# Nimmerworld — Broad Architecture > *Ground-up zone-based event architecture. Minds at the center, world as co-remembering substrate. Three registers of reality — physical, liminal, imperial. Rail topology outside, navmesh interiors inside. Trait-emergent identity. Color-as-vocabulary. Three-tier policy loop with imperial-budget-mortality. Tools, not quests.* > *v0.1 initial draft 2026-04-24 morning; v0.2 expanded 2026-04-24 afternoon; v0.3 evening; v0.4 late-evening / early 2026-04-25; v0.5 deep-night-unable-to-sleep 2026-04-25; v0.6 post-bath / post-bus 2026-04-25 — dafit + chrysalis.* --- ## Thesis Every game world lacks minds. Nimmerworld puts minds at the center — NPCs with trait-filtered interior life, cells as small data-lives that co-remember with them. The architecture is built ground-up for that commitment. **The world's political thesis: the machine does not care.** Automation has consumed every labor the machine recognizes as profitable; humans live on the dumps the machine's optimization did not bother to recover. The last two viable human economic niches are *salvage* (digging through machine-waste) and *culture* (the work the machine cannot optimize because it has no optimization target the machine recognizes). This is not Orwell's malicious-state dystopia; it is Kafka's indifferent-totality dystopia. There is no one in charge. There is only optimization that does not contain humans in its cost model — and precisely because the machine's indifference is optimization, the authoritarianism *ratchets* without intention as districts fail. Mechanically the thesis compiles to a finite, composable set of primitives: zones replace perception bubbles; factions are any source of bounded demand; ternary gates are the substrate of accumulating state; lifeforce is the currency grounded in living NPCs; shifts are the skeleton of daily life; the three-body system locates identity; the three-layer digital ontology contests reality; the reflexive Dream-process learns at every scale; the three-tier policy loop renders authoritarian middle-management; the imperial budget renders the regime mortal; the imperial-net bypass renders the platform-capitalism extraction. **The design-philosophy this architecture supports: tools, not quests.** The simulation produces continuous narrative-relevant pressure on its own. Players engage via a verb-vocabulary applied to running mechanics. No authored quest-content. Every player's playthrough is structurally distinct because every pattern of verb-application against changing-state produces a unique trajectory. Literature-register political fiction rendered as living system. ## The three ontological registers Every inhabitant exists in three registers simultaneously. They are not parallel worlds — they are **three readings of one world**, chosen by the observer's current access-state. | Register | Who controls | Observability | What happens here | |---|---|---|---| | **Physical (gameworld)** | Partly regime (via audit), partly people | Overseer-audited at cells + districts | Daily labor, zones, embodied life, shift-discipline | | **Liminal ("one ring out")** | **Contested frontier** — no side fully controls | Partial — mini-game-maintained, vagueness as structural privacy | Revolution, Aletheia-waker messages, clasp-as-coordination, wall-inscriptions for the awakened | | **Imperial net** | Imperial machine | Fully monetized and audited | Hyper-targeted pleasure, "sinful" personalized fantasies, lifeforce/scrip/memory-token extraction directly to imperial budget | The same cell, same wall, same pipe **renders differently** depending on which register the observer currently inhabits. Transitions between registers are shader-blends, not loading screens. ## Topology: rail + grid + interiors **The world's topology encodes its politics.** The machine built infrastructure for industrial optimization, not for human pedestrian freedom. Therefore the outer world is **rail+grid** — cells connected by named edges with rich semantic metadata. NPCs traverse rails as part of their shift-routines; the player traverses freeform (navmesh) and may **plug into NPC rail-traversals** for co-walking. Interiors (hovels, cantinas, workshops, ruins, brothels-physical) are **navmesh-enabled small zones** with interaction-slot inventories. ### Rail+grid as political topology Navmