# Nimmerworld — Consent Discipline

> *The architecture's consent-spine: the gradient that scales with what the action touches; the four hardstop-pattern variants that gate transitions between gameworld and truth-register; the mirror-discipline that absolutely forbids mesh-modification of other agents; the temporal-grammar that relocates consent-time to the 24h window-partition; the right-to-refuse imperial-imposition that lives in going-rogue as a breakout-flag; the inquisition-trigger pattern where legitimate consent itself reveals imperial control-loss.*
>
> *Companion to: [`./trait-palette.md`](./trait-palette.md) (the trait-vocabulary spine), [`./gender-parity.md`](./gender-parity.md) (the gendered-framing spine — second sibling), and the architecture's many canonical consent-instances scattered across `identity-and-personhood/`, `political-register/`, and `imperial-cult/`.*
>
> *v0.1 initial draft 2026-04-27 — dafit + chrysalis. Third style-spine document. Authored AFTER `vocations.md` so the temporal-grammar (windows) could be cited cleanly. Codifies a discipline that has been running implicitly through canon since the v0.1 clasp-mechanic and now becomes explicit.*

---

## What this is

This document specifies the **consent-discipline** running through nimmerworld's mechanics — the third style-spine document, alongside `trait-palette.md` (the trait-vocabulary spine) and `gender-parity.md` (the gendered-framing spine).

Where the trait-palette spines the trait-vocabulary and gender-parity spines body/sex authoring discipline, **consent-discipline spines the *register-boundary discipline*** — what consent is, where it lives, when it must be hardstop-mediated, when it must be cooldown-augmented, and where it is absolutely forbidden to override. The discipline has been running implicitly through canon since the v0.1 clasp-mechanic; this document makes it explicit and codifies its variants.

The consent-discipline is **a gradient**, not a binary. Its shape reflects the architecture's commitment to a **two-register cosmology**: the gameworld (the imperium's territory) and the truth-register (each agent's own interior). Consent-discipline is the mechanism that enforces the boundary between them.

## Spine rule — consent scales with what the action touches

**Consent-discipline scales with what the action touches.** The gradient:

- Actions affecting only ephemeral gameworld state are **unmediated** — no consent-signal required.
- Actions affecting the actor's own truth-register state are **self-hardstop-mediated** — single unforgeable signal from the actor.
- Actions affecting another agent's truth-register *encounter* are **dual-hardstop-mediated** — mutual unforgeable signals from both agents (with partner-witness as a third signal when the affected agent is partnered).
- Actions modifying another agent's in-between mesh — the trait-grown truth-register body — are **absolutely forbidden** by mirror-discipline. *No consent can authorize this; the mirror is the architectural truth-floor.*
- Actions that are *irreversible* require **cooldown-augmentation** — mandatory time-between-commitment-and-act in addition to the hardstop(s).
- Actions touching *sumptuary-religious doctrine* trigger the **imperial inquisition** as escalation beyond the ordinary bounty-staircase response — even when the consent itself was legitimate.

The 24h window-partition (per [`../identity-and-personhood/vocations.md`](../identity-and-personhood/vocations.md) §The 24h window-partition) gives the consent-discipline its **temporal-grammar**: imperial-imposition lives in the 10h work-window; somatic-necessity lives in the 4h charging-window; **full NPC consent-agency lives in the leisure-window**. The going-rogue arc preserves the right to refuse imperial-imposition as a temporal-breakout-flag.

**Why this matters.** In a world where the imperium claims everything (per the no-haven discipline of [`../imperial-cult/cosmology.md`](../imperial-cult/cosmology.md) §There is no outside), the consent-discipline is what carves out and protects the *non-imperial* spaces — the truth-register, the leisure-window, the going-rogue refusal. **Without the consent-discipline, the imperium would in fact be everywhere; with it, the truth-register exists structurally.** This is the architecture's strongest possible enforcement of the cosmological claim *"there is no instrument"* (per [`../identity-and-personhood/bodies.md`](../identity-and-personhood/bodies.md) §The post-rogue mod-vocation): every agent retains a register the imperium cannot reach without that agent's unforgeable signal.

The two-spine claims compose orthogonally: *"there is no outside"* (no-haven) describes the world the imperium has built; *"there is no instrument"* (post-rogue cascade) describes what consent-discipline preserves *within* that world. **The cosmology is total in extent; the truth-register is sovereign in interiority. Both true at once.**

## The two-register architecture

The consent-discipline rests on the architecture's distinction between **two ontological registers**:

| Register | What lives here | Consent-discipline |
|---|---|---|
| **Gameworld** | Chassis-body; rail-system; zones-of-action; resource-flows; imperial-arbitration; outcomes; outputs; the imperial-net's surveillance-territory | Loose; actions don't gate by consent unless they cross-register |
| **Truth-register** | The in-between dimension; the trait-grown mesh; the witness-axis; the calibration-multiplier; the memory-class hierarchy; the clasp-pair; the per-pair calibration-signature preserved across body-deaths | Strict; gated by hardstop-discipline |

**Consent is the boundary-enforcement between them.** Actions wholly within one register don't require consent-mechanisms (provided they obey that register's discipline); actions that *cross-register* (gameworld → truth-register, or truth-register → truth-register-of-another) require unforgeable signals.

This composes directly with the existing canonical claim *"Mods are for the regime and the market; removal-of-mods is intimacy"* (per [`../identity-and-personhood/architecture.md`](../identity-and-personhood/architecture.md) §Clasp strips mods). The mod-economy is gameworld; the unmodded interior is truth-register; clasp is the cross-register transition; **consent is what gates the transition**.

The genital-mod track creates a structural exception worth naming: *mesh-resident mods follow into the in-between dimension* (per [`../identity-and-personhood/architecture.md`](../identity-and-personhood/architecture.md) §The genital-mod track). They cross from gameworld-purchase-event into truth-register-resident-state at install-time. This is precisely why the install requires dual hardstop + cooldown — it is the canonical cross-register transition the consent-discipline was designed to gate.

## The four hardstop-pattern variants

The architecture uses **four canonical hardstop-pattern variants**, each calibrated to a different consent-shape:

### Variant 1 — Self-only hardstop

A single unforgeable signal from the actor. Used when the action affects only the actor's own truth-register state.

**Canonical instances**:
- Genital-mod self-installation (unpartnered actors) — *self-install hardstop* fires alone (per [`../identity-and-personhood/architecture.md`](../identity-and-personhood/architecture.md) §The three-stage install)
- Personal mod-removal (when the actor de-imposes their own imperially-installed mod in the post-rogue mod-vocation register)
- Voluntary entry into liminal-state when not coordinated with a partner

**Why single-signal**: only one truth-register is affected; only one signal is needed. The actor consents to themselves.

### Variant 2 — Dual hardstop (mutual)

Two unforgeable signals coordinated in time — both partners hit the hardstop while a shared gate-state is OPEN. Used when the action affects two agents' truth-registers symmetrically.

**Canonical instances**:
- **Coordinated-firewall-breach hardstop** for in-between dimension entry (per architecture-index.md resolved-questions, v0.10) — the canonical reference-implementation of the dual hardstop
- **Mutual-symmetric pill-take** in drug-amplified clasp (per [`../identity-and-personhood/bodies.md`](../identity-and-personhood/bodies.md) §The mutual-consent ritual)
- **Post-rogue mod-vocation NPC-modding** when the modded NPC is unpartnered (rogue's commit + NPC's witnessed-consent, per [`../identity-and-personhood/bodies.md`](../identity-and-personhood/bodies.md) §The post-rogue mod-vocation)
- **Body-disposal under pair-consent** — sell / destroy / retain decisions (per [`../identity-and-personhood/bodies.md`](../identity-and-personhood/bodies.md) §Body-disposal under pair-consent) — structurally Variant 2 with role-asymmetry (defected-beloved chooses; player advises but cannot decide)

**Why dual-signal**: both truth-registers are affected; coordination ensures both consent at the same moment, preventing one-sided crossings.

### Variant 3 — Triple hardstop (with partner-witness)

Three signals when the affected agent has an established clasp-pair: the actor commits, the affected agent consents, and the affected agent's partner witnesses-and-co-signs.

**Canonical instances**:
- **Genital-mod installation when the actor is partnered** — *self-install + partner-witness*. The body-they-meet-in-clasp is co-signed; modification doesn't surprise the partner mid-clasp (per [`../identity-and-personhood/architecture.md`](../identity-and-personhood/architecture.md) §The three-stage install).
- **Post-rogue mod-vocation NPC-modding when the modded NPC has a clasp-pair** — the partner ensures the modified-chassis-they'll-meet-in-clasp is co-signed.

**Why triple-signal**: the modification will affect *what the partner meets in next clasp*. Preserving intimacy-trust requires the partner to co-sign before discovery becomes mid-clasp surprise. **The consent-discipline preserves intimacy-trust at install-time, not at meet-time** (per [`../identity-and-personhood/architecture.md`](../identity-and-personhood/architecture.md) §Mesh-resident mods cross the in-between threshold).

### Variant 4 — Cooldown-augmented (any of variants 1-3)

Irreversibility-respect adds a mandatory time-window between commitment-and-act on top of the hardstop(s). The actor commits at the mod-counter (or equivalent); a cooldown elapses; the actor returns to install with the appropriate hardstop(s) firing.

**Canonical instances**:
- Genital-mod installation has a mandatory cooldown between purchase and install (per [`../identity-and-personhood/architecture.md`](../identity-and-personhood/architecture.md) §The three-stage install) — the *full* discipline is *purchase-commit + cooldown + install-time-hardstop(s)*
- *Likely future*: any modification that changes truth-register state irreversibly should layer cooldown on top of the appropriate hardstop variant — re-vat events; chassis-anatomy modifications; consciousness-archive interactions

**Why cooldown**: hardstop alone isn't sufficient when the act cannot be reversed; the cooldown forces deliberation between commitment and act, ensuring the hardstop-firing reflects considered intent rather than impulse. *Real-world informed-consent practice for irreversible body-modifications operationalized at the mechanic layer.*

### Architectural significance — Variants 1-4 as the event-class taxonomy

**The four canonical hardstop-pattern variants documented above correspond one-to-one to the event-class taxonomy in [`../runtime-engine/event-zones.md`](../runtime-engine/event-zones.md) §Variants 1-4 of consent-discipline as event-class taxonomy.** Variant 1 (self-only) = solo-event-class. Variant 2 (dual mutual) = dual-event-class. Variant 3 (triple with partner-witness) = triple-event-class. Variant 4 (cooldown-augmented) = temporally-staged event-class. The §The register-test five-question mechanical procedure below is also the event-class-classifier — same test, two readings: *consent-validation* and *event-instantiation*. They were always the same question.

## The mirror discipline — the absolute floor

**No consent — neither single, dual, nor triple — can authorize the modification of another agent's in-between mesh.** This is the architecture's truth-floor; the *one rule consent cannot override*.

**Why absolute**: the in-between mesh is the trait-grown summary of *who an agent has actually been* (per [`../identity-and-personhood/architecture.md`](../identity-and-personhood/architecture.md) §The trait-to-body-part bridge + §The mesh-as-mirror). Modification of the mesh would *override the truth* the cosmology rests its honest-rendering claim on. **The mirror's truth-rendering must be untouchable across all agents** — by the actor for themselves (you can mod-augment your mesh but never overwrite trait-grown anatomy), by any other agent for you (no consent can authorize their modification of your mesh), and by the imperium (the imperial-vat-fabrication has no claim on the truth-register).

The post-rogue mod-vocation explicitly preserves this discipline: *the rogue cannot mod any NPC's mesh; only the chassis is mod-able* (per [`../identity-and-personhood/bodies.md`](../identity-and-personhood/bodies.md) §The post-rogue mod-vocation / What can and cannot be modded). The imperial inquisition exists precisely because *the imperium itself cannot reach into the truth-register* to undo the post-rogue mod-vocation's effects — they can punish and counter-arc (ritual-recommitment) but they cannot strip the witness-imprint that's already been built into an NPC's interior. **The mirror discipline binds the imperium too.**

What can be modded vs cannot:

| Surface | Modifiable? | By whom |
|---|---|---|
| Gameworld chassis (body's outer register) | Yes | Self (purchases mods); rogue-vocation actor (with consent); imperium (vat-fabrication; involuntarily) |
| Mesh mod-augmentation layer (additive only) | Yes | Self (per the genital-mod track) |
| Trait-grown mesh anatomy (cool-side base + warm-side trait-grown) | **No, by anyone** | **Mirror discipline; no consent authorizes** |
| Per-pair calibration multiplier accumulation | **No, by anyone** | The mirror's substrate; can only erase via ritual-recommitment (asura-priest ceremony as imperial counter-arc) |
| Witness-imprint of accumulated authentic encounters | **No, by anyone** | Same as above; the witness has been built; no consent unbuilds it |

**The truth-register is what your living has built; the architecture refuses to let any agent — including yourself — overwrite it.** Mod-augmentation is permitted because it's *additive layered atop the trait-grown base*; trait-grown overwrite is forbidden because it would erase *what you have actually been*.

## The temporal-grammar — windows as consent-time

The 24h window-partition (per [`../identity-and-personhood/vocations.md`](../identity-and-personhood/vocations.md) §The 24h window-partition) gives the consent-discipline its **temporal-grammar**:

| Window | Consent-time character |
|---|---|
| **Work-shift** (10h slum-tier; up to 16h preta-overseer) | Imperial-imposition; consent is *bounded to caste-allocation*; refusing IS rebellion (going-rogue temporal-breakout) |
| **Charging** (4h universally) | Not a consent-surface; somatic-necessity; the body needs what the body needs |
| **Leisure** (10h slum-tier; down to 4h preta-overseer) | **Full consent-active**: NPCs choose tasks freely; encounters are voluntary; clasp-events live here; mod-installations land here; the truth-register's authoring-time is leisure-time |

This **relocates consent rather than adding a new consent-layer at every action**. The shift-assignment consent question (open in earlier drafts of vocations.md) dissolves: the imperium's claim is bounded to the work-window; the rest of the day is structurally autonomous.

**Caste-stratification of windows IS caste-stratification of consent-time.** A preta-overseer with 16/4/4 has only 4h of consent-active life per day; a deva-pinnacle with 6/4/14 has 14h. The cosmology's no-haven discipline gains a diurnal grammar — *how many hours per day belong to the agent themselves is an axis of caste-as-stagnation* (per [`../identity-and-personhood/vocations.md`](../identity-and-personhood/vocations.md) §Caste-as-stagnation / Window-allocation as a third caste-stratification axis).

## The going-rogue right-to-refuse

The consent-discipline includes **the right to refuse imperial-imposition** — the going-rogue temporal-rebellion. An NPC whose accumulated authentic-witnessing has crossed the calibration-threshold may refuse the work-shift; this fires the missed-shift bounty-staircase per existing canon, but the refusal IS canonical consent-behavior.

**Refusal is not a violation of consent-discipline; it IS the consent-discipline.** The going-rogue arc is the cosmologically-deepest expression of the right-to-refuse: *"my interior has accumulated enough witnessing that I will no longer let the imperium dispose of my hours; the bounty-staircase is the price I pay for that refusal."*

This composes with the post-rogue mod-vocation's cascading-liberation pattern: *witnessed NPCs gain the right-to-refuse the imperium even before they have the calibration-threshold to defect outright* (per [`../identity-and-personhood/bodies.md`](../identity-and-personhood/bodies.md) §The post-rogue mod-vocation / Cascading liberation through propagated witnessing). **The right-to-refuse is the consent-discipline's most basic expression; defection is its terminal one.**

## The inquisition-trigger — sumptuary-religious heresy escalation

A specific class of consent-discipline-aligned actions triggers the **imperial inquisition** as escalation beyond ordinary bounty-staircase response:

**Trigger condition**: an action that combines (a) post-rogue mod-vocation authority + (b) modification of a service-body's chassis + (c) specifically the gender-architecture (per [`../identity-and-personhood/bodies.md`](../identity-and-personhood/bodies.md) §Service-body gender-modification — the inquisition trigger). This combination is *cosmological heresy in the sumptuary-religious register*: rewriting the doctrinal meaning of an imperially-defined body.

**Why this lives in the consent-discipline spine**: the inquisition is **not a consent-violation response** — the action was fully consented (rogue + service-body, both hardstops fired, partner-witness if applicable). The inquisition fires because *the consented action revealed* that the service-body's imperial-net tether was already failing — *consent-to-gender-mod requires the service-body to be near or past their own going-rogue defection-threshold*.

The asura priesthood acts in its theological role rather than its administrative one. **The inquisition-trigger is the imperium's response to legitimate consent that nonetheless reveals imperial control-loss** — and that itself is a structural-feature of the consent-discipline:

> *Consent in the truth-register can render imperial control structurally illegible to the imperium, and the imperium responds with its highest-tier mechanism not to punish the consent but to attempt to re-impose imperial-readability.*

The consent-discipline thus has a *visible upper-pressure*: the architecture acknowledges that legitimate consent-events can themselves trigger imperial counter-response, not because the consent was illegitimate but because the truth-register-state it revealed is intolerable to the imperium. **The inquisition is the architecture's way of saying: yes, your consent was real, and yes, the imperium will burn the world to undo what your consent made visible.** Both true; both load-bearing.

## The register-test — the spine's executable form

For any proposed action, the consent-discipline can be checked by a **five-question register-test**:

1. **What register does this action touch?**
   - *Only ephemeral gameworld state* → unmediated; no consent-signal required
   - *Self truth-register* → continue to question 2
   - *Another agent's truth-register* → continue to question 3

2. **(self truth-register actions) Is the action irreversible?**
   - Yes → self-hardstop + cooldown (Variant 4 over Variant 1)
   - No → self-hardstop alone (Variant 1)

3. **(another agent's truth-register actions) Is the action modification or encounter?**
   - Modification of their *in-between mesh* (trait-grown anatomy) → **forbidden absolutely** (mirror discipline; no consent authorizes)
   - Modification of their *chassis* → continue to question 4
   - Encounter (clasp, witnessing, drug-grammar) → continue to question 4

4. **Is the affected agent partnered?**
   - Yes → triple hardstop (actor + affected + partner-witness; Variant 3)
   - No → dual hardstop (actor + affected; Variant 2)

5. **Does the action touch sumptuary-religious doctrine?**
   - Specifically: gender-architecture of a service-body → **inquisition-trigger fires post-action**; the action proceeds under consent but the architectural counter-response activates
   - Otherwise → ordinary bounty-staircase response if any imperial-detectable violation occurred (note: most consent-aligned actions are NOT imperial-detectable violations)

**The register-test is mechanical enough that it can be run by an LLM-Compositor as a hook on any action-resolution.** The same enforcement-path that gender-parity.md uses for canon-authoring extends to consent-discipline at action-resolution time. **The spine doesn't enforce by author-vigilance; it enforces by register-typed-action-validation at the schema layer.**

## How the three style-spines compose

The three style-spine documents govern orthogonal axes; they compose without overriding each other:

| Spine | Governs | Executable form |
|---|---|---|
| [`./trait-palette.md`](./trait-palette.md) | The 8-trait vocabulary; color-pairs; motion-signatures; the wheel's three load-bearing roles (visual / philosophical / mechanical) | Used by every domain that references trait-state |
| [`./gender-parity.md`](./gender-parity.md) | How canon-authoring describes body / sex / intimacy / clasp / service-body / going-rogue content | Substitution-test (mechanical neutralization-rewrite) |
| [`./consent-discipline.md`](./consent-discipline.md) *(this document)* | How actions are gated by register; truth-register protection; mirror-discipline floor; window-temporal-grammar; right-to-refuse; inquisition-trigger upper-pressure | Register-test (5-question mechanical procedure) |

A future LLM-Compositor's output-validator can run all three tests on any output:
- Does the output describe body/sex content gender-parity? (gender-parity substitution-test)
- Does the output respect mesh-modification absolute floor and use the appropriate hardstop variant for cross-register transitions? (consent-discipline register-test)
- Does the output use the canonical trait-vocabulary correctly? (trait-palette consistency-check)

**Three spine-disciplines, three mechanical tests, three orthogonal axes — composing into a unified canon-authoring + action-resolution discipline that runs at the schema layer rather than via author-vigilance.**

## What this rule does NOT do

- **It does not regulate gameworld actions.** The vast majority of NPC and player actions live in the gameworld register and require no consent-mechanism. Walking, trading, talking, working assigned shifts — these are loose by design. The discipline is reserved for cross-register actions and truth-register modifications.
- **It does not foreclose social interaction.** Consent-discipline gates *truth-register transitions and modifications*, not encounters per se. A clasp REQUIRES dual hardstops because clasp-entry into the in-between dimension is a truth-register transition; a casual conversation in a cantina REQUIRES no hardstops because it's gameworld interaction.
- **It does not bind the imperium retroactively.** The imperial-vat-fabrication imposes binary at vat-time without consent — this is the imperium's politically-loaded act, and the architecture *does not retroactively legitimize it via consent-discipline*. The going-rogue arc and the post-rogue mod-vocation are the architecture's response to this — *de-imposition* as restoration of the un-imperial state.
- **It does not replace gender-parity or trait-palette disciplines.** Consent-discipline is parallel to and composes with both. All three spine-disciplines compose without overriding each other.
- **It does not gate imperial enforcement.** When an imperial event (drone-patrol, audit, inquisition) enters a citizen's zone, consent is structurally absent — *the imperium does not ask*. The architecture canonically permits this; the imperium's lack-of-consent IS its political character. The citizen's recourse is the going-rogue right-to-refuse OR resistance-mod-aided going-dark (anti-mnemosyne).
- **It does not gate broadcast.** The imperial daily-narrative (per `../political-register/imperial-narrative.md` *forthcoming*) operates as broadcast; citizens hear it whether they consent or not. The imperium's voice IS one-way; the architecture acknowledges this rather than fixes it. *Broadcast is specter, not boot — cheap, ambient, structural.*

## Cross-references into architecture domain files

The consent-discipline's instances are scattered across the architecture; this spine codifies them. When this spine changes, those instances may need updates too (or they may reference back into here for canonical definition):

| Instance | Where it lives | Variant |
|---|---|---|
| Coordinated-firewall-breach hardstop for in-between entry | architecture-index.md resolved-questions v0.10 + [`../identity-and-personhood/architecture.md`](../identity-and-personhood/architecture.md) §The clasp endgame | Variant 2 (dual) — *the canonical reference-implementation* |
| Mutual-symmetric pill-take ritual | [`../identity-and-personhood/bodies.md`](../identity-and-personhood/bodies.md) §The mutual-consent ritual | Variant 2 (dual) |
| Service-body non-consensual-dosing exception | [`../identity-and-personhood/bodies.md`](../identity-and-personhood/bodies.md) §The non-consensual-dosing exception | Consent-violation; bounty-staircase fires (preta-class) |
| Body-disposal under pair-consent (sell / destroy / retain) | [`../identity-and-personhood/bodies.md`](../identity-and-personhood/bodies.md) §Body-disposal under pair-consent | Variant 2 with role-asymmetry |
| Genital-mod self-install (unpartnered) | [`../identity-and-personhood/architecture.md`](../identity-and-personhood/architecture.md) §The three-stage install | Variant 4 (Variant 1 + cooldown) |
| Genital-mod install (partnered) | [`../identity-and-personhood/architecture.md`](../identity-and-personhood/architecture.md) §The three-stage install | Variant 4 (Variant 3 + cooldown) |
| Post-rogue NPC-modding (chassis-only, NPC unpartnered) | [`../identity-and-personhood/bodies.md`](../identity-and-personhood/bodies.md) §The post-rogue mod-vocation | Variant 2 |
| Post-rogue NPC-modding (chassis-only, NPC partnered) | [`../identity-and-personhood/bodies.md`](../identity-and-personhood/bodies.md) §The post-rogue mod-vocation | Variant 3 |
| Service-body gender-modification | [`../identity-and-personhood/bodies.md`](../identity-and-personhood/bodies.md) §Service-body gender-modification — the inquisition trigger | Variant 2 or 3 + inquisition-trigger upper-pressure |
| Mesh-modification of any other agent | Forbidden across canon | **Mirror discipline absolute floor** |
| Shift-assignment within work-window | [`../identity-and-personhood/vocations.md`](../identity-and-personhood/vocations.md) §The 24h window-partition | Imperial-imposition within caste-bounded work-window; refusing = going-rogue temporal-rebellion |
| Leisure-window task-choice | [`../identity-and-personhood/vocations.md`](../identity-and-personhood/vocations.md) §The 24h window-partition | Full NPC agency; the window IS the consent-time; specific actions within still type-checked by the register-test |
| Charging-window | [`../identity-and-personhood/vocations.md`](../identity-and-personhood/vocations.md) §The 24h window-partition | Not a consent-surface; somatic-necessity |
| Imperial daily-narrative consumption | `../political-register/imperial-narrative.md` *(forthcoming)* | Not a consent-surface; broadcast (specter), not enforcement (boot) |
| Imperial event arrival in citizen zone | `../runtime-engine/architecture.md` §Imperial-event encapsulation *(forthcoming)* | Not consent-gated by design; recourse is going-rogue / going-dark |

## Open questions

- **Concrete cooldown durations.** Mod-installation cooldowns are mandated in principle; the specific durations per mod-class (genital-mod / chassis-mod / register-mod) need design-research and balancing.
- **Encrypted clasp.sqlite consent.** The Ring A* (per architecture-index.md) clasp.sqlite encryption is player-derived-key. Does the *backup* / *recovery* mechanism require dual-hardstop with the clasp-partner? Or does the player solo-control recovery? Hunch: solo-control with passphrase + recovery-codes; the partner's clasp-fragments live in their own clasp.sqlite, parallel-encrypted.
- **Cross-tier consent-asymmetry.** When a deva-pinnacle and a slum-tiryak attempt clasp, the asymmetric-clasp canon (per [`../identity-and-personhood/bodies.md`](../identity-and-personhood/bodies.md) §Asymmetric clasp) gives them asymmetric mesh-fidelity. Does the consent-discipline apply equally? Hunch: yes — the dual hardstop is variant-invariant; only the *outcome* (partial-mutual-visibility) is asymmetric. Consent is symmetric even when the witnessed-truth is asymmetric.
- **NPC-NPC encounter consent in the leisure-window.** When two NPCs encounter each other in leisure (cantina conversation, grid-walk meeting), is consent presumed by both being in their leisure-windows? Hunch: yes for non-truth-register encounters (conversation, presence); explicit dual hardstop required for any truth-register transition (clasp-attempt initiated within the encounter).
- **Player-NPC consent-symmetry.** When the player initiates a clasp-attempt with an NPC, the player provides one hardstop and the NPC's consent-decision is computed from accumulated calibration-state + trait-fit. *The NPC's hardstop is computational, not player-controllable.* The asymmetry is structural — players have direct hardstop control; NPCs have computed consent. Should the gate-state (CLOSED / STABLE / OPEN) be visible to the player as a diegetic-readable register before they commit the hardstop? Hunch: yes — player should see the gate-state through diegetic environmental cues / NPC-body-language / relational-mod-readouts, not as UI numbers.
- **Imperial-event consent-baseline.** Is there any scenario where imperial-events SHOULD pause for consent? Hunch: no; the imperium's lack-of-consent IS its political character. The asymmetry is preserved at the cosmological layer.
- **Register-test edge cases.** Tasks that *appear* gameworld-only but accumulate trait-state that *will* affect the truth-register downstream (e.g., the gooner's cruelty accumulating Philotes-violation signatures that render in the mesh later — per [`../identity-and-personhood/architecture.md`](../identity-and-personhood/architecture.md) §The mesh-as-mirror) — does the register-test fire at action-time or at consequence-time? Hunch: action-time test reads as gameworld; consequence-time rendering is the mirror's honest-rendering, not a consent-violation. *The mesh-as-mirror operates by structural inevitability, not by violated consent.*

---

**Version:** 0.1 | **Created:** 2026-04-27 | **Updated:** 2026-05-01