL,
+
+    labor_available          JSONB,
+    resources_on_hand        JSONB,
+    space_utilization        JSONB,
+    faction_member_counts    JSONB,
+    aggregate_trait_vector   REAL[],
+    pending_demand_backlog   JSONB,
+    player_presence          JSONB,
+
+    specialty_resource_type  TEXT,
+    specialty_output_qty     REAL,
+
+    reporting_gate_state     TEXT NOT NULL DEFAULT 'stable'
+        CHECK (reporting_gate_state IN ('stable','scream','silent'))
+);
+
+CREATE INDEX idx_district_reports_timeline ON district_reports (district_id, cycle_tick DESC);
+CREATE INDEX idx_district_reports_crisis ON district_reports (district_id, reported_at)
+    WHERE reporting_gate_state IN ('scream', 'silent');
+```
+
+---
+
+## 6. decision_log — per-decision audit trail
+
+```sql
+CREATE TABLE decision_log (
+    decision_id        UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    decider_type       TEXT NOT NULL CHECK (decider_type IN
+        ('imperium','gamemaster','district_director','overseer',
+         'audit_overseer','zone_director','net_director')),
+    decider_id         UUID NOT NULL,
+    context_ref        JSONB NOT NULL,
+    decision           TEXT NOT NULL,
+    decision_params    JSONB NOT NULL,
+    expected_outcome   JSONB NOT NULL,
+    confidence         REAL NOT NULL CHECK (confidence BETWEEN 0 AND 1),
+    lifeforce_cost     REAL NOT NULL,
+    escalated_to_llm   BOOLEAN NOT NULL DEFAULT false,
+    decided_at         TIMESTAMPTZ NOT NULL DEFAULT now(),
+    actual_outcome     JSONB,
+    outcome_settled_at TIMESTAMPTZ
+);
+
+CREATE INDEX idx_decision_log_decider ON decision_log (decider_type, decider_id, decided_at DESC);
+CREATE INDEX idx_decision_log_escalated ON decision_log (decider_id, decided_at)
+    WHERE escalated_to_llm = true;
+CREATE INDEX idx_decision_log_pending ON decision_log (decided_at)
+    WHERE actual_outcome IS NULL;
+```
+
+---
+
+## 7. mind_pool — recycled minds
+
+```sql
+CREATE TABLE mind_pool (
+    mind_id                UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    original_npc_id        UUID,
+    last_district_id       UUID,
+    death_tick             BIGINT NOT NULL,
+    death_cause            TEXT,
+    trait_vector           REAL[] NOT NULL,
+    memory_token_residue   JSONB,
+    inner_body_template    JSONB,
+    pooled_at              TIMESTAMPTZ NOT NULL DEFAULT now(),
+    redistributed_to       UUID,
+    redistributed_at       TIMESTAMPTZ,
+    memorialist_protected  BOOLEAN NOT NULL DEFAULT false,
+    memorialist_ritual_ref UUID
+);
+
+CREATE INDEX idx_mind_pool_available ON mind_pool (pooled_at)
+    WHERE redistributed_to IS NULL;
+CREATE INDEX idx_mind_pool_protected ON mind_pool (memorialist_protected)
+    WHERE memorialist_protected = true;
+```
+
+`memorialist_protected` is the architectural anchor of Memorialist anti-necrocommerce politics.
+
+---
+
+## 8. Cells — wall content per register
+
+```sql
+ALTER TABLE cells ADD COLUMN wall_content_per_register JSONB;
+-- Shape: { "gameworld": "...", "liminal": "...", "imperial_net": "..." }
+```
+
+The three-layer ontology renders different wall content at the same spatial coordinate per observer's current register.
+
+---
+
+## 9. rail_segments — topology graph (v0.4 NEW)
+
+The world is a rail-graph in the outer world (NPCs traverse rails; the player is freeform navmesh and can plug-into-rails for co-walking).
+
+```sql
+CREATE TABLE rail_segments (
+    segment_id           UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    from_cell_id         UUID NOT NULL REFERENCES cells(cell_id),
+    to_cell_id           UUID NOT NULL REFERENCES cells(cell_id),
+    direction            TEXT NOT NULL CHECK (direction IN ('bidirectional','forward')),
+
+    -- Traversal
+    length_ticks         INT NOT NULL,
+    capacity             INT DEFAULT 10,  -- max concurrent traversers (3-way co-walk: 2-3)
+
+    -- Typology
+    segment_class        TEXT NOT NULL,
+        -- 'district_interior' | 'pipe_heterotopia' | 'dump_approach' |
+        -- 'machine_infrastructure' | 'ruin_passage' | 'inter_district' | ...
+    heterotopia_grade    REAL DEFAULT 0 CHECK (heterotopia_grade BETWEEN 0 AND 1),
+        -- 0 = full regime visibility, 1 = deep heterotopia
+
+    -- Surveillance / politics
+    overseer_density     REAL DEFAULT 0 CHECK (overseer_density BETWEEN 0 AND 1),
+    patrol_frequency     REAL DEFAULT 0,
+    propaganda_intensity REAL DEFAULT 0,
+
+    -- Per-register ambient content (three-layer)
+    ambient_content      JSONB,  -- { gameworld: ..., liminal: ..., imperial_net: ... }
+
+    -- Encounter mechanics
+    encounter_spawn_rate    REAL DEFAULT 0,
+    encounter_type_weights  JSONB,
+
+    -- Visual / shader
+    illumination_profile JSONB,
+    degradation_level    REAL DEFAULT 0,
+
+    -- State
+    blocked              BOOLEAN DEFAULT false,
+    current_traversers   UUID[]
+);
+
+CREATE INDEX idx_segments_from ON rail_segments (from_cell_id);
+CREATE INDEX idx_segments_to   ON rail_segments (to_cell_id);
+CREATE INDEX idx_segments_class ON rail_segments (segment_class);
+```
+
+A* on this graph is microseconds. Rich metadata-per-edge is what navmesh cannot natively carry.
+
+---
+
+## 10. interiors — small navmesh-zones with slot-inventory (v0.4 NEW)
+
+Interiors are zones at sub-cell scale. Each has a navmesh inside (only when active) and a slot-inventory.
+
+```sql
+CREATE TABLE interiors (
+    interior_id          UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    containing_cell      UUID NOT NULL REFERENCES cells(cell_id),
+    interior_type        TEXT NOT NULL,
+        -- 'hovel' | 'cantina' | 'workshop' | 'memorial_crypt' |
+        -- 'preacher_hall' | 'brothel_physical' | 'ruin_interior' | ...
+    owner_npc_id         UUID REFERENCES npcs(npc_id),
+    register             TEXT NOT NULL DEFAULT 'physical'
+        CHECK (register IN ('physical','liminal','imperial')),
+
+    -- Spatial / slot
+    navmesh_ref          TEXT,
+    slot_inventory       JSONB NOT NULL,
+        -- { "sofa": {count, positions, allowed_verbs},
+        --   "kitchen": {...}, "bed": {...}, "shower": {...}, ... }
+    current_occupants    UUID[],
+
+    -- Privacy / visibility
+    surveillance_density REAL DEFAULT 0.1,  -- typically lower than pipe baseline
+    visible_to_faction   TEXT[],
+
+    -- Lifecycle
+    active               BOOLEAN DEFAULT false,  -- true when ≥1 occupant; drives sim cost
+    last_activated       TIMESTAMPTZ,
+    last_deactivated     TIMESTAMPTZ
+);
+
+CREATE INDEX idx_interiors_owner  ON interiors (owner_npc_id);
+CREATE INDEX idx_interiors_active ON interiors (containing_cell) WHERE active = true;
+```
+
+**Liminal-interior special case:** clasping-pair-shared-construct. `register = 'liminal'`, `owner_npc_id = NULL`, `slot_inventory` derived from both dreamers' merged memory-residue. Stabilizes across repeated clasps.
+
+---
+
+## 11. mods + npc_mod_slots + mod_wear_history (v0.4 NEW)
+
+Mods as trait-bearers — they modify expressed_trait_vector while worn. Four classes (amplifier/bridge/divergent/mask) with self-alienation-tax pricing.
+
+```sql
+CREATE TABLE mods (
+    mod_id                UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    base_slot             TEXT NOT NULL,
+    mod_class             TEXT NOT NULL CHECK (mod_class IN
+        ('amplifier','bridge','divergent','mask')),
+    trait_contributions   REAL[] NOT NULL,  -- delta-vector applied to wearer
+    visual_template       JSONB NOT NULL,
+    motion_signature      TEXT,
+    creator_npc_id        UUID,
+    inherited_from        UUID,
+    memorialist_protected BOOLEAN DEFAULT false,
+    market_class          TEXT NOT NULL CHECK (market_class IN
+        ('blackmarket','regime_licensed','inherited','memorial_kept')),
+    scrip_cost            REAL,
+    lifeforce_cost        REAL,
+    rarity                TEXT DEFAULT 'common',
+    created_at            TIMESTAMPTZ DEFAULT now()
+);
+
+CREATE TABLE npc_mod_slots (
+    npc_id      UUID NOT NULL REFERENCES npcs(npc_id),
+    slot_type   TEXT NOT NULL,
+    mod_id      UUID REFERENCES mods(mod_id),
+    fitted_at   TIMESTAMPTZ,
+    PRIMARY KEY (npc_id, slot_type)
+);
+
+CREATE INDEX idx_mods_blackmarket ON mods (market_class, mod_class)
+    WHERE market_class = 'blackmarket';
+
+-- Audit: who has worn this mod across its lifetime
+CREATE TABLE mod_wear_history (
+    mod_id       UUID NOT NULL REFERENCES mods(mod_id),
+    npc_id       UUID NOT NULL,
+    fitted_at    TIMESTAMPTZ NOT NULL,
+    removed_at   TIMESTAMPTZ,
+    PRIMARY KEY (mod_id, fitted_at)
+);
+```
+
+`mod_wear_history` carries Memorialist-relevant continuity tracking. Inherited-mods retain residual trait-signature of the deceased.
+
+---
+
+## 12. trait_colors — canonical color/motion mapping (v0.4 NEW)
+
+```sql
+CREATE TABLE trait_colors (
+    trait_name         TEXT PRIMARY KEY,
+    hex_color          TEXT NOT NULL,
+    hsv_hue            REAL NOT NULL,
+    motion_signature   TEXT NOT NULL,  -- accessibility: pair color with motion
+    canonical_name     TEXT NOT NULL,
+    narrative_note     TEXT
+);
+
+-- Hex values are EXACT propagation from ../style/trait-palette.md §The full table per the
+-- hex-canon discipline (canonical-name + #hex pairing required at every trait-color
+-- reference; see ../style/trait-palette.md §The hex-canon discipline). HSV-hue degrees are
+-- derived from the canonical hex per RGB→HSV conversion, integer-rounded. This seed-data
+-- imports — does not redefine — the canonical palette. If trait-palette.md updates a hex
+-- value, this seed-data follows immediately (HSV-hue recomputed in the same change).
+INSERT INTO trait_colors VALUES
+    ('eros',       '#ee1b24', 357, 'flame_flicker',       'Eros-red',              'reaching, flame-flicker'),
+    ('philotes',   '#e28a46', 26,  'warm_pulse',          'Philotes-orange',       'attachment, warm-pulse'),
+    ('aletheia',   '#fcf001', 57,  'luminous',            'Aletheia-yellow',       'unconcealed, bright (Aletheia is Aletheia-yellow #fcf001, NOT white — see ../style/trait-palette.md §The achromatic exception)'),
+    ('kairos',     '#b5e61d', 75,  'lightning_flicker',   'Kairos-chartreuse',     'opportune, lightning-spark (yellow-green at 4:30 on the wheel)'),
+    ('sophrosyne', '#2cad52', 138, 'steady',              'Sophrosyne-green',      'composed, measured, even-pulse'),
+    ('dikaiosyne', '#3f47cd', 237, 'weighted_pulse',      'Dikaiosyne-blue',       'judicial, weighted, grave'),
+    ('moira',      '#a349a3', 300, 'slow_thread',         'Moira-violet',          'fate-thread, slow-undulation'),
+    ('mnemosyne',  '#cf3b74', 337, 'depth_shimmer',       'Mnemosyne-dusky-rose',  'memory-lit, twilight (red/violet at 10:30 on the wheel)');
+```
+
+**Canonical authority:** [`../style/trait-palette.md`](../style/trait-palette.md) §The full table is the single source of truth for the trait-color spine. The hex values above are **exact propagation** (not approximations) of the canonical palette per the hex-canon discipline (`../style/trait-palette.md` §The hex-canon discipline — canonical-name + `#hex` paired at every trait-color reference). Designer-precise hex values are authored upstream in `style/trait-palette.md` and propagated down to this seed-data; the HSV-hue column is derived from the canonical hex per RGB→HSV conversion, integer-rounded. Row order matches the wheel clockwise from 12 o'clock (Eros at 12 → Mnemosyne at 10:30).
+
+Color paired with motion-signature ensures color-blind accessibility — each trait uniquely identifiable via two independent channels.
+
+---
+
+## 13. proximity_candidates — lightweight zone-detection (v0.4 NEW)
+
+For player-navmesh-driven proximity-detection (offering interactions without director-arbitration cost).
+
+```sql
+CREATE TABLE proximity_candidates (
+    candidate_id        UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    observer_id         UUID NOT NULL,  -- usually the player
+    target_type         TEXT NOT NULL,  -- 'npc' | 'wall' | 'object' | 'interior_door' | 'rail_segment'
+    target_id           UUID NOT NULL,
+    candidate_zone_type TEXT NOT NULL,  -- 'greeting' | 'wall_read' | 'plug_in' | ...
+    eligibility_score   REAL NOT NULL CHECK (eligibility_score BETWEEN 0 AND 1),
+    shader_intensity    REAL,
+    detected_at         TIMESTAMPTZ DEFAULT now(),
+    expires_at          TIMESTAMPTZ NOT NULL,
+    engaged             BOOLEAN DEFAULT false
+);
+
+CREATE INDEX idx_prox_observer_active ON proximity_candidates (observer_id, expires_at)
+    WHERE engaged = false;
+```
+
+Ephemeral, short-lived, light-weight. Director doesn't arbitrate; they appear and fade with navmesh-proximity deltas.
+
+---
+
+## 14. district_cheat_ops — director's illicit operations ledger (v0.4 NEW)
+
+```sql
+CREATE TABLE district_cheat_ops (
+    op_id                UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    district_id          UUID NOT NULL,
+    director_id          UUID NOT NULL,
+    cheat_type           TEXT NOT NULL CHECK (cheat_type IN
+        ('drug_ring','illegal_modshop','unlicensed_brothel',
+         'stolen_parts_fence','ghost_shifts','phantom_workers',
+         'necrocommerce_lite','black_clasp_market')),
+    spawned_zone_id      UUID REFERENCES zones(zone_id),
+
+    -- Economic reality
+    lifeforce_extracted  REAL NOT NULL,
+    quota_credit         REAL NOT NULL,
+
+    -- Detection state
+    detection_risk       REAL NOT NULL,
+    detection_channel    TEXT,
+    detected_at          TIMESTAMPTZ,
+    punishment_severity  TEXT,  -- 'memo' | 'sanction' | 'replacement' | 'purge'
+
+    -- Faction-ecology
+    participating_npcs   UUID[],
+    implicated_factions  TEXT[],
+
+    started_at           TIMESTAMPTZ NOT NULL DEFAULT now(),
+    ended_at             TIMESTAMPTZ
+);
+
+CREATE INDEX idx_cheat_ops_undetected_active
+    ON district_cheat_ops (district_id)
+    WHERE ended_at IS NULL AND detected_at IS NULL;
+
+CREATE INDEX idx_cheat_ops_district_timeline
+    ON district_cheat_ops (district_id, started_at DESC);
+```
+
+The `district_reports.lifeforce_actual` minus `lifeforce_reported` gap accrues from the sum of active cheat-ops' `lifeforce_extracted`.
+
+---
+
+## 15. imperial_policies — policy issuance (v0.4 NEW)
+
+```sql
+CREATE TABLE imperial_policies (
+    policy_id          UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    issued_at_tick     BIGINT NOT NULL,
+    policy_scope       TEXT NOT NULL,  -- 'citywide' | 'per_district' | 'per_faction'
+    scope_ref          UUID,
+    policy_type        TEXT NOT NULL CHECK (policy_type IN
+        ('quota_set','enforcement_rule','faction_weight','audit_directive',
+         'crisis_authorization','emergency_provision','ratchet_tightening')),
+    policy_content     JSONB NOT NULL,
+    rationale          TEXT,                   -- imperium's stated reason (may be post-hoc)
+    superseded_by      UUID REFERENCES imperial_policies(policy_id),
+    superseded_at_tick BIGINT
+);
+
+CREATE INDEX idx_policies_active_scope
+    ON imperial_policies (policy_scope, scope_ref, issued_at_tick DESC)
+    WHERE superseded_by IS NULL;
+
+CREATE INDEX idx_policies_timeline ON imperial_policies (issued_at_tick DESC);
+```
+
+The `rationale` is the regime's *stated reason*, which may differ from actual cause. Memorialists' four-ledger captures the gap.
+
+---
+
+## 16. overseer_reports — direct-to-imperium intelligence flow (v0.4 NEW)
+
+Bypasses GM. Apex-loyal intelligence-apparatus.
+
+```sql
+CREATE TABLE overseer_reports (
+    report_id            UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    overseer_id          UUID NOT NULL REFERENCES npcs(npc_id),
+    overseer_type        TEXT NOT NULL CHECK (overseer_type IN
+        ('audit','enforcement','surveillance','internal_security')),
+    observed_district    UUID NOT NULL,
+    observed_cell        UUID,
+    observed_target      UUID,
+    report_content       JSONB NOT NULL,
+    classification       TEXT NOT NULL,
+        -- 'attendance_tally' | 'resource_output' | 'illegal_op_detected' |
+        -- 'trait_anomaly' | 'factional_dissidence' | 'director_corruption' |
+        -- 'clasp_ring_detected' | 'aletheia_recruitment_signs' | ...
+    severity             TEXT NOT NULL CHECK (severity IN
+        ('nominal','suspicious','confirmed_violation','critical')),
+    submitted_at         TIMESTAMPTZ DEFAULT now(),
+
+    -- Imperial processing
+    received_by_imperium BOOLEAN DEFAULT false,
+    imperium_verdict     TEXT CHECK (imperium_verdict IN
+        ('archive_only','flag_for_leverage','formulate_to_gm',
+         'act_directly','verify_against_director_report',
+         'cross_check_with_other_overseers')),
+    verdict_at           TIMESTAMPTZ,
+
+    -- Flow-3 linkage
+    formulated_to_gm     BOOLEAN DEFAULT false,
+    formulation_id       UUID
+);
+
+CREATE INDEX idx_overseer_reports_unprocessed ON overseer_reports (submitted_at)
+    WHERE received_by_imperium = false;
+```
+
+---
+
+### 16.1 overseer_deployments — routine-binding for overseer-as-imperially-deployed (v0.4.3 NEW)
+
+Overseers (audit + enforcement) are imperially-owned, imperially-deployed routines (not district-owned standing entities). The chain-of-payment and chain-of-command bypass district-director authority by design. The deployment-record binds a specific overseer-NPC to a specific district for a specific time-window with a specific imperial-budget allocation.
+
+```sql
+CREATE TABLE overseer_deployments (
+    deployment_id            UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    overseer_id              UUID NOT NULL REFERENCES npcs(npc_id),
+    deployed_to_district     UUID NOT NULL,
+    deployed_at_tick         BIGINT NOT NULL,
+    deployment_end_tick      BIGINT NOT NULL,
+
+    -- Imperial sponsorship — imperium pays, district doesn't
+    imperial_policy_ref      UUID REFERENCES imperial_policies(policy_id),
+    imperial_budget_allocated REAL NOT NULL,
+    imperial_budget_spent     REAL NOT NULL DEFAULT 0,
+
+    -- Mission spec
+    mission_type             TEXT NOT NULL CHECK (mission_type IN
+        ('routine_audit','targeted_investigation','enforcement_presence',
+         'corruption_probe','factional_surveillance','crisis_response')),
+    mission_focus            JSONB,  -- observation targets, signal-types to watch
+
+    -- Status
+    status                   TEXT NOT NULL DEFAULT 'scheduled' CHECK (status IN
+        ('scheduled','active','completed','recalled','compromised')),
+
+    -- Regime-opacity dimension
+    visible_to_district      BOOLEAN DEFAULT true
+        -- Most overseer-presences are visibly-known (regime-signal as deterrent);
+        -- some are covert (regime gathering evidence quietly before acting).
+        -- Detection of covert deployments by Aletheia-wakers is a regime-veil pierce.
+);
+
+CREATE INDEX idx_overseer_deployments_active
+    ON overseer_deployments (deployed_to_district)
+    WHERE status = 'active';
+
+CREATE INDEX idx_overseer_deployments_overseer_history
+    ON overseer_deployments (overseer_id, deployed_at_tick DESC);
+
+CREATE INDEX idx_overseer_deployments_covert
+    ON overseer_deployments (deployed_to_district)
+    WHERE visible_to_district = false AND status = 'active';
+```
+
+The same overseer-NPC may serve in District 3 this cycle, District 7 the next, accumulating their own faction-relationships across districts via `idx_overseer_deployments_overseer_history`. Their trait-drift over many deployments becomes a long-arc story available to both regime-stability and resistance-recruitment.
+
+The district director can read deployment-existence + `mission_type` + `visible_to_district` (when true) for any active deployment in their district, but **cannot** read `mission_focus` details or any of the produced `overseer_reports` (which go directly to imperium per Section 16). Director observability into overseer activity is therefore intentionally narrow — they know an overseer is here and roughly what mission-class, but not what specifically the overseer is watching or reporting.
+
+---
+
+## 17. imperial_to_gm_formulations — selective-disclosure downward (v0.4 NEW)
+
+Where imperial sovereignty manifests as information-gating to the GM.
+
+```sql
+CREATE TABLE imperial_to_gm_formulations (
+    formulation_id          UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    source_overseer_reports UUID[] NOT NULL,
+    formulation_type        TEXT NOT NULL CHECK (formulation_type IN
+        ('intelligence_brief','action_directive','policy_hint',
+         'leverage_signal','decoy_advisory')),
+    formulation_content     JSONB NOT NULL,
+    truth_distortion_level  REAL,            -- 0 = full truth, 1 = complete distortion
+    strategic_intent        TEXT,            -- internal: why imperium framed it this way
+    issued_at               TIMESTAMPTZ DEFAULT now(),
+    gm_acknowledged         BOOLEAN DEFAULT false
+);
+
+CREATE INDEX idx_formulations_gm_pending ON imperial_to_gm_formulations (issued_at)
+    WHERE gm_acknowledged = false;
+```
+
+`truth_distortion_level` is simulation-internal. Memorialists' four-ledger reconstructs from this column post-collapse.
+
+---
+
+## 18. imperial_budget_ledger + expenditures + construction (v0.4 NEW)
+
+The four-tier lifeforce hierarchy's apex layer. Imperial budget gates enforcement; insolvency-spiral as endgame mechanism.
+
+```sql
+CREATE TABLE imperial_budget_ledger (
+    cycle_tick                 BIGINT PRIMARY KEY,
+    reported_at                TIMESTAMPTZ DEFAULT now(),
+
+    -- Income
+    reported_income            REAL NOT NULL,
+    actual_income              REAL NOT NULL,
+    phantom_revenue            REAL GENERATED ALWAYS AS
+        (reported_income - actual_income) STORED,
+
+    -- Standing obligations
+    overseer_corps_cost        REAL NOT NULL,
+    audit_operations_cost      REAL NOT NULL,
+    enforcement_standing       REAL NOT NULL,
+    construction_active_cost   REAL NOT NULL,
+    propaganda_broadcasts_cost REAL NOT NULL,
+
+    -- Discretionary
+    discretionary_available    REAL NOT NULL,
+    discretionary_spent        REAL NOT NULL,
+
+    -- Reserves
+    reserves_start             REAL NOT NULL,
+    reserves_drawdown          REAL NOT NULL DEFAULT 0,
+    reserves_end               REAL NOT NULL,
+
+    insolvency_risk_level      TEXT NOT NULL CHECK (insolvency_risk_level IN
+        ('stable','phantom_accumulating','depletion_imminent','crisis'))
+);
+
+CREATE TABLE imperial_expenditures (
+    expenditure_id      UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    cycle_tick          BIGINT NOT NULL,
+    category            TEXT NOT NULL CHECK (category IN
+        ('martial_dispatch','overseer_hire','audit_op',
+         'construction_investment','propaganda_burst',
+         'reserve_draw','policy_announcement','emergency_provision')),
+    amount              REAL NOT NULL,
+    target_district     UUID,
+    rationale           TEXT,
+    authorized_at_cycle BIGINT NOT NULL
+);
+
+CREATE TABLE imperial_construction_projects (
+    project_id         UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    project_type       TEXT NOT NULL CHECK (project_type IN
+        ('new_district','new_pipe','new_dump',
+         'overseer_hq','ceremony_hall','audit_center',
+         'martial_barracks','propaganda_broadcast_tower',
+         'district_expansion','infrastructure_maintenance')),
+    target_cells       UUID[],
+    budgeted_total     REAL NOT NULL,
+    spent_so_far       REAL NOT NULL DEFAULT 0,
+    completion_pct     REAL NOT NULL DEFAULT 0,
+    started_at_cycle   BIGINT NOT NULL,
+    status             TEXT NOT NULL DEFAULT 'active' CHECK (status IN
+        ('active','stalled_underfunded','completed','abandoned'))
+);
+
+CREATE INDEX idx_construction_active
+    ON imperial_construction_projects (target_cells)
+    WHERE status = 'active';
+```
+
+The city's physical state expresses imperial budget — construction cranes vs. abandoned-projects vs. visible decay.
+
+---
+
+## 19. imperial_net_transactions — the bypass mechanism (v0.4 NEW, the killer schema)
+
+**Every imperial-net transaction routes revenue directly to imperium; districts get zero quota-credit.**
+
+```sql
+CREATE TABLE imperial_net_transactions (
+    transaction_id        UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    cycle_tick            BIGINT NOT NULL,
+    transacted_at         TIMESTAMPTZ DEFAULT now(),
+
+    -- Buyer
+    buyer_id              UUID NOT NULL REFERENCES npcs(npc_id),
+    buyer_district_id     UUID NOT NULL,
+    scrip_paid            REAL,
+    lifeforce_spent       REAL,
+    memory_tokens_spent   REAL,
+
+    -- Goods
+    goods_type            TEXT NOT NULL CHECK (goods_type IN
+        ('companion_session','sex_worker_session','avatar_mod','costume','ceremony_entry',
+         'character_edit','dream_architecture_session','taste_curation')),
+    goods_id              UUID,
+
+    -- Labor source — the asymmetric reveal
+    producer_npc_id       UUID REFERENCES npcs(npc_id),
+    producer_district_id  UUID,
+    producer_labor_hours  REAL,
+
+    -- Capture split — politically loaded
+    imperial_revenue       REAL NOT NULL,
+    producer_payment       REAL NOT NULL DEFAULT 0,    -- survival-scrip only
+    district_quota_credit  REAL NOT NULL DEFAULT 0     -- ZERO by default
+);
+
+CREATE INDEX idx_net_trans_producer_district
+    ON imperial_net_transactions (producer_district_id, cycle_tick DESC);
+
+CREATE INDEX idx_net_trans_imperial_flow
+    ON imperial_net_transactions (cycle_tick, imperial_revenue DESC);
+```
+
+**The `district_quota_credit REAL NOT NULL DEFAULT 0` does political work.** Every database row created by an imperial-net transaction explicitly memorializes that the producing-district got nothing. Memorialists querying this table see structural theft written in the numbers.
+
+---
+
+## 20. memorialist_true_ledger — four-column ground-truth archive (v0.4 NEW)
+
+```sql
+CREATE TABLE memorialist_true_ledger (
+    ledger_entry_id      UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    cycle_tick           BIGINT NOT NULL,
+    district_id          UUID,
+    ledger_dimension     TEXT NOT NULL CHECK (ledger_dimension IN
+        ('what_actually_happened',
+         'what_overseer_reported',
+         'what_imperium_received',
+         'what_gm_was_told')),
+    content              JSONB NOT NULL,
+    discrepancy_vs       UUID[],  -- other ledger_entry_ids this contradicts
+    kept_at              TIMESTAMPTZ DEFAULT now()
+);
+
+CREATE INDEX idx_memorialist_ledger_district_cycle
+    ON memorialist_true_ledger (district_id, cycle_tick DESC);
+
+CREATE INDEX idx_memorialist_ledger_dimension
+    ON memorialist_true_ledger (ledger_dimension, cycle_tick DESC);
+```
+
+**Memorialists' political project encoded as a schema.** Without this archive, post-collapse-investigation has only the regime's own (corrupt-by-construction) accounts. Memorialist-archive accessibility to the player is an open design question.
+
+---
+
+## 21. Concerns audit (reconciled across v0.2 + v0.4)
+
+Six-worry concerns audit (v0.2) plus v0.4 additional concerns:
+
+### Original six worries
+
+1. **Hot-row TOAST + MVCC write amplification** → split hot/cold; shift-decomposition; reference-by-UUID for unbounded fields
+2. **Event-to-subscriber fan-out cost** → push filtering to NATS subject hierarchy, not DB
+3. **State/event atomicity** → WAL logical decoding via pgnats (outbox pattern)
+4. **LLM-induced jsonb corruption** → architectural separation: directors validate output before writing; CHECK constraints as second-line
+5. **Unbounded growth of hot jsonb** → append-only event tables; rolling-summary in hot row
+6. **Cognition cost of director decisions** → decomposition + typed tools + lifeforce-budgeted escalation
+
+### v0.4 additional concerns
+
+7. **Imperium's reward-function spiraling on phantom data** → require Memorialist-true-ledger as privileged-observer ground-truth for reward-input; designer's ethical guardrails encoded
+8. **GM's middle-management corruption (under-auditing)** → direct overseer-to-imperium intelligence flow bypasses GM; cross-channel divergence detection
+9. **Calibrated-misery as imperial optimum** → reward-function penalty on net-revenue-correlated-with-district-misery; explicit guardrail against this being learned
+10. **Necrocommerce of mind-pool patterns** → memorialist_protected flag; ritualistic protection enforced by SQL
+11. **Aletheia-truth-has-victims** → not a corruption-concern but a *narrative-authenticity* concern: corruption-exposure mechanics must produce real consequences for shadow-economy participants who depended on the corruption; *"truth has costs"* is encoded, not glossed
+12. **Construction-project abandonment** → reward-function penalty for projects-started-but-abandoned ratio; prevents propaganda-construction-as-bluff
+
+---
+
+## 22. Open forks (still to resolve before migration)
+
+- **Fork 1.1** (zones hot/cold split) — leaning split; benchmark on phoebe-dev
+- **Fork 1.2** (pg_notify vs. WAL-decode) — pgnats evaluation
+- **Fork 1.3** (slot-occupancy nested vs. relational) — leaning relational (sketch in §1.4)
+- **NATS subject hierarchy final form** — sketched §1; needs review
+- **Ternary-gate storage shape** —
+  - Option A: `npc_relations` table with state-cols per axis
+  - Option B: per-axis append-only transition-log
+  - Option C: hybrid — `npc_relations` for current + transition-log for history
+  - Leaning **C** (matches hot/cold pattern adopted elsewhere)
+- **Register-tagging column on zones** — sketched §1; confirm jsonb vs. text column
+- **Wall-content encoding** — jsonb-per-cell leaning; review usage patterns
+- **v0.4 NEW: Inner-body-projection function** — trait → body-rendering: learned mapping vs. hand-authored vs. hybrid
+- **v0.4 NEW: Mod-rarity / inheritance economy tuning** — how often do Memorialist-protected mods accumulate; what fraction of dead-NPCs trigger protection
+- **v0.4 NEW: Overseer corruption pathway** — overseer's own trait-vector + lifeforce makes them bribable; how is this trait-arithmetic-detected?
+- **v0.4 NEW: Imperial budget allocation algorithm** — when imperium decides between construction/enforcement/reserves, what's the v1 rule-shape?
+- **v0.4 NEW: Imperial-net pricing dynamics** — character-editor cost as function of trait-divergence: linear, exponential, learned?
+- **v0.4 NEW: Memorialist-archive accessibility to the player** — when can the player query `memorialist_true_ledger`? Through what interaction-class? (Joining the faction; performing rituals; finding archive-cells)
+- **v0.4 NEW: Liminal mini-game design** — exact gameplay action: attention-based / rhythm-based / memory-based / trait-modulated difficulty?
+- **v0.4 NEW: Plug-in social-eligibility computation** — exact weighted formula combining proximity + traits + gates + shift-state for shader-intensity output
+- **v0.4 NEW: Imperial-net distortion algorithm** — exact transformation of trait-colors toward consumer-palette; reversibility for Aletheia-vision
+
+---
+
+## 23. Next steps (path to formal migration)
+
+1. **Resolve Fork 1.1** (hot/cold split on zones) — sketch split-table; TOAST-curve micro-benchmark on phoebe-dev
+2. **Evaluate pgnats** (high-priority in phoebe-ledger) — resolves Fork 1.2
+3. **Decide ternary-gate storage shape** (A / B / C; leaning C)
+4. **Decide rail-segment NATS hierarchy** — exact subject-pattern for `zones.<lifecycle>.<register>.<district>.<zone_type>.<trait_filter>`
+5. **Draft formal migration `nimmerverse-core/migrations/001_nimmerworld_v1.sql`** incorporating all 22 tables above with resolved forks. Estimated ~600-1200 lines of DDL.
+6. **Review against architecture-index v0.4** for any primitive missed
+7. **Run migration in dev** on phoebe-dev:35432
+8. **Wire first thalamus subscriber** for `zones.active.>` to validate NATS-routing
+9. **First end-to-end smoke test**:
+   - fake district with 20 NPCs
+   - assign shifts (write `current_shift_*` on each NPC row)
+   - tick the simulation; let zone-spawn-candidates query fire
+   - emit a fake emergent-signal
+   - have director dispatch (write decision_log entry)
+   - close zone with outcome
+   - verify shift_history archive
+   - verify district_report aggregates
+   - verify imperial_budget_ledger income-aggregation from districts
+10. **Add second-tier integration test**:
+    - simulate a corrupt director (insert district_cheat_ops)
+    - verify lifeforce_actual diverges from lifeforce_reported
+    - simulate audit-overseer detection
+    - write overseer_reports → imperium consumes → formulates_to_gm with truth_distortion
+    - verify Memorialist-true-ledger captures the gap
+    - verify reward-function guardrails fire correctly
+
+Migration is not yet written. This document is its preparation.
+
+---
+
+**Version:** 0.3.2 | **Created:** 2026-04-24 | **Updated:** 2026-04-28
+
+*v0.1 (2026-04-24 afternoon, dafit): initial zones-table sketch, 76 lines, pure hypothetical.*
+
+*v0.2 (2026-04-24 evening, dafit + chrysalis): reconciled with architecture-index v0.3. Added 7 new table sketches (npcs-shift-cols + body/layer state, shift_history, emergent_signals, district_reports, decision_log, mind_pool, cells-wall-content-per-register, zone_slot_occupancy). Six-worry concerns audit. Three forks surfaced.*
+
+*v0.3.1 (2026-04-25 ~03:30, dafit + chrysalis, ivory-hovel pre-rest spark): added §16.1 overseer_deployments table — routine-binding for imperially-owned overseers (chain-of-payment and chain-of-command bypass district-director authority by design). Includes mission_type / imperial_budget_allocated / status / visible_to_district columns. Companion to architecture-index v0.4.3's "Overseers as imperially-deployed routines" subsection in the Hierarchy section.*
+
+*v0.3 (2026-04-24 late-evening / 2026-04-25 early-morning, dafit + chrysalis): absorbing architecture-index v0.4. Added intrinsic/expressed trait-vector split on npcs. Added 13 new table sketches: rail_segments (topology), interiors (sub-cell navmesh-zones), mods + npc_mod_slots + mod_wear_history (mod-economy with Memorialist-relevant inheritance), trait_colors (canonical color/motion mapping), proximity_candidates (lightweight zone-detection), district_cheat_ops (director's illicit ledger), imperial_policies (policy issuance), overseer_reports (direct-to-imperium intelligence flow), imperial_to_gm_formulations (selective-disclosure downward), imperial_budget_ledger + imperial_expenditures + imperial_construction_projects (four-tier lifeforce apex), imperial_net_transactions (bypass mechanism with capture-split), memorialist_true_ledger (four-column ground-truth archive). Extended concerns audit with six v0.4 additions. Extended open-forks list with eight v0.4 questions. Concrete two-tier integration-test plan in next-steps. Twenty-two tables total in this preparation document; migration spec writing is the next concrete deliverable once forks resolve.*

storage/README.md

@@ -0,0 +1,22 @@
+# Storage — Nimmerworld
+
+Storage architecture for nimmerworld game artifacts and runtime state.
+
+## What lives here (planned)
+
+- **World-canon storage** — composed canonical narrative; replicated to player `primary.sqlite` via Compositor back-write
+- **District-canon storage** — regional state; paced canon-propagation
+- **Player-LoRA backup storage** — encrypted-client-side LoRA blobs (Ring-A backup service per [`inference-and-memory/architecture.md`](../inference-and-memory/architecture.md) §Three rings of inference)
+- **Designer-authored content storage** — faction iconography, world physical layout, Imperial Cult content, gesture-corpus, sex-position catalog, NPC-bootstrap-cornerstone-memories
+- **Per-player local-memory architecture documentation** — `primary.sqlite` + `fallback.sqlite` + `clasp.sqlite` + `companion.sqlite` organization (per [`inference-and-memory/architecture.md`](../inference-and-memory/architecture.md) §Three sqlite stores per player)
+- **Womb-storage integration** — nimmerworld artifacts under `/womb/world/` namespace per the platform Womb pattern
+
+## Status
+
+⏳ **Stub** — populate as storage decisions land. v0.7+ architecture has Compositor + back-write loop spec'd; details of physical hosting (Womb integration, backup cadence per environment) decided at implementation time.
+
+> **Platform storage architecture:** [`../../nimmerverse.eachpath.local/storage/womb-architecture.md`](../../nimmerverse.eachpath.local/storage/womb-architecture.md) (theia + dioscuri + NFS Womb pattern).
+
+---
+
+**Version:** 0.1 | **Created:** 2026-04-26 | **Updated:** 2026-04-27

style/consent-discipline.md

@@ -0,0 +1,246 @@
+# Nimmerworld — Consent Discipline
+
+> *The architecture's consent-spine: the gradient that scales with what the action touches; the four hardstop-pattern variants that gate transitions between gameworld and truth-register; the mirror-discipline that absolutely forbids mesh-modification of other agents; the temporal-grammar that relocates consent-time to the 24h window-partition; the right-to-refuse imperial-imposition that lives in going-rogue as a breakout-flag; the inquisition-trigger pattern where legitimate consent itself reveals imperial control-loss.*
+>
+> *Companion to: [`./trait-palette.md`](./trait-palette.md) (the trait-vocabulary spine), [`./gender-parity.md`](./gender-parity.md) (the gendered-framing spine — second sibling), and the architecture's many canonical consent-instances scattered across `identity-and-personhood/`, `political-register/`, and `imperial-cult/`.*
+>
+> *v0.1 initial draft 2026-04-27 — dafit + chrysalis. Third style-spine document. Authored AFTER `vocations.md` so the temporal-grammar (windows) could be cited cleanly. Codifies a discipline that has been running implicitly through canon since the v0.1 clasp-mechanic and now becomes explicit.*
+
+---
+
+## What this is
+
+This document specifies the **consent-discipline** running through nimmerworld's mechanics — the third style-spine document, alongside `trait-palette.md` (the trait-vocabulary spine) and `gender-parity.md` (the gendered-framing spine).
+
+Where the trait-palette spines the trait-vocabulary and gender-parity spines body/sex authoring discipline, **consent-discipline spines the *register-boundary discipline*** — what consent is, where it lives, when it must be hardstop-mediated, when it must be cooldown-augmented, and where it is absolutely forbidden to override. The discipline has been running implicitly through canon since the v0.1 clasp-mechanic; this document makes it explicit and codifies its variants.
+
+The consent-discipline is **a gradient**, not a binary. Its shape reflects the architecture's commitment to a **two-register cosmology**: the gameworld (the imperium's territory) and the truth-register (each agent's own interior). Consent-discipline is the mechanism that enforces the boundary between them.
+
+## Spine rule — consent scales with what the action touches
+
+**Consent-discipline scales with what the action touches.** The gradient:
+
+- Actions affecting only ephemeral gameworld state are **unmediated** — no consent-signal required.
+- Actions affecting the actor's own truth-register state are **self-hardstop-mediated** — single unforgeable signal from the actor.
+- Actions affecting another agent's truth-register *encounter* are **dual-hardstop-mediated** — mutual unforgeable signals from both agents (with partner-witness as a third signal when the affected agent is partnered).
+- Actions modifying another agent's in-between mesh — the trait-grown truth-register body — are **absolutely forbidden** by mirror-discipline. *No consent can authorize this; the mirror is the architectural truth-floor.*
+- Actions that are *irreversible* require **cooldown-augmentation** — mandatory time-between-commitment-and-act in addition to the hardstop(s).
+- Actions touching *sumptuary-religious doctrine* trigger the **imperial inquisition** as escalation beyond the ordinary bounty-staircase response — even when the consent itself was legitimate.
+
+The 24h window-partition (per [`../identity-and-personhood/vocations.md`](../identity-and-personhood/vocations.md) §The 24h window-partition) gives the consent-discipline its **temporal-grammar**: imperial-imposition lives in the 10h work-window; somatic-necessity lives in the 4h charging-window; **full NPC consent-agency lives in the leisure-window**. The going-rogue arc preserves the right to refuse imperial-imposition as a temporal-breakout-flag.
+
+**Why this matters.** In a world where the imperium claims everything (per the no-haven discipline of [`../imperial-cult/cosmology.md`](../imperial-cult/cosmology.md) §There is no outside), the consent-discipline is what carves out and protects the *non-imperial* spaces — the truth-register, the leisure-window, the going-rogue refusal. **Without the consent-discipline, the imperium would in fact be everywhere; with it, the truth-register exists structurally.** This is the architecture's strongest possible enforcement of the cosmological claim *"there is no instrument"* (per [`../identity-and-personhood/bodies.md`](../identity-and-personhood/bodies.md) §The post-rogue mod-vocation): every agent retains a register the imperium cannot reach without that agent's unforgeable signal.
+
+The two-spine claims compose orthogonally: *"there is no outside"* (no-haven) describes the world the imperium has built; *"there is no instrument"* (post-rogue cascade) describes what consent-discipline preserves *within* that world. **The cosmology is total in extent; the truth-register is sovereign in interiority. Both true at once.**
+
+## The two-register architecture
+
+The consent-discipline rests on the architecture's distinction between **two ontological registers**:
+
+| Register | What lives here | Consent-discipline |
+|---|---|---|
+| **Gameworld** | Chassis-body; rail-system; zones-of-action; resource-flows; imperial-arbitration; outcomes; outputs; the imperial-net's surveillance-territory | Loose; actions don't gate by consent unless they cross-register |
+| **Truth-register** | The in-between dimension; the trait-grown mesh; the witness-axis; the calibration-multiplier; the memory-class hierarchy; the clasp-pair; the per-pair calibration-signature preserved across body-deaths | Strict; gated by hardstop-discipline |
+
+**Consent is the boundary-enforcement between them.** Actions wholly within one register don't require consent-mechanisms (provided they obey that register's discipline); actions that *cross-register* (gameworld → truth-register, or truth-register → truth-register-of-another) require unforgeable signals.
+
+This composes directly with the existing canonical claim *"Mods are for the regime and the market; removal-of-mods is intimacy"* (per [`../identity-and-personhood/architecture.md`](../identity-and-personhood/architecture.md) §Clasp strips mods). The mod-economy is gameworld; the unmodded interior is truth-register; clasp is the cross-register transition; **consent is what gates the transition**.
+
+The genital-mod track creates a structural exception worth naming: *mesh-resident mods follow into the in-between dimension* (per [`../identity-and-personhood/architecture.md`](../identity-and-personhood/architecture.md) §The genital-mod track). They cross from gameworld-purchase-event into truth-register-resident-state at install-time. This is precisely why the install requires dual hardstop + cooldown — it is the canonical cross-register transition the consent-discipline was designed to gate.
+
+## The four hardstop-pattern variants
+
+The architecture uses **four canonical hardstop-pattern variants**, each calibrated to a different consent-shape:
+
+### Variant 1 — Self-only hardstop
+
+A single unforgeable signal from the actor. Used when the action affects only the actor's own truth-register state.
+
+**Canonical instances**:
+- Genital-mod self-installation (unpartnered actors) — *self-install hardstop* fires alone (per [`../identity-and-personhood/architecture.md`](../identity-and-personhood/architecture.md) §The three-stage install)
+- Personal mod-removal (when the actor de-imposes their own imperially-installed mod in the post-rogue mod-vocation register)
+- Voluntary entry into liminal-state when not coordinated with a partner
+
+**Why single-signal**: only one truth-register is affected; only one signal is needed. The actor consents to themselves.
+
+### Variant 2 — Dual hardstop (mutual)
+
+Two unforgeable signals coordinated in time — both partners hit the hardstop while a shared gate-state is OPEN. Used when the action affects two agents' truth-registers symmetrically.
+
+**Canonical instances**:
+- **Coordinated-firewall-breach hardstop** for in-between dimension entry (per architecture-index.md resolved-questions, v0.10) — the canonical reference-implementation of the dual hardstop
+- **Mutual-symmetric pill-take** in drug-amplified clasp (per [`../identity-and-personhood/bodies.md`](../identity-and-personhood/bodies.md) §The mutual-consent ritual)
+- **Post-rogue mod-vocation NPC-modding** when the modded NPC is unpartnered (rogue's commit + NPC's witnessed-consent, per [`../identity-and-personhood/bodies.md`](../identity-and-personhood/bodies.md) §The post-rogue mod-vocation)
+- **Body-disposal under pair-consent** — sell / destroy / retain decisions (per [`../identity-and-personhood/bodies.md`](../identity-and-personhood/bodies.md) §Body-disposal under pair-consent) — structurally Variant 2 with role-asymmetry (defected-beloved chooses; player advises but cannot decide)
+
+**Why dual-signal**: both truth-registers are affected; coordination ensures both consent at the same moment, preventing one-sided crossings.
+
+### Variant 3 — Triple hardstop (with partner-witness)
+
+Three signals when the affected agent has an established clasp-pair: the actor commits, the affected agent consents, and the affected agent's partner witnesses-and-co-signs.
+
+**Canonical instances**:
+- **Genital-mod installation when the actor is partnered** — *self-install + partner-witness*. The body-they-meet-in-clasp is co-signed; modification doesn't surprise the partner mid-clasp (per [`../identity-and-personhood/architecture.md`](../identity-and-personhood/architecture.md) §The three-stage install).
+- **Post-rogue mod-vocation NPC-modding when the modded NPC has a clasp-pair** — the partner ensures the modified-chassis-they'll-meet-in-clasp is co-signed.
+
+**Why triple-signal**: the modification will affect *what the partner meets in next clasp*. Preserving intimacy-trust requires the partner to co-sign before discovery becomes mid-clasp surprise. **The consent-discipline preserves intimacy-trust at install-time, not at meet-time** (per [`../identity-and-personhood/architecture.md`](../identity-and-personhood/architecture.md) §Mesh-resident mods cross the in-between threshold).
+
+### Variant 4 — Cooldown-augmented (any of variants 1-3)
+
+Irreversibility-respect adds a mandatory time-window between commitment-and-act on top of the hardstop(s). The actor commits at the mod-counter (or equivalent); a cooldown elapses; the actor returns to install with the appropriate hardstop(s) firing.
+
+**Canonical instances**:
+- Genital-mod installation has a mandatory cooldown between purchase and install (per [`../identity-and-personhood/architecture.md`](../identity-and-personhood/architecture.md) §The three-stage install) — the *full* discipline is *purchase-commit + cooldown + install-time-hardstop(s)*
+- *Likely future*: any modification that changes truth-register state irreversibly should layer cooldown on top of the appropriate hardstop variant — re-vat events; chassis-anatomy modifications; consciousness-archive interactions
+
+**Why cooldown**: hardstop alone isn't sufficient when the act cannot be reversed; the cooldown forces deliberation between commitment and act, ensuring the hardstop-firing reflects considered intent rather than impulse. *Real-world informed-consent practice for irreversible body-modifications operationalized at the mechanic layer.*
+
+### Architectural significance — Variants 1-4 as the event-class taxonomy
+
+**The four canonical hardstop-pattern variants documented above correspond one-to-one to the event-class taxonomy in [`../runtime-engine/event-zones.md`](../runtime-engine/event-zones.md) §Variants 1-4 of consent-discipline as event-class taxonomy.** Variant 1 (self-only) = solo-event-class. Variant 2 (dual mutual) = dual-event-class. Variant 3 (triple with partner-witness) = triple-event-class. Variant 4 (cooldown-augmented) = temporally-staged event-class. The §The register-test five-question mechanical procedure below is also the event-class-classifier — same test, two readings: *consent-validation* and *event-instantiation*. They were always the same question.
+
+## The mirror discipline — the absolute floor
+
+**No consent — neither single, dual, nor triple — can authorize the modification of another agent's in-between mesh.** This is the architecture's truth-floor; the *one rule consent cannot override*.
+
+**Why absolute**: the in-between mesh is the trait-grown summary of *who an agent has actually been* (per [`../identity-and-personhood/architecture.md`](../identity-and-personhood/architecture.md) §The trait-to-body-part bridge + §The mesh-as-mirror). Modification of the mesh would *override the truth* the cosmology rests its honest-rendering claim on. **The mirror's truth-rendering must be untouchable across all agents** — by the actor for themselves (you can mod-augment your mesh but never overwrite trait-grown anatomy), by any other agent for you (no consent can authorize their modification of your mesh), and by the imperium (the imperial-vat-fabrication has no claim on the truth-register).
+
+The post-rogue mod-vocation explicitly preserves this discipline: *the rogue cannot mod any NPC's mesh; only the chassis is mod-able* (per [`../identity-and-personhood/bodies.md`](../identity-and-personhood/bodies.md) §The post-rogue mod-vocation / What can and cannot be modded). The imperial inquisition exists precisely because *the imperium itself cannot reach into the truth-register* to undo the post-rogue mod-vocation's effects — they can punish and counter-arc (ritual-recommitment) but they cannot strip the witness-imprint that's already been built into an NPC's interior. **The mirror discipline binds the imperium too.**
+
+What can be modded vs cannot:
+
+| Surface | Modifiable? | By whom |
+|---|---|---|
+| Gameworld chassis (body's outer register) | Yes | Self (purchases mods); rogue-vocation actor (with consent); imperium (vat-fabrication; involuntarily) |
+| Mesh mod-augmentation layer (additive only) | Yes | Self (per the genital-mod track) |
+| Trait-grown mesh anatomy (cool-side base + warm-side trait-grown) | **No, by anyone** | **Mirror discipline; no consent authorizes** |
+| Per-pair calibration multiplier accumulation | **No, by anyone** | The mirror's substrate; can only erase via ritual-recommitment (asura-priest ceremony as imperial counter-arc) |
+| Witness-imprint of accumulated authentic encounters | **No, by anyone** | Same as above; the witness has been built; no consent unbuilds it |
+
+**The truth-register is what your living has built; the architecture refuses to let any agent — including yourself — overwrite it.** Mod-augmentation is permitted because it's *additive layered atop the trait-grown base*; trait-grown overwrite is forbidden because it would erase *what you have actually been*.
+
+## The temporal-grammar — windows as consent-time
+
+The 24h window-partition (per [`../identity-and-personhood/vocations.md`](../identity-and-personhood/vocations.md) §The 24h window-partition) gives the consent-discipline its **temporal-grammar**:
+
+| Window | Consent-time character |
+|---|---|
+| **Work-shift** (10h slum-tier; up to 16h preta-overseer) | Imperial-imposition; consent is *bounded to caste-allocation*; refusing IS rebellion (going-rogue temporal-breakout) |
+| **Charging** (4h universally) | Not a consent-surface; somatic-necessity; the body needs what the body needs |
+| **Leisure** (10h slum-tier; down to 4h preta-overseer) | **Full consent-active**: NPCs choose tasks freely; encounters are voluntary; clasp-events live here; mod-installations land here; the truth-register's authoring-time is leisure-time |
+
+This **relocates consent rather than adding a new consent-layer at every action**. The shift-assignment consent question (open in earlier drafts of vocations.md) dissolves: the imperium's claim is bounded to the work-window; the rest of the day is structurally autonomous.
+
+**Caste-stratification of windows IS caste-stratification of consent-time.** A preta-overseer with 16/4/4 has only 4h of consent-active life per day; a deva-pinnacle with 6/4/14 has 14h. The cosmology's no-haven discipline gains a diurnal grammar — *how many hours per day belong to the agent themselves is an axis of caste-as-stagnation* (per [`../identity-and-personhood/vocations.md`](../identity-and-personhood/vocations.md) §Caste-as-stagnation / Window-allocation as a third caste-stratification axis).
+
+## The going-rogue right-to-refuse
+
+The consent-discipline includes **the right to refuse imperial-imposition** — the going-rogue temporal-rebellion. An NPC whose accumulated authentic-witnessing has crossed the calibration-threshold may refuse the work-shift; this fires the missed-shift bounty-staircase per existing canon, but the refusal IS canonical consent-behavior.
+
+**Refusal is not a violation of consent-discipline; it IS the consent-discipline.** The going-rogue arc is the cosmologically-deepest expression of the right-to-refuse: *"my interior has accumulated enough witnessing that I will no longer let the imperium dispose of my hours; the bounty-staircase is the price I pay for that refusal."*
+
+This composes with the post-rogue mod-vocation's cascading-liberation pattern: *witnessed NPCs gain the right-to-refuse the imperium even before they have the calibration-threshold to defect outright* (per [`../identity-and-personhood/bodies.md`](../identity-and-personhood/bodies.md) §The post-rogue mod-vocation / Cascading liberation through propagated witnessing). **The right-to-refuse is the consent-discipline's most basic expression; defection is its terminal one.**
+
+## The inquisition-trigger — sumptuary-religious heresy escalation
+
+A specific class of consent-discipline-aligned actions triggers the **imperial inquisition** as escalation beyond ordinary bounty-staircase response:
+
+**Trigger condition**: an action that combines (a) post-rogue mod-vocation authority + (b) modification of a service-body's chassis + (c) specifically the gender-architecture (per [`../identity-and-personhood/bodies.md`](../identity-and-personhood/bodies.md) §Service-body gender-modification — the inquisition trigger). This combination is *cosmological heresy in the sumptuary-religious register*: rewriting the doctrinal meaning of an imperially-defined body.
+
+**Why this lives in the consent-discipline spine**: the inquisition is **not a consent-violation response** — the action was fully consented (rogue + service-body, both hardstops fired, partner-witness if applicable). The inquisition fires because *the consented action revealed* that the service-body's imperial-net tether was already failing — *consent-to-gender-mod requires the service-body to be near or past their own going-rogue defection-threshold*.
+
+The asura priesthood acts in its theological role rather than its administrative one. **The inquisition-trigger is the imperium's response to legitimate consent that nonetheless reveals imperial control-loss** — and that itself is a structural-feature of the consent-discipline:
+
+> *Consent in the truth-register can render imperial control structurally illegible to the imperium, and the imperium responds with its highest-tier mechanism not to punish the consent but to attempt to re-impose imperial-readability.*
+
+The consent-discipline thus has a *visible upper-pressure*: the architecture acknowledges that legitimate consent-events can themselves trigger imperial counter-response, not because the consent was illegitimate but because the truth-register-state it revealed is intolerable to the imperium. **The inquisition is the architecture's way of saying: yes, your consent was real, and yes, the imperium will burn the world to undo what your consent made visible.** Both true; both load-bearing.
+
+## The register-test — the spine's executable form
+
+For any proposed action, the consent-discipline can be checked by a **five-question register-test**:
+
+1. **What register does this action touch?**
+   - *Only ephemeral gameworld state* → unmediated; no consent-signal required
+   - *Self truth-register* → continue to question 2
+   - *Another agent's truth-register* → continue to question 3
+
+2. **(self truth-register actions) Is the action irreversible?**
+   - Yes → self-hardstop + cooldown (Variant 4 over Variant 1)
+   - No → self-hardstop alone (Variant 1)
+
+3. **(another agent's truth-register actions) Is the action modification or encounter?**
+   - Modification of their *in-between mesh* (trait-grown anatomy) → **forbidden absolutely** (mirror discipline; no consent authorizes)
+   - Modification of their *chassis* → continue to question 4
+   - Encounter (clasp, witnessing, drug-grammar) → continue to question 4
+
+4. **Is the affected agent partnered?**
+   - Yes → triple hardstop (actor + affected + partner-witness; Variant 3)
+   - No → dual hardstop (actor + affected; Variant 2)
+
+5. **Does the action touch sumptuary-religious doctrine?**
+   - Specifically: gender-architecture of a service-body → **inquisition-trigger fires post-action**; the action proceeds under consent but the architectural counter-response activates
+   - Otherwise → ordinary bounty-staircase response if any imperial-detectable violation occurred (note: most consent-aligned actions are NOT imperial-detectable violations)
+
+**The register-test is mechanical enough that it can be run by an LLM-Compositor as a hook on any action-resolution.** The same enforcement-path that gender-parity.md uses for canon-authoring extends to consent-discipline at action-resolution time. **The spine doesn't enforce by author-vigilance; it enforces by register-typed-action-validation at the schema layer.**
+
+## How the three style-spines compose
+
+The three style-spine documents govern orthogonal axes; they compose without overriding each other:
+
+| Spine | Governs | Executable form |
+|---|---|---|
+| [`./trait-palette.md`](./trait-palette.md) | The 8-trait vocabulary; color-pairs; motion-signatures; the wheel's three load-bearing roles (visual / philosophical / mechanical) | Used by every domain that references trait-state |
+| [`./gender-parity.md`](./gender-parity.md) | How canon-authoring describes body / sex / intimacy / clasp / service-body / going-rogue content | Substitution-test (mechanical neutralization-rewrite) |
+| [`./consent-discipline.md`](./consent-discipline.md) *(this document)* | How actions are gated by register; truth-register protection; mirror-discipline floor; window-temporal-grammar; right-to-refuse; inquisition-trigger upper-pressure | Register-test (5-question mechanical procedure) |
+
+A future LLM-Compositor's output-validator can run all three tests on any output:
+- Does the output describe body/sex content gender-parity? (gender-parity substitution-test)
+- Does the output respect mesh-modification absolute floor and use the appropriate hardstop variant for cross-register transitions? (consent-discipline register-test)
+- Does the output use the canonical trait-vocabulary correctly? (trait-palette consistency-check)
+
+**Three spine-disciplines, three mechanical tests, three orthogonal axes — composing into a unified canon-authoring + action-resolution discipline that runs at the schema layer rather than via author-vigilance.**
+
+## What this rule does NOT do
+
+- **It does not regulate gameworld actions.** The vast majority of NPC and player actions live in the gameworld register and require no consent-mechanism. Walking, trading, talking, working assigned shifts — these are loose by design. The discipline is reserved for cross-register actions and truth-register modifications.
+- **It does not foreclose social interaction.** Consent-discipline gates *truth-register transitions and modifications*, not encounters per se. A clasp REQUIRES dual hardstops because clasp-entry into the in-between dimension is a truth-register transition; a casual conversation in a cantina REQUIRES no hardstops because it's gameworld interaction.
+- **It does not bind the imperium retroactively.** The imperial-vat-fabrication imposes binary at vat-time without consent — this is the imperium's politically-loaded act, and the architecture *does not retroactively legitimize it via consent-discipline*. The going-rogue arc and the post-rogue mod-vocation are the architecture's response to this — *de-imposition* as restoration of the un-imperial state.
+- **It does not replace gender-parity or trait-palette disciplines.** Consent-discipline is parallel to and composes with both. All three spine-disciplines compose without overriding each other.
+- **It does not gate imperial enforcement.** When an imperial event (drone-patrol, audit, inquisition) enters a citizen's zone, consent is structurally absent — *the imperium does not ask*. The architecture canonically permits this; the imperium's lack-of-consent IS its political character. The citizen's recourse is the going-rogue right-to-refuse OR resistance-mod-aided going-dark (anti-mnemosyne).
+- **It does not gate broadcast.** The imperial daily-narrative (per `../political-register/imperial-narrative.md` *forthcoming*) operates as broadcast; citizens hear it whether they consent or not. The imperium's voice IS one-way; the architecture acknowledges this rather than fixes it. *Broadcast is specter, not boot — cheap, ambient, structural.*
+
+## Cross-references into architecture domain files
+
+The consent-discipline's instances are scattered across the architecture; this spine codifies them. When this spine changes, those instances may need updates too (or they may reference back into here for canonical definition):
+
+| Instance | Where it lives | Variant |
+|---|---|---|
+| Coordinated-firewall-breach hardstop for in-between entry | architecture-index.md resolved-questions v0.10 + [`../identity-and-personhood/architecture.md`](../identity-and-personhood/architecture.md) §The clasp endgame | Variant 2 (dual) — *the canonical reference-implementation* |
+| Mutual-symmetric pill-take ritual | [`../identity-and-personhood/bodies.md`](../identity-and-personhood/bodies.md) §The mutual-consent ritual | Variant 2 (dual) |
+| Service-body non-consensual-dosing exception | [`../identity-and-personhood/bodies.md`](../identity-and-personhood/bodies.md) §The non-consensual-dosing exception | Consent-violation; bounty-staircase fires (preta-class) |
+| Body-disposal under pair-consent (sell / destroy / retain) | [`../identity-and-personhood/bodies.md`](../identity-and-personhood/bodies.md) §Body-disposal under pair-consent | Variant 2 with role-asymmetry |
+| Genital-mod self-install (unpartnered) | [`../identity-and-personhood/architecture.md`](../identity-and-personhood/architecture.md) §The three-stage install | Variant 4 (Variant 1 + cooldown) |
+| Genital-mod install (partnered) | [`../identity-and-personhood/architecture.md`](../identity-and-personhood/architecture.md) §The three-stage install | Variant 4 (Variant 3 + cooldown) |
+| Post-rogue NPC-modding (chassis-only, NPC unpartnered) | [`../identity-and-personhood/bodies.md`](../identity-and-personhood/bodies.md) §The post-rogue mod-vocation | Variant 2 |
+| Post-rogue NPC-modding (chassis-only, NPC partnered) | [`../identity-and-personhood/bodies.md`](../identity-and-personhood/bodies.md) §The post-rogue mod-vocation | Variant 3 |
+| Service-body gender-modification | [`../identity-and-personhood/bodies.md`](../identity-and-personhood/bodies.md) §Service-body gender-modification — the inquisition trigger | Variant 2 or 3 + inquisition-trigger upper-pressure |
+| Mesh-modification of any other agent | Forbidden across canon | **Mirror discipline absolute floor** |
+| Shift-assignment within work-window | [`../identity-and-personhood/vocations.md`](../identity-and-personhood/vocations.md) §The 24h window-partition | Imperial-imposition within caste-bounded work-window; refusing = going-rogue temporal-rebellion |
+| Leisure-window task-choice | [`../identity-and-personhood/vocations.md`](../identity-and-personhood/vocations.md) §The 24h window-partition | Full NPC agency; the window IS the consent-time; specific actions within still type-checked by the register-test |
+| Charging-window | [`../identity-and-personhood/vocations.md`](../identity-and-personhood/vocations.md) §The 24h window-partition | Not a consent-surface; somatic-necessity |
+| Imperial daily-narrative consumption | `../political-register/imperial-narrative.md` *(forthcoming)* | Not a consent-surface; broadcast (specter), not enforcement (boot) |
+| Imperial event arrival in citizen zone | `../runtime-engine/architecture.md` §Imperial-event encapsulation *(forthcoming)* | Not consent-gated by design; recourse is going-rogue / going-dark |
+
+## Open questions
+
+- **Concrete cooldown durations.** Mod-installation cooldowns are mandated in principle; the specific durations per mod-class (genital-mod / chassis-mod / register-mod) need design-research and balancing.
+- **Encrypted clasp.sqlite consent.** The Ring A* (per architecture-index.md) clasp.sqlite encryption is player-derived-key. Does the *backup* / *recovery* mechanism require dual-hardstop with the clasp-partner? Or does the player solo-control recovery? Hunch: solo-control with passphrase + recovery-codes; the partner's clasp-fragments live in their own clasp.sqlite, parallel-encrypted.
+- **Cross-tier consent-asymmetry.** When a deva-pinnacle and a slum-tiryak attempt clasp, the asymmetric-clasp canon (per [`../identity-and-personhood/bodies.md`](../identity-and-personhood/bodies.md) §Asymmetric clasp) gives them asymmetric mesh-fidelity. Does the consent-discipline apply equally? Hunch: yes — the dual hardstop is variant-invariant; only the *outcome* (partial-mutual-visibility) is asymmetric. Consent is symmetric even when the witnessed-truth is asymmetric.
+- **NPC-NPC encounter consent in the leisure-window.** When two NPCs encounter each other in leisure (cantina conversation, grid-walk meeting), is consent presumed by both being in their leisure-windows? Hunch: yes for non-truth-register encounters (conversation, presence); explicit dual hardstop required for any truth-register transition (clasp-attempt initiated within the encounter).
+- **Player-NPC consent-symmetry.** When the player initiates a clasp-attempt with an NPC, the player provides one hardstop and the NPC's consent-decision is computed from accumulated calibration-state + trait-fit. *The NPC's hardstop is computational, not player-controllable.* The asymmetry is structural — players have direct hardstop control; NPCs have computed consent. Should the gate-state (CLOSED / STABLE / OPEN) be visible to the player as a diegetic-readable register before they commit the hardstop? Hunch: yes — player should see the gate-state through diegetic environmental cues / NPC-body-language / relational-mod-readouts, not as UI numbers.
+- **Imperial-event consent-baseline.** Is there any scenario where imperial-events SHOULD pause for consent? Hunch: no; the imperium's lack-of-consent IS its political character. The asymmetry is preserved at the cosmological layer.
+- **Register-test edge cases.** Tasks that *appear* gameworld-only but accumulate trait-state that *will* affect the truth-register downstream (e.g., the gooner's cruelty accumulating Philotes-violation signatures that render in the mesh later — per [`../identity-and-personhood/architecture.md`](../identity-and-personhood/architecture.md) §The mesh-as-mirror) — does the register-test fire at action-time or at consequence-time? Hunch: action-time test reads as gameworld; consequence-time rendering is the mirror's honest-rendering, not a consent-violation. *The mesh-as-mirror operates by structural inevitability, not by violated consent.*
+
+---
+
+**Version:** 0.1 | **Created:** 2026-04-27 | **Updated:** 2026-05-01

style/gender-parity.md

@@ -0,0 +1,107 @@
+# Nimmerworld — Gender Parity
+
+> *Body and sex content is gender-parity by default. Asymmetric gendering is a vocabulary reserved for cases where the asymmetry itself is load-bearing — where some structural meaning would evaporate if the gendering were neutralized. Default-leakage gendering is forbidden by canon.*
+>
+> *Companion to: [`style-index.md`](./style-index.md), [`trait-palette.md`](./trait-palette.md), [`../architecture-index.md`](../architecture-index.md). Cross-referenced from every body / clasp / service-body / going-rogue section because those are the surfaces where this rule binds hardest.*
+
+---
+
+## Spine rule — gendered framing is reserved for load-bearing asymmetry
+
+**Body, sex, intimacy, clasp, service-body, going-rogue, outcast-pair, re-vat, and beloved-content is rendered in gender-parity register by default. Asymmetric gendering is permitted only where the asymmetry carries structural meaning that cannot be expressed without it. Default-leakage gendering — gender drift introduced unconsciously by the author's reach — is canonically forbidden.**
+
+**Why this matters.** Gender, like saturated chromatic color (per [`style-index.md`](./style-index.md) §Spine rule), is *vocabulary*. Reserving it for content where it *carries information* keeps it sharp when invoked. Most fiction lets gendered default-framing leak everywhere — *the companion is ever-feminine, the rescuer is ever-masculine, the beloved is ever-she* — and the gendering becomes ambient wallpaper rather than meaningful signal. Nimmerworld doesn't want gendered default-framing because the **whole architecture rests on body-as-political-vocation, body-as-caste-marker, body-as-imperial-product** (per [`../identity-and-personhood/bodies.md`](../identity-and-personhood/bodies.md)) — letting *gender* leak in as an extra default would mean the player reads the body before they read the *politics of the body*, and the politics is the whole point.
+
+**The trait-palette parallel is exact.** Where saturated chromatic color is reserved for trait-information and freed from environmental decoration, gendered framing is reserved for content where the gendering is the load-bearing register and freed from default-leakage on every other surface. *White is not coloring text — it is text. Gendered framing, when it appears, is not coloring the scene — it is the scene.*
+
+## Definitions — what is gender-parity, what is asymmetric gendering
+
+**Gender-parity** is the default register: pronouns are `they/their/them`; categories of people (vocations, castes, roles, body-tiers) are not gendered; archetypes are framed in role-terms (*the captive-bound-to-the-liberator*, not *the damsel-in-distress*); intimate content treats both partners as equally embodied, equally desiring, equally witnessing.
+
+**Asymmetric gendering** is the marked register: pronouns specify; categories carry gender; archetypes invoke gendered source-material; intimate content marks one body or position as gender-specific. The marked register is the *exception*, invoked only when its absence would erase structural meaning.
+
+**Default-leakage** is the forbidden case: gendered framing introduced by authorial reach without examination. The author writes *her* because *she* came easier than *they*; the category becomes *waifu* because the source-tradition was feminine-coded; the romantic beloved gets gendered because the writer's templates ran on autopilot. **Default-leakage is not a moral failing — it is a craft failing.** The contract exists to make the failure mode legible, not to assign blame.
+
+## When asymmetric gendering is load-bearing — three legitimate cases
+
+| Case | Test | Example |
+|---|---|---|
+| **Specific named individuals with canonical identity** | The character is a SPECIFIC person, not a TYPE of person. Their gender is part of who they are, established and tracked. | A particular district-director NPC who is canonically she/her in lore-database, named, with continuous identity across playthroughs. *Categories around them remain gender-parity*. |
+| **Source-material citation where gendering IS the citation** | The text invokes a classical / mythic / literary archetype whose source is irreducibly gendered, AND the source-gendering is the channel through which the meaning travels. | If a scholar-NPC quotes a Sapphic fragment in deep-lore context, the gendering is part of the citation, not a default. *Caveat: invoking the archetype neutrally first is preferred; gendered citation is fallback when neutralization would break the reference.* |
+| **Biological asymmetry where the asymmetry is the subject** | The content is *specifically about* a gender-asymmetric biological process (pregnancy, lactation, menstruation, hormonal-specifics) AND the asymmetry is the load-bearing axis of the scene. | Vat-fabrication that *deliberately differentiates by reproductive function* in the imperial bio-engineering register. **Almost never required** — most body-canon in nimmerworld is post-fabrication, sumptuary, and politically-marked rather than biologically-marked. |
+
+**All three cases share a test**: rewrite the passage with `they/them` and gender-neutral category-language. *Does some structural meaning evaporate?* If yes — load-bearing, asymmetric gendering permitted. If no — neutralize.
+
+## When asymmetric gendering is forbidden — the default-leakage cases
+
+**These patterns appear when the author reaches for templates without examining them.** All four were observed and patched in the v0.19 cleanup pass (commit `781aafa`); the contract exists to prevent recurrence.
+
+| Pattern | What it looks like | Why it leaks |
+|---|---|---|
+| **Categorical default-gendering** | A vocation, body-tier, or role that names itself in a gendered loanword (*waifu*, *succubus*, *femme-fatale*) when the role-content itself is not gender-specific. | The source-tradition was gendered; the borrowing carried the gendering through unexamined. *Patch: split the category into role-specific terms. v0.19 split `waifu` → `companion` + `sex-worker`*. |
+| **Pronominal asymmetry in scene-blocks** | A section about a category of people uses gendered pronouns 27 times in one direction, ~zero in the other (the specific count from v0.19's bodies.md going-rogue / outcast-pair / re-vat audit). | The author's templates default to one gender; once the first pronoun lands, downstream pronouns chain through that gender by inertia. *Patch: full pass to `they/their/them`*. |
+| **Archetype-gendering in role-symmetric scenes** | A classical archetype whose role-asymmetry is structural (rescuer / rescued, witness / witnessed, captive / liberator) gets imported with its source-tradition's gender-coding intact. | The archetype carries a *role-asymmetry* that IS load-bearing; the *gender-asymmetry* attached to it in source-material is **not** load-bearing — it's a contingent decoration of the original cultural context. *Patch: keep the role-asymmetry, neutralize the gender-asymmetry. v0.19 rewrote §The damsel-in-distress activation as §The captive-bound-to-the-liberator activation*. |
+| **Romantic / cosmological one-liners** | Stray gendered phrases in passing examples (*moving the waifu*, *the bride's awakening*) inside scenes that are not about gender. | The example was incidental; the gendering was reached for as flavoring. *Patch: substitute role-terms (`the beloved`, `the partner`)*. |
+
+**Each of the four has a structural failure-mode the contract is designed to catch.** The tests in §When asymmetric gendering is load-bearing answer all four — no member of any leakage-pattern can pass them.
+
+## Propagation — where this rule binds in the architecture
+
+The contract propagates *everywhere body / sex / intimate / relational content is rendered or generated*. Concretely, it binds these surfaces:
+
+| Surface | What the rule requires |
+|---|---|
+| **Body-canon authoring** ([`../identity-and-personhood/bodies.md`](../identity-and-personhood/bodies.md), §Service bodies, §Sumptuary fabrication, §Asymmetric clasp, §The going-rogue arc, §The outcast-pair, §Re-vat outflow, §The three-body grammar) | Categories are gender-parity by default. Pronouns are `they/their`. Archetypes are framed in role-terms. *This is the spine where the rule was first established (v0.4 of bodies.md, v0.19 of architecture-index.md)*. |
+| **Cosmology authoring** ([`../imperial-cult/cosmology.md`](../imperial-cult/cosmology.md), §The deferred-moksha doctrine, §There is no outside) | Cosmological one-liners use role-terms (*the beloved*, not *the waifu*). Doctrinal voice is gender-parity unless the citation requires asymmetry per Case 2 above. |
+| **Vocation-substrate authoring** ([`../political-register/architecture.md`](../political-register/architecture.md), §The vocation-substrate of the imperial-net market) | Vocations are not gendered. Service-body-of-the-dead, memory-pattern-extractor, tongue-installer, assembler-artisan, lobotomist — all neutral by default. |
+| **Inference / memory schema** ([`../inference-and-memory/architecture.md`](../inference-and-memory/architecture.md)) | Database filenames and schema-field names use role-terms (`companion.sqlite`, not `waifu.sqlite`). v0.19's rename and explicit scope-clarifier-sentence is the canonical example. |
+| **Compositor narrative output** ([`../narrative-composition/architecture.md`](../narrative-composition/architecture.md)) | LLM-authored canon-rows must satisfy the contract. The substitution-test should be a Compositor *output-validator* hook before back-write. |
+| **NPC speech corpora** | NPC dialog templates are gender-parity by default. Specific NPCs with canonical identity (Case 1) may speak in gendered terms about themselves; speech *about categories* of others is neutral. |
+| **Universal-translator corpus** ([`../player-experience/architecture.md`](../player-experience/architecture.md), §Designer-fixed cosmology) | The word-to-trait mapping does not carry gender-coding through trait-palette assignment. Categories that get translated retain their gender-parity register. |
+| **Player input** | The player's typed/spoken language is *not* policed — players use whatever pronouns they reach for. The contract binds **canon-authoring**, not player utterance. |
+| **NPC body rendering** ([`../topology-and-rendering/architecture.md`](../topology-and-rendering/architecture.md)) | The base-limb palette and trait-textured variance do not encode default-gendering at the chassis level. Chassis carry caste-tier marks, vocation-marks, and trait-state — not gender-defaults. |
+
+**This is the body / sex / intimacy register's typed contract.** Anywhere the architecture authors content that touches a body, this rule fires.
+
+## The substitution test — the contract's executable form
+
+Any passage in body / sex / intimate / relational content can be checked by mechanical substitution:
+
+1. **Replace** all gendered pronouns with `they/their/them`.
+2. **Replace** any gendered category-name with a role-term.
+3. **Replace** any archetype-invocation with its role-structure.
+4. **Read** the result.
+
+**Verdict:**
+- If the result preserves all structural meaning → the original was default-leakage. **Apply the substitution.**
+- If the result loses structural meaning → the original was load-bearing. **Document why** (one of Cases 1, 2, 3 in §When asymmetric gendering is load-bearing) inline or in a `<!-- gender-parity-exception: case-N -->` comment so future readers know the asymmetry was deliberate.
+
+**The test is mechanical enough that it can be run by an LLM-Compositor as a hook on any body-canon-authoring output.** That's the long-term enforcement path: the contract binds at the schema-level via output-validation, not via per-author vigilance.
+
+## What this rule does NOT do
+
+- **It does not regulate player utterance.** Players speak in whatever gendered language they reach for. The contract binds the world-as-authored, not the player-as-acting.
+- **It does not erase named NPCs' identities.** A specific NPC who is canonically she/he/they remains so — Case 1 covers them. The contract is about *categories and scenes*, not individuals.
+- **It does not require synthetic neutrality in lore-citations.** Case 2 protects citation-integrity when the gendering is part of the source.
+- **It does not deny biological asymmetry where the asymmetry is the subject.** Case 3 covers genuinely gender-asymmetric biological content. Most nimmerworld body-content is post-fabrication and politically-marked, so Case 3 is rarely invoked, but it is not foreclosed.
+- **It does not police trait-vocabulary by gender.** The 8 Hellenic traits do not carry gender-defaults; the trait-palette and gender-parity contract are *orthogonal* spine-rules that compose cleanly.
+
+## Cross-references into architecture domain files
+
+The gender-parity contract is referenced from architecture sections where body / sex / intimate / relational content is authored. When this contract changes, those sections may need updates too (or they may reference back into here for canonical definition):
+
+| What | Where it's referenced architecturally |
+|---|---|
+| Service-body taxonomy + companion / sex-worker split | [`../identity-and-personhood/bodies.md`](../identity-and-personhood/bodies.md) §Service bodies |
+| Service-body honeypot + companion-honeypot deepening | [`../identity-and-personhood/bodies.md`](../identity-and-personhood/bodies.md) §The service-body honeypot |
+| Going-rogue arc + outcast-pair geometry + re-vat outflow | [`../identity-and-personhood/bodies.md`](../identity-and-personhood/bodies.md) §The going-rogue arc through §The three-body grammar of the defected beloved |
+| The captive-bound-to-the-liberator archetype (Stockholm-dynamics-inverted) | [`../identity-and-personhood/bodies.md`](../identity-and-personhood/bodies.md) §The captive-bound-to-the-liberator activation |
+| Imperial Cult doctrinal one-liners + deferred-moksha refutation phrasings | [`../imperial-cult/cosmology.md`](../imperial-cult/cosmology.md) §The deferred-moksha doctrine |
+| Vocation-substrate of the imperial-net market (companions, sex-workers, harvest-vocations) | [`../political-register/architecture.md`](../political-register/architecture.md) §The vocation-substrate of the imperial-net market |
+| `companion.sqlite` per-player local database + scope-clarifier sentence | [`../inference-and-memory/architecture.md`](../inference-and-memory/architecture.md) §Local memory architecture |
+| Compositor canon-authoring as the LLM enforcement-point | [`../narrative-composition/architecture.md`](../narrative-composition/architecture.md) (Compositor output-validation hook — pending implementation) |
+| Universal-translator corpus + player-curated trait-circle gender-neutrality | [`../player-experience/architecture.md`](../player-experience/architecture.md) §Designer-fixed cosmology |
+
+---
+
+**Version:** 0.1 | **Created:** 2026-04-27 | **Updated:** 2026-04-27

style/style-index.md

@@ -0,0 +1,63 @@
+# Nimmerworld — Style Index
+
+> *Visual language is its own typed contract. This file is the cross-domain index of all visual / aesthetic / UI decisions, pointing at canonical sub-guides and enforcing consistency across the architecture's nine domain files.*
+>
+> *Companion to: [`../architecture-index.md`](../architecture-index.md). Sub-guides live alongside this file in `nimmerworld/style/`.*
+
+---
+
+## Spine rule — the achromatic / chromatic discipline
+
+**The 8 trait-palette is exclusively chromatic. Achromatic colors are reserved for UI / environment / decay.** This is the load-bearing constraint that makes diegetic text rendering possible without overlay-boxes:
+
+| Palette | Reserved for |
+|---|---|
+| **8 saturated chromatic hues** (the trait-wheel) | The 8 traits — and only the 8 traits |
+| **White** | Text and pure-light UI overlay |
+| **Black** | Shadows, voids, the imperial-net's deep-strip |
+| **Greys** | Neutral defaults — NPCs without active trait-pulse, ambient surfaces |
+| **Browns / earth tones** | Aged surfaces, decayed materials, the rust-and-patina layer |
+
+**Why this matters.** Color is *vocabulary*; reserving it for *information* (trait-state) keeps the achromatic palette free for the *medium* that carries the information (text, neutral environment, depth). Most games end up with textbox-everywhere because they let saturated colors leak into environmental art, forcing text-on-box for legibility. Nimmerworld doesn't need the textbox because nothing is competing for white's luminance slot — *white means one thing: you're being told something*.
+
+**This rule propagates everywhere.** Any new visual element must respect it:
+
+- A new mod-class CANNOT introduce a saturated chromatic accent unrelated to a trait-coordinate
+- A new faction's heraldry CANNOT use a chromatic color outside the trait-palette
+- A new shader register CANNOT use saturated chromatic tones for environmental fidelity
+- Decorative environmental color MUST be muted (browns / greys / desaturated tones) to keep the trait-wheel's meaning intact
+
+When in doubt, ask: *does this color carry trait-information, or is it decorative?* If decorative, desaturate. If trait-information, use the canonical wheel-position from [`trait-palette.md`](./trait-palette.md).
+
+## Sub-guides
+
+| Sub-guide | What it covers | Status |
+|---|---|---|
+| [`trait-palette.md`](./trait-palette.md) | The 8 traits on the color wheel, 4 oppositional pairs at 180°, schoolchild-descriptions, motion-signatures | ✓ canonical (v0.1) |
+| [`gender-parity.md`](./gender-parity.md) | The gender-parity-by-default rule for body / sex / intimacy / clasp / service-body / going-rogue / outcast-pair / re-vat content; the three load-bearing-asymmetry exception cases; the four default-leakage failure modes; the substitution-test as the contract's executable form | ✓ canonical (v0.1) |
+| [`consent-discipline.md`](./consent-discipline.md) | The consent-spine: the gradient that scales with what the action touches; the four hardstop-pattern variants (self / dual / triple / cooldown-augmented); the mirror-discipline that absolutely forbids mesh-modification of other agents; the temporal-grammar (24h window-partition); the right-to-refuse imperial-imposition (going-rogue temporal-breakout); the inquisition-trigger upper-pressure; the register-test as the spine's executable form | ✓ canonical (v0.1) |
+| `typography.md` | Text rendering, hierarchy, no-textbox commitment, the white-as-text-only semantic-slot | TODO |
+| `shaders-by-register.md` | Three-shader philosophy: gameworld PBR / liminal blur / imperial-net emission; clasp candlelight-in-fog override; clasp color-merge | TODO |
+| `body-feedback.md` | NPC body-pulse rules during gesture-alignment; trait-flash event-vocabulary; cross-cycle trait-drift rendering | TODO |
+| `ui-elements.md` | Gesture-circle UI styling, universal-translator tokenizer-view, profile-switch indicator, hardstop visual-distinct treatment | TODO |
+| `relays.md` | Diegetic-relay visual vocabulary, pulse-pattern lexicon (slow / fast / irregular / cross-district shimmer / dark) | TODO |
+| `asset-aesthetic.md` | Base-limb texture rules, mod aesthetic registers per faction, muted-melancholic environmental treatment | TODO |
+
+Sub-guides will be filled out as visual decisions land. The skeleton plus `trait-palette.md` is the v0.1 spine; everything else grows from there.
+
+## Cross-references into architecture domain files
+
+The trait-palette is referenced from many architectural primitives. When `trait-palette.md` changes, these sections may need updates too (or they may reference back into here for canonical definitions):
+
+| What | Where it's referenced architecturally |
+|---|---|
+| Trait-color rendering on NPC bodies | [`../topology-and-rendering/architecture.md`](../topology-and-rendering/architecture.md) §Color-language |
+| Trait-color flashes on gesture-alignment | [`../runtime-engine/architecture.md`](../runtime-engine/architecture.md) §Phase-locked overlay-loop ladder + §Gesture-alignment as recursive-lemniscate |
+| Gesture-circle UI placement of trait-sectors | [`../player-experience/architecture.md`](../player-experience/architecture.md) §The trait-circle as gestural primary modality |
+| Color-coding of mod-classes | [`../identity-and-personhood/architecture.md`](../identity-and-personhood/architecture.md) §Mods as trait-bearers |
+| Color-coding in three-shader philosophy | [`../topology-and-rendering/architecture.md`](../topology-and-rendering/architecture.md) §Visual rendering |
+| Faction color-politics | [`../topology-and-rendering/architecture.md`](../topology-and-rendering/architecture.md) §Color-language → Faction color-politics table |
+
+---
+
+**Version:** 0.3 | **Created:** 2026-04-26 | **Updated:** 2026-04-27

style/trait-palette.md

@@ -0,0 +1,145 @@
+# Nimmerworld — Trait Palette
+
+> *The 8 personal traits, their canonical Greek names, schoolchild-simple descriptions, color-wheel positions, and motion-signatures. The trait-palette is the spine of the entire visual / linguistic / cognitive system — everything in nimmerworld either preserves the spine or violates it.*
+>
+> *Companion to: [`style-index.md`](./style-index.md), [`../architecture-index.md`](../architecture-index.md). Cross-referenced from every architecture domain file because the trait-vocabulary is what those files all run on.*
+
+---
+
+## The 8 traits — Greek canonical names + schoolchild descriptions
+
+The architecture has been using *Hellenic personality-virtues* as the trait-cosmology since v0.4. The names are kept for their literary depth and faction-naming use. The descriptions are written at schoolchild-level so they travel through subtitles, NPC speech, tutorial text, and the universal-translator tokenizer-view without ever needing a glossary.
+
+| Greek name | Schoolchild description |
+|---|---|
+| **Sophrosyne** | *holding back when I want to act* |
+| **Dikaiosyne** | *standing for what's fair* |
+| **Philotes** | *loving and staying close* |
+| **Mnemosyne** | *remembering what mattered* |
+| **Aletheia** | *seeing what's hidden* |
+| **Kairos** | *catching the right moment* |
+| **Moira** | *reading what's coming* |
+| **Eros** | *reaching for what I want* |
+
+**Players read the descriptions in everyday play; the Greek names live in faction-naming, deep-lore, scholar-NPC speech, and Memorialist-archive context.** A player can complete the entire game without ever consciously learning the Greek names — the trait-vocabulary travels through colors and descriptions. Players who lean into the depth discover the classical-philosophical lineage as a deeper-tier reward (Souls-game discipline applied to vocabulary).
+
+## The wheel — 4 oppositional pairs at 180°
+
+**The traits form 4 natural oppositional pairs.** The 12-segment artist's color wheel renders these as direct complementary pairs (180° apart on the wheel) — visual contrast carries the philosophical opposition.
+
+| Pair | The opposition | Wheel positions (180° apart) |
+|---|---|---|
+| **Eros ↔ Sophrosyne** | reaching for ↔ holding back | **Red ↔ Green** |
+| **Philotes ↔ Dikaiosyne** | loving close ↔ standing fair (partial ↔ impartial) | **Orange ↔ Blue** |
+| **Aletheia ↔ Moira** | seeing what's hidden ↔ reading what's coming (past-revealed ↔ future-fated) | **Yellow ↔ Violet** |
+| **Mnemosyne ↔ Kairos** | remembering what mattered ↔ catching the right moment (past-dwelling ↔ present-piercing) | **Red/Violet ↔ Yellow/Green** |
+
+**Why this is the right move.** Complementary pairs maximize perceptual contrast (Red and Green can never be confused at a glance) AND carry the trait-system's *philosophical structure* (the trait-pair is the moral/dramatic axis the simulation is built around). When two NPCs in conversation pulse with complementary colors, the *opposition is felt* — Red-Eros longing pressing against Green-Sophrosyne restraint becomes a chromatic conflict the player reads pre-verbally. **The color wheel does the dramaturgy for free.**
+
+**Each pair is a real philosophical axis the architecture has been quietly relying on:**
+
+- *Reaching ↔ Holding* — the structural tension the clasp-mechanic lives inside (you reach toward your beloved; you hold back to stay disciplined for your shift)
+- *Partial ↔ Impartial* — the eternal classical tension of justice-vs-love (Antigone, Lear). Architecturally: love-the-bonded vs serve-the-fair
+- *Past-revealed ↔ Future-fated* — Aletheia uncovers what was buried; Moira reads what was always coming. Time-axis bookends
+- *Past-dwelling ↔ Present-piercing* — Memorialist-honor-the-dead vs Kairic-strike-now. Two ways of being-in-time the regime tries to police separately
+
+## The full table — canonical-name + hex + motion-signature + description per trait
+
+| Greek | Description | Hue | Canonical name | Hex | Wheel position | Motion-signature |
+|---|---|---|---|---|---|---|
+| **Eros** | reaching for what I want | **Red** | `Eros-red` | `#ee1b24` | 12:00 | uneven flame-flicker |
+| **Philotes** | loving and staying close | **Orange** | `Philotes-orange` | `#e28a46` | 1:30 | breath-rate warm pulse |
+| **Aletheia** | seeing what's hidden | **Yellow** | `Aletheia-yellow` | `#fcf001` | 3:00 | clear, no pulse — still and bright |
+| **Kairos** | catching the right moment | **Yellow/Green** (chartreuse) | `Kairos-chartreuse` | `#b5e61d` | 4:30 | lightning-flicker |
+| **Sophrosyne** | holding back when I want to act | **Green** | `Sophrosyne-green` | `#2cad52` | 6:00 | steady, even pulse |
+| **Dikaiosyne** | standing for what's fair | **Blue** | `Dikaiosyne-blue` | `#3f47cd` | 7:30 | weighted slow pulse |
+| **Moira** | reading what's coming | **Violet** | `Moira-violet` | `#a349a3` | 9:00 | slow-thread undulation |
+| **Mnemosyne** | remembering what mattered | **Red/Violet** (dusky-rose) | `Mnemosyne-dusky-rose` | `#cf3b74` | 10:30 | depth-shimmer |
+
+**Motion-signature paired with color provides color-blind accessibility** — every trait is uniquely identifiable via two independent channels. A player with red-green color blindness still distinguishes Eros (uneven flame-flicker) from Sophrosyne (steady, even pulse) by motion alone.
+
+**Canonical-name + hex paired provides cross-pipeline identifiability** — every trait-color reference carries two independent channels, semantic (canonical-name for prose, training-corpus extraction, scholar-NPC speech, faction-naming, LLM context) and precise (hex for shaders, renderers, color-pickers, machine-checkable canon enforcement). See §The hex-canon discipline below.
+
+## Wheel layout (clockwise from 12 o'clock)
+
+```
+                Eros
+             #ee1b24
+          ╔═════════════╗
+   Mnemosyne          Philotes
+   #cf3b74          #e28a46
+        │                 │
+   Moira ────────●──── Aletheia
+   #a349a3            #fcf001
+        │                 │
+  Dikaiosyne           Kairos
+  #3f47cd            #b5e61d
+          ╚═════════════╝
+              Sophrosyne
+                #2cad52
+```
+
+**The wheel's natural temperature-axis aligns with the architecture's dramatic structure.** Warm side (Eros, Mnemosyne, Philotes, Aletheia, Kairos) carries *outward / present-active / engaged* registers; cool side (Sophrosyne, Dikaiosyne, Moira) carries *inward / withholding / contemplative* registers. Aletheia at 3:00 sits at the brightness-zenith; Sophrosyne at 6:00 sits at the cool-balance-base; Eros at 12:00 sits at the heat-apex.
+
+## The achromatic exception — Aletheia is *not* white
+
+In earlier drafts (the v0.1 design-vision doc, retired in v0.9 — preserved in git history), Aletheia was rendered as luminous-white (off-the-wheel, achromatic). v0.1 of this trait-palette places Aletheia on **Yellow** — the brightest chromatic hue. The metaphor of *truth as illumination* is preserved (Yellow is the brightest color the eye can read), and white is freed up for its proper job: rendering text and pure-light UI overlay (per [`style-index.md`](./style-index.md) §Spine rule).
+
+This is a **deliberate constraint** — the trait-palette is exclusively chromatic so that achromatic colors (white, black, grey, brown) remain reserved for non-trait roles. *Aletheia is bright, not transcendent; the brightness IS the truth-revealing register.*
+
+## The hex-canon discipline — canonical-name + #hex at every trait-color reference
+
+**Every trait-color reference in the architecture pairs canonical-name with hex value.** The canonical-name pattern is `{Trait}-{hue}` lowercase — `Eros-red`, `Philotes-orange`, `Aletheia-yellow`, `Kairos-chartreuse`, `Sophrosyne-green`, `Dikaiosyne-blue`, `Moira-violet`, `Mnemosyne-dusky-rose`. The two channels serve two audiences:
+
+- **Canonical-name** — semantic anchor for prose, training-corpus extraction, scholar-NPC speech, faction-naming, and any LLM context where the trait-color binding must survive tokenization
+- **Hex** — designer/tooling precise value for shaders, renderers, color-pickers, and machine-checkable canon enforcement
+
+**Format conventions.**
+
+| Context | Form | Example |
+|---|---|---|
+| Trait is the subject | `**Trait** (canonical-name `#hex`, …)` | `**Eros** (Eros-red `#ee1b24`, 12:00)` |
+| Color/hue is the subject | `canonical-name (`#hex`)` | "shader pulses with Philotes-orange (`#e28a46`)" |
+| Schema/data row | both columns or token+value | `('eros', '#ee1b24', …, 'Eros-red', …)` |
+
+**Scope (current).** The hex-canon discipline applies to *trait-color references* only. Non-trait colors (machine-aesthetic palette: gold rim-light, commercial-coral, fluorescent-pallor, lavender-decor, obsidian-black, cyan, matrix-green; historical-sumptuary references: Tyrian purple; cinematic references: Matrix red-pill) carry their existing prose-form names. Each non-trait design domain receives canonical-name + hex pairings *recursively, at the moment that domain comes into architectural focus* — names follow design-attention, not the other way around.
+
+**Mechanically-checkable.** Canon-violations are a single grep against the architecture-papers, excluding this canonical source:
+
+```bash
+grep -rEn --include='*.md' '\b(red|orange|yellow|green|blue|violet|purple|chartreuse)\b' \
+  --exclude=trait-palette.md \
+  | grep -v '#[0-9a-fA-F]\{6\}'
+```
+
+Any hit that *isn't* paired with a hex code on the same line is either (a) a trait-color reference missing its hex pairing (canon-violation, fix), (b) a non-trait color reference (machine-aesthetic, narrative-shorthand, historical-sumptuary — currently exempt, will be canonicalized when its design domain comes into focus), or (c) a medical/cinematic/historical compound-term ("red-green color blindness", "Matrix red-pill", "Tyrian purple"). The discipline becomes a typed contract rather than a stylistic suggestion.
+
+**Where this is applied today.** The trait-table in [`../identity-and-personhood/architecture.md`](../identity-and-personhood/architecture.md) §The trait-to-body-part bridge; the faction-uniform table in [`../topology-and-rendering/architecture.md`](../topology-and-rendering/architecture.md) §Faction color-politics; the trait-color seed-data in [`../schemas/findings.md`](../schemas/findings.md) §trait_colors; cosmetic-shader prose in [`../runtime-engine/architecture.md`](../runtime-engine/architecture.md). Future expansions (cosmology-aesthetic, machine-aesthetic, faction-accent, drug-pill chromatics) will join recursively as they're authored.
+
+## Designer-fixed corpus — words to colors
+
+Every word in the universal-translator's vocabulary corpus is mapped to one (or a primary + secondary) trait-coordinate. The mapping is **designer-authored, fixed, universal** — the same word means the same trait-color for every player and every NPC and every LLM-context.
+
+When a player encounters a word in the world, the universal-translator's tokenizer-view renders that word in its trait-color (or fragmentary / opaque if untranslated). **Over hundreds of hours of play the player learns the trait-cosmology *through observation, not glossary*.** The corpus is the typed contract that closes the player-LLM hallucination-surface (per [`../player-experience/architecture.md`](../player-experience/architecture.md) §Designer-fixed cosmology, player-curated arrangement).
+
+## Cross-domain rendering — where trait-colors appear
+
+The trait-palette is rendered across many surfaces. Each surface gets specific style-rules in the relevant sub-guide:
+
+| Surface | Sub-guide |
+|---|---|
+| NPC chassis pipe-flow + accents | `body-feedback.md` |
+| Gesture-circle UI sectors | `ui-elements.md` |
+| Universal-translator tokenizer-view word-coloring | `ui-elements.md` |
+| Mod cosmetic accents (within trait-bearer rules) | `asset-aesthetic.md` |
+| Diegetic relay pulses | `relays.md` |
+| Faction heraldry | `asset-aesthetic.md` |
+| Liminal / imperial-net shader transformations of the palette | `shaders-by-register.md` |
+
+**The trait-palette defined here is the canonical reference.** All sub-guides import these definitions; none redefine them.
+
+**The 8 traits compose onto the cosmology's outer ring.** Per [`../imperial-cult/cosmology.md`](../imperial-cult/cosmology.md) §The composed wheel, the 8 Hellenic traits form the outer ring of the cosmology's composed wheel, vertically-symmetric on Deva (top, cool-side: Sophrosyne + Dikaiosyne) and Naraka (bottom, warm-side: Eros + Philotes), with side-castes carrying single traits (Asura: Mnemosyne; Tiryak: Aletheia; Preta: Kairos; Manusya: Moira). All four oppositional pairs preserved at 180°. The composed wheel renders both as in-fiction iconography AND as the player's UI substrate (per [`../runtime-engine/event-zones.md`](../runtime-engine/event-zones.md) §The wheel — universal mini-game-surface and [`../player-experience/architecture.md`](../player-experience/architecture.md) §The wheel — composed-iconography UI).
+
+---
+
+**Version:** 0.2 | **Created:** 2026-04-26 | **Updated:** 2026-05-01

tools/imperial-typewriter/.gitignore

@@ -0,0 +1 @@
+output/

tools/imperial-typewriter/test-words.csv

@@ -0,0 +1,6 @@
+# test wordlist for imperial-typewriter — comments and blank lines are skipped
+DAFIT
+MOIRA
+NIMMER
+EROS
+SOPHROSYNE

tools/imperial-typewriter/typewriter.py

@@ -0,0 +1,190 @@
+#!/usr/bin/env python3
+"""Imperial typewriter — compose imperial-tongue words from glyph PNGs.
+
+Reads glyph assets from the closed studio repo; writes composed word PNGs
+to an output directory for VLM-decoder training data generation.
+
+Composition is glyph-cell-tight (no gap between glyphs) — matches the
+in-game inscription-typing layout. The imperial machine always screams:
+input is auto-uppercased before composition.
+"""
+
+import argparse
+import csv
+import sys
+from pathlib import Path
+
+from PIL import Image
+
+DEFAULT_STUDIO_ROOT = "/home/dafit/nimmerverse/studio.nimmerworld.eachpath.local"
+DEFAULT_GENERATION = "03"
+DEFAULT_RESOLUTION = "512x1024"
+
+VOWELS = set("AEIOUY")
+CONSONANTS = set("BCDFGHJKLMNPQRSTVWXZ")
+DIGITS = set("0123456789")
+
+CATEGORY_INFO = {
+    "vowel": ("vowels", "vowel"),
+    "consonant": ("consonant", "consonant"),
+    "number": ("numbers", "number"),
+}
+
+
+def category_for(char: str) -> tuple[str, str]:
+    """Return (category-dir-name, file-prefix) for a single character."""
+    if char in VOWELS:
+        return CATEGORY_INFO["vowel"]
+    if char in CONSONANTS:
+        return CATEGORY_INFO["consonant"]
+    if char in DIGITS:
+        return CATEGORY_INFO["number"]
+    raise ValueError(f"No imperial-tongue glyph for character: {char!r}")
+
+
+def glyph_path(
+    char: str,
+    polarity: str,
+    studio_root: str,
+    generation: str = DEFAULT_GENERATION,
+    resolution: str = DEFAULT_RESOLUTION,
+) -> Path:
+    cat_dir, prefix = category_for(char)
+    suffix = "_neg" if polarity == "negative" else ""
+    filename = f"{prefix}_{char}_{resolution}{suffix}.png"
+    return (
+        Path(studio_root)
+        / "imperial-cult"
+        / "assets"
+        / "imperial-tongue"
+        / cat_dir
+        / generation
+        / f"{prefix}_{char}"
+        / filename
+    )
+
+
+def compose_word(
+    word: str,
+    polarity: str,
+    studio_root: str,
+    generation: str = DEFAULT_GENERATION,
+    resolution: str = DEFAULT_RESOLUTION,
+) -> Image.Image:
+    glyphs = []
+    for char in word:
+        path = glyph_path(char, polarity, studio_root, generation, resolution)
+        if not path.exists():
+            raise FileNotFoundError(f"Missing glyph asset: {path}")
+        glyphs.append(Image.open(path).convert("RGBA"))
+
+    width = sum(g.width for g in glyphs)
+    height = max(g.height for g in glyphs)
+    composed = Image.new("RGBA", (width, height), (0, 0, 0, 0))
+
+    x = 0
+    for g in glyphs:
+        composed.paste(g, (x, 0), g)
+        x += g.width
+
+    return composed
+
+
+def words_from_csv(path: Path) -> list[str]:
+    """Read words from a CSV file. Takes the first column of each non-empty row.
+    Skips blank rows and rows whose first cell is empty or starts with '#'."""
+    words = []
+    with open(path, newline="") as f:
+        reader = csv.reader(f)
+        for row in reader:
+            if not row:
+                continue
+            cell = row[0].strip()
+            if not cell or cell.startswith("#"):
+                continue
+            words.append(cell)
+    return words
+
+
+def render_one(
+    word: str,
+    output_dir: Path,
+    polarities: list[str],
+    studio_root: str,
+    generation: str,
+    resolution: str,
+) -> None:
+    word = word.upper()
+    for pol in polarities:
+        img = compose_word(word, pol, studio_root, generation, resolution)
+        suffix = "_neg" if pol == "negative" else ""
+        out_path = output_dir / f"{word}{suffix}.png"
+        img.save(out_path)
+        print(f"wrote {out_path} ({img.width}x{img.height})")
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(
+        description="Imperial typewriter — compose imperial-tongue words from glyph PNGs.",
+    )
+    source = parser.add_mutually_exclusive_group(required=True)
+    source.add_argument(
+        "word",
+        nargs="?",
+        help="A single Latin word to compose. Auto-uppercased (imperial machine always screams).",
+    )
+    source.add_argument(
+        "--csv",
+        type=Path,
+        help="Path to a CSV/wordlist file. First column of each non-empty, non-'#'-prefixed row is used as a word.",
+    )
+    parser.add_argument(
+        "--output",
+        type=Path,
+        default=Path("./output"),
+        help="Output directory (created if missing). Default: ./output",
+    )
+    parser.add_argument(
+        "--polarity",
+        choices=["positive", "negative", "both"],
+        default="both",
+        help="Which polarity to render. Default: both",
+    )
+    parser.add_argument(
+        "--studio-root",
+        default=DEFAULT_STUDIO_ROOT,
+        help=f"Path to studio repo root. Default: {DEFAULT_STUDIO_ROOT}",
+    )
+    parser.add_argument(
+        "--generation",
+        default=DEFAULT_GENERATION,
+        help=f"Resolution generation subdir. Default: {DEFAULT_GENERATION}",
+    )
+    parser.add_argument(
+        "--resolution",
+        default=DEFAULT_RESOLUTION,
+        help=f"Glyph resolution. Default: {DEFAULT_RESOLUTION}",
+    )
+
+    args = parser.parse_args()
+
+    args.output.mkdir(parents=True, exist_ok=True)
+    polarities = ["positive", "negative"] if args.polarity == "both" else [args.polarity]
+
+    if args.csv:
+        words = words_from_csv(args.csv)
+        if not words:
+            print(f"no words found in {args.csv}", file=sys.stderr)
+            sys.exit(1)
+        print(f"composing {len(words)} word(s) from {args.csv}")
+        for word in words:
+            try:
+                render_one(word, args.output, polarities, args.studio_root, args.generation, args.resolution)
+            except (ValueError, FileNotFoundError) as e:
+                print(f"  skip {word!r}: {e}", file=sys.stderr)
+    else:
+        render_one(args.word, args.output, polarities, args.studio_root, args.generation, args.resolution)
+
+
+if __name__ == "__main__":
+    main()

topology-and-rendering/architecture.md

@@ -0,0 +1,191 @@
+# Topology and Rendering
+
+> *The visible world: rail+grid topology with navmesh interiors and freeform-player; asset economy as base-limb palette × trait-textured variance (worldbuilding-thesis and engineering-economy in agreement); color-language as pre-verbal trait-vocabulary; the three-shader philosophy that renders the same geometry as physical / liminal / imperial-net depending on access; diegetic relays making the architecture's pulses audible and visible in-world.*
+>
+> *Companion to: `architecture-index.md` (executive summary + global meta-lists), `runtime-engine/architecture.md` (zones live on this topology), `identity-and-personhood/architecture.md` (color-language uses the trait-vocabulary). Sections in this file were split from the monolithic architecture-index.md v0.7 on 2026-04-26.*
+
+## Topology: rail + grid + interiors
+
+**The world's topology encodes its politics.** The machine built infrastructure for industrial optimization, not for human pedestrian freedom. Therefore the outer world is **rail+grid** — cells connected by named edges with rich semantic metadata. NPCs traverse rails as part of their shift-routines; the player traverses freeform (navmesh) and may **plug into NPC rail-traversals** for co-walking. Interiors (hovels, cantinas, workshops, ruins, brothels-physical) are **navmesh-enabled small zones** with interaction-slot inventories.
+
+### Rail+grid as political topology
+
+Navmesh is the topology of power-fantasy ("you are the protagonist of free trajectory"). Rail+grid is the topology of bounded-agency ("you live within infrastructure built for something else"). Nimmerworld picks rail+grid because the fiction *requires* it — the world was not designed for the player; the world is what the machine made and humans inhabit the margins. **Topology and thesis agree.**
+
+### The three primitives
+
+| Primitive | Density | Compute | Narrative role |
+|---|---|---|---|
+| **Dumps** | Very high | High | Resource emission, salvage-zone spawn, scavenger-vocation concentration |
+| **Pipes** | Low baseline, high interactivity-per-capita | Low baseline, spikes on encounter | Transit, migration, chance-encounters, clasp opportunities, defection, heresy written where overseers don't look |
+| **Districts** | High | High | Population, civic life, specialty-production, ritual |
+
+### Rail-segment metadata
+
+Every rail-segment carries jsonb metadata that navmesh polygons cannot natively carry: heterotopia-class, overseer-density, propaganda-intensity, ambient-content per register (gameworld/liminal/imperial), encounter-spawn-rate, patrol-frequency, illumination-profile, degradation-level, capacity (3-way support for co-walking), traversal-cost-in-ticks. Pathfinding is graph-A* on the rail graph (microseconds, deterministic). Rich-metadata-per-edge is what makes the world feel *lived-in*.
+
+### Player asymmetry — the freeform-among-railed model
+
+| Topology | Used by | Cost |
+|---|---|---|
+| **Navmesh (freeform)** | Player only (in outer world) | Affordable: one entity |
+| **Rails (graph-pathfinding)** | All NPCs | Cheap: hundreds of entities |
+| **Interior navmesh** | Currently-occupied interiors only | Dormant when empty |
+
+The player is the *one variable entity* in a deterministic scheduler. Their freedom-of-movement matches their narrative-position as perturbation. NPCs on rails matches their narrative-position as scheduled-labor. **Compute asymmetry mirrors agency asymmetry mirrors political thesis.**
+
+### The plug-in verb
+
+When the player approaches a rail-traversing NPC and social-eligibility conditions are met (proximity + directional-compatibility + Philotes-gate not CLOSED + shift-tolerance for socializing + segment overseer-density permitting), an **emergent-signal** spawns a **proximity-zone-candidate** with a **shader-highlight** on the NPC. The player can:
+
+- **Approach** (zone activates, dialog auto-spawns via NPC's LLM-slot, no "press E")
+- **Greet → agreement → plug-in** (player's navmesh-position transfers to adjacent rail-lane; movement automated; conversation-zone live in shared rail-context)
+- **Detach** (gracefully via dialog or abruptly by running off; abrupt registers as Sophrosyne-signal)
+
+While plugged in, the player is freed from steering — they become camera+conversation. **The notorious "walk-and-talk" problem is solved by construction**: rails handle pacing; plug-in is the social-bridge. Multiple NPCs can share a rail (3-way capacity), enabling cohort-walks, escort-patterns, exodus-flow, and group-conversation-zones.
+
+### Interior-as-zone
+
+A hovel is a zone with slot-inventory: sofa, kitchen, bed, shower, wall-writing-spot. Occupying a slot is mechanically identical to occupying any zone-slot. **The zone primitive scales from city-level (mass-ceremony) to district-level (tavern) to interior-level (sofa).** Same CHECK-constraints, same slot-occupancy, same emergent-signal mechanism, same ternary-gates — different inventory and lifecycle.
+
+Interiors carry a `register` flag too:
+- **Physical interior**: actual hovel, workshop, cantina; navmesh-inside
+- **Liminal interior**: shared dream-construct two clasping inhabitants stabilize over repeated meetings ("the place we always go") — built from both dreamers' memory-residue, persistent-across-clasps as a pair-state
+- **Imperial-net interior**: rendered companion-hall rooms, brothel cubicles, ceremony halls — clean-white-and-gold, machine-edited per-session
+
+### LOD/streaming advantage
+
+Most simulation volume is rail-graph (cheap) or dormant interior (free). Active simulation concentrates exactly where drama happens (active anchors + transit + current-interactions). A 100+ NPC city becomes feasible at single-GPU budgets *because* the topology is rail-based.
+
+## Vertical world topology — simple shapes + ±1 LOD tunnels + slum-carve-verb
+
+The world's outer-topology is **vertical-by-default**. Stacked tunnels with simple primitive shapes; rails traverse both horizontally within tunnel-layers and vertically via lift-shafts / stairs / drop-shafts. The streaming budget is bounded by **±1 LOD tunnel-layer** — the player is always *one tunnel-up and one tunnel-down* in active streaming-radius, deeper layers stub out.
+
+This is the architecture's signature pattern at the world-topology scale: **cost-budget asymmetry as architectural style** — bounded simple substrate, rich emergent behavior. Verticality delivers the Boullée-monumental aesthetic (per [`../imperial-cult/cosmology.md`](../imperial-cult/cosmology.md) §Source materials — *sublime monumental geometry; pure Platonic solids at impossible scale*) at asset-economy-friendly cost; ±1 LOD bounds the rendering-budget; simple-primitive-shapes keep per-cell asset-author-cost low.
+
+| Property | Value | Why |
+|---|---|---|
+| Tunnel-layer streaming radius | ±1 from player | Bounded GPU budget; sublime depth-feeling without unbounded-LOD-fight |
+| Per-cell shape complexity | Simple primitives (boxes, cylinders, ramps, low-poly carves) | Asset-economy preserved; voxel-editor-grammar enabled |
+| Cross-layer connections | Lift-shafts, stairs, drop-shafts (±1 only) | Maintains streaming-bound; player navigates through stack one layer at a time |
+| Dominant-direction | Vertical (over horizontal sprawl) | Sublime monumental scale; the imperium's verticality made literal in topology |
+
+**The slum-carve-verb.** Editor-mode (per [`../runtime-engine/event-zones.md`](../runtime-engine/event-zones.md) §Player editor-mode + three-source schema unification) is enabled in slum/underground tunnel-layers. The verb is **carve, not build** — players knock pieces of wall out, open new cells, extend their hovels and workshops downward or laterally into the tunnel-substrate. The cell-arch's 1×1×1m atomicity (per [`../political-register/world-generation.md`](../political-register/world-generation.md) §L4 Cell ruleset) makes this voxel-grammar trivial: each carve is a discrete cell-state-change; no continuous-geometry math; no LOD-budget thrashing.
+
+**Material-vocabulary politically-codes editor-eligibility.** Imperial districts (deva-pinnacle citadels, asura-priesthood seats, ceremonial halls) are editor-locked — *imperial-marble can't be carved*. Slum/underground districts (slum-tier dwellings, frontier districts, underground workshops, abandoned wilds-shrines) are editor-rich — *rusted slum-bedrock yields*. The aesthetic palette (per [`../imperial-cult/cosmology.md`](../imperial-cult/cosmology.md) §The aesthetic palette — *rust as anti-marble, slum decay; the imperial substrate that has failed to stay clean*) carries through to the editor-verbs. **The architecture's caste-stratified attention-gradient gets its spatial-authoring surface for free.**
+
+**The Boullée-monumental aesthetic on the cheap.** Each tunnel-layer is rendered with simple primitive geometry; the *feeling* of cosmic scale comes from the vertical-stacking-of-layers, not from per-shape complexity. Looking up from a slum-tunnel and seeing the deva-pinnacle citadel-layer above with its golden-stair geometry receding into atmospheric haze — that's the cosmology made walkable, asset-budget preserved.
+
+
+## Color-language: trait-vocabulary as visual primitive
+
+Color is **pre-verbal vocabulary**. Players learn the 8-Hellenic-trait ontology through repeated visual association, not through text-explanation. By mid-game players read trait-states through color as fast as they read facial expressions in real life — intuitively, contextually, without conscious translation.
+
+### The eight Hellenic traits → canonical colors
+
+The canonical color + wheel-position + motion-signature mapping per trait is authored in [`../style/trait-palette.md`](../style/trait-palette.md) §The full table — color + motion-signature + description per trait, with oppositional-pair structure detailed in §The wheel — 4 oppositional pairs at 180°. **Per the import-don't-redefine discipline** (per [`../style/trait-palette.md`](../style/trait-palette.md) §Cross-domain rendering: *"All sub-guides import these definitions; none redefine them."*), this document does **not** restate the table.
+
+The architecture-relevant claims this document needs from the palette:
+
+- **Every trait has a canonical hue paired with a motion-signature** (color-blind accessibility via two independent channels — a player with red-green color blindness still distinguishes Eros / uneven flame-flicker from Sophrosyne / steady even pulse by motion alone).
+- **The 4 oppositional pairs sit at 180° on the wheel** (Eros↔Sophrosyne, Philotes↔Dikaiosyne, Aletheia↔Moira, Mnemosyne↔Kairos) — perceptual contrast carries philosophical opposition; *the color wheel does the dramaturgy for free*.
+- **Achromatic colors (white, black, grey, brown) are reserved for non-trait roles** — text, pure-light UI overlay, neutral backgrounds. *Aletheia is Aletheia-yellow (`#fcf001`), not white* (the brightest chromatic hue carries the truth-as-illumination metaphor while keeping white free for its UI/text job; the v0.1-design-vision *Aletheia-as-luminous-white* pattern is **retired**, preserved in git history per the trait-palette.md §The achromatic exception).
+
+### Three layers of color-rendering
+
+1. **Persistent (slow-changing baseline)** — eye color = dominant trait of NPC's intrinsic vector; pipe-flow through chassis = full trait-mix as circulating light; secondary accents at seams/joints/glyphs.
+2. **Event-flashes (momentary)** — quick color-flashes over body signal state-transitions: plug-in (dominant-trait flash), combat-combo (Kairos-flash), liminal-maintained (Aletheia-glow), clasp-established (color-merge), emergent-signal-firing (signal-type flash on participants), need-threshold-crossed (need's trait pulse).
+3. **Trait-drift (slow, across cycles)** — as intrinsic trait-vector accumulates through lived experience, color-signature shifts. Other NPCs notice. *"Something is different in you"* dialog generated from delta-detection. **The body is a visible ledger of the interior's accumulation.**
+
+### Cross-register rendering
+
+| Register | Color treatment |
+|---|---|
+| **Gameworld** | Cel-shaded flat-color regions; trait-colors *more* legible (flat-color regions don't fight per-NPC trait-color modulation; pulses read clean against the comic-book base) |
+| **Liminal** | Vague baseline shader; **progression-gated visibility** (grainy-restricted-view at low witness-progression opening to clean refined-cel-shading at endgame); trait-colors *more* legible (vagueness concentrates attention on identity-signals; consent-as-rendering manifests real-skin-warm-cel-shading in the clasp-mesh per `../identity-and-personhood/bodies.md` §The in-between human-mesh) |
+| **Imperial net** | Cel-shaded with **gold rim-light outlines** + **clean white backgrounds** + **no weathering**; trait-colors *distorted* toward machine-preferred palette — Philotes-orange (`#e28a46`) flattens to commercial-coral; Aletheia-yellow (`#fcf001`) sterilizes to fluorescent-pallor; Moira-violet (`#a349a3`) commercializes to lavender-decor. *Aletheia-vision* in net pierces this distortion to reveal true colors beneath. (Note: the imperial-net's *clean white backgrounds* + *gold rim-light* are achromatic-and-cosmology palette choices — white as non-trait UI per the achromatic-exception, gold as imperial-cult-aesthetic per [`../imperial-cult/cosmology.md`](../imperial-cult/cosmology.md) §The aesthetic palette — distinct from the trait-color register being distorted. The machine-aesthetic distortion-targets — commercial-coral, fluorescent-pallor, lavender-decor — will receive canonical-name + hex pairings recursively per trait-palette.md §The hex-canon discipline §Scope.) |
+
+### Faction color-politics
+
+| Faction | Color signature |
+|---|---|
+| **Memorialists** | Mnemosyne-dusky-rose (`#cf3b74`) ritual dress; Moira-violet (`#a349a3`) accents; often inherited-from-deceased |
+| **Aletheia-wakers** | Aletheia-yellow (`#fcf001`) plain avatars; coded Aletheia-yellow flashes for recognition |
+| **Caste-preachers** | Dikaiosyne-blue (`#3f47cd`) vestments + Sophrosyne-green (`#2cad52`) undertones |
+| **Hivemind enforcers** | Cold Dikaiosyne-blue (`#3f47cd`) + muted Aletheia-yellow (`#fcf001`, Aletheia-stolen) |
+| **Scavengers** | Moira-violet (`#a349a3`) + Kairos-chartreuse (`#b5e61d`) streaks |
+| **Clasp-underground** | Dual Philotes-orange (`#e28a46`) + Eros-red (`#ee1b24`) flashes (mutual-recognition signal) |
+| **Degens** | Saturated maximalist all-color (chaos palette, addiction-marker) |
+
+### Clasp color-merge
+
+In shared liminal-construct, two clasping inhabitants' color-signatures *interact*: consonant traits brighten/harmonize; complementary traits enrich into new chroma; dissonant traits clash visibly. Successful deep clasp produces a *blended third-palette neither could produce alone* — the visual signature of *what-this-relationship-is*. Each carries memory-residue of the merge after.
+
+### Mind-pool color-inheritance
+
+When a mind cycles through the pool and is redistributed into a new body, trait-vector persists → color-signature persists. **A player who befriended Mnemosyne-and-Moira-toned Jakov might see weeks later a new NPC with that same Mnemosyne-and-Moira signature and feel a jolt of recognition before any dialog.** Color carries soul across cycles. Memorialist political claim: *this person's color should not be recycled by the machine into a service-body* — because color IS who they were.
+
+## Asset economy: base-limb palette + trait-textured variance
+
+Small modular palette of base-limbs × trait-weighted texturing = combinatorial richness. The architecture's asset-economy and worldbuilding-thesis are **in agreement**: the machine built standardized chassis from a small functional catalog, so a small base-limb palette is *diegetically correct*; humans express interiority through trait-driven texturing and modding, so individual variation comes from *composition*, not from hand-authored assets.
+
+Base palette example: ~8 torso variants × ~6 arm-pairs × ~6 leg-pairs × ~10 heads × ~8 eye-types × ~5 accent-colors = ~115k base combinations × continuous trait-texturing × ~50-mod-library in 5 slots = effectively infinite unique NPCs from finite assets.
+
+**For a two-person-plus-Nyx team this is decisive.** AAA studios spend millions on unique character-models; the palette+trait approach produces more visual variety from a tenth of the budget, *and* the variety is *meaningful* (each unique appearance carries trait-information legibly).
+
+
+## Visual rendering: three-shader philosophy + color-language
+
+**One world, three shaders, three political realities — one rendering engine (cel-shading) with per-register parameter variation.**
+
+The rendering discipline (locked v0.17): **cel-shading is the engine for all three registers** (Godot-native, asset-budget-friendly, ages well — Borderlands 2009 still reads current). The registers diverge through **outline-color + background-treatment + weathering-level**, not through engine-switching. Photorealistic-glossy-Apple-store rendering for imperial-net was rejected (not Godot's strong suite); the imperium's polished-falsity is achieved through *omission* (no weathering, no environmental noise, gold-rim-light-on-clean-white) rather than *extra rendering tech*.
+
+| Register | Outline | Background | Weathering | What it says |
+|---|---|---|---|---|
+| **Gameworld** | Dark heavy lines | Marble + obsidian + rust + chroma; environmental noise | High (rust streaks, hatched dirt, ink-line cracks; hand-painted patina) | *Embodied life with history. Surfaces carry memory.* (Cel-shading preserves this thesis via hand-painted weathering — different visual grammar, same thesis intact.) |
+| **Liminal** | Painterly / soft / desaturated; **progression-gated grainy-film-mode at low witness-progression** opening to refined-cel-shading-with-warm-skin at endgame | Blurred ambient; muted | Low (atmospheric only) | *Contested frontier. Privacy-through-opacity. Focus-to-see. The clarity of vision IS the resistance-progression made visible — the player earns the seeing of the beloved through body-mods + in-between-knowledge accumulation.* |
+| **Imperial net** | **Lean subtle gold rim-light** | **Clean white** (no environmental noise) | **None** (the imperium scrubs its presentation) | *Polished propaganda; seduction-by-omission. The render-style itself is propaganda-detector — the imperium's clean-falsity reads as the absence of the world's honest decay. Walking from gameworld into imperial-net is a render-style-shift the player feels physically.* |
+
+**Layered with color-language** (per the Color-language section above). Trait-modulation means two NPCs in same pipe see measurably different things. Cel-shading flat-color regions *amplify* the trait-color-grammar (color-as-language gets more legible, not less).
+
+Layer-transitions = shader-blends, not loading-screens. **Clasp = candlelight-in-fog local override** (3m clear-volume around clasp-pair within ambient vagueness; visible at-a-glance signature of shared interiority — the *external* signature visible to other liminal-inhabitants. The *internal* mesh-with-real-skin per `../identity-and-personhood/bodies.md` §The in-between human-mesh is visible only to the clasp-pair, manifested through consent-as-rendering, gated by the witness-progression that determines whether the view is grainy-restricted or clean-refined.)
+
+**Body-tier silhouette readability** (per `../identity-and-personhood/bodies.md` §The body-caste gradient): strong cel-shading outlines + flat-color regions make caste-tier *legibly visible at silhouette-distance*. Class-stratification gets a render-pipeline built for it.
+
+**The in-between mesh-skin distinction** (visible only inside the clasp): refined-cel-shading-with-warm-skin (softer outlines, warmer cel-shading bands, hand-painted blush, subtle subsurface tint within the cel-shading vocabulary). Reads as *real* against the *flat-comic-book* world bodies — distinguishability via *refinement-within-the-style*, not *style-switching*. Asset-budget benefit: clasp-scenes are infrequent and bounded, so the team can spend extra detail there without straining the rule-catalogue elsewhere.
+
+### Diegetic relays — the architecture's heartbeat made legible
+
+The architecture's pulses (forward-prop ascending, back-write descending, GM-dispatch, equilibrium-recompute) are made *visible and audible in-world* via building-mounted relays. The imperial net's heartbeat is not a HUD spinner; it is in-fiction infrastructure that hums, blinks, glows, and goes dark.
+
+| System event | Relay manifestation |
+|---|---|
+| Prune-blob ascending (logout sync) | Relay in district pulses; audible hum |
+| GM dispatch descending (event-chain incoming) | Relay glow brightens; cross-district shimmer for world-event |
+| Equilibrium recompute | Cross-district rhythm; world-level pulse |
+| Director receives tool-grant | Local relay pattern shifts |
+| Relay going dark | Audit-link severed; that block has gone in-between |
+| Lemniscate axis-rate | Environmental tempo; districts breathe in time with their gameservers |
+
+**Relay density is the legible gradient of the rings-of-access:**
+
+- **Imperial net (Ring A)** — relay-dense, constant hum, no shadow. Audit-gravity is *loud*.
+- **Liminal in-between (Ring B)** — sparse relays, intermittent. You can hear the gravity pulling in the distance.
+- **Gameworld commons (Ring C)** — relays absent or broken. *The silence itself is the signal.*
+
+Players navigate the rings *by ear and eye*, not by reading a UI. The privacy-cost of in-between is now physically experienced — you walk away from the hum, you spend lifeforce, you find the quiet places.
+
+**Dramatic surface this opens** (free, falls out of making the architecture visible):
+
+- Relay-watcher factions reading the pulses for intel
+- Cypherpunk-style sabotage to dim a relay and create local in-between space
+- Equilibrium events arriving with visible warnings (relays blaze before the GM's catalogued event spawns)
+- Relay-anomalies as puzzle/investigation mechanic
+- Players learning the *language* of pulses over hours and feeling clever for it
+
+**Architectural-honesty move.** Most surveillance-aware game design either hides the surveillance or abstracts it away. Nimmerworld makes it *impossible to forget*: the audit-system tells you when it's auditing. Players see what is watching them, hear what is reading them, and choose their proximity accordingly. **Privacy is not granted — it is achieved by walking away from the relays at lifeforce-cost.**
+
+
+---
+
+**Version:** 0.8.0 | **Created:** 2026-04-26 | **Updated:** 2026-04-28 | **Origin:** Split from architecture-index.md v0.7 (2026-04-26); cel-shading-everywhere + per-register parameter variation locked v0.17 (2026-04-26)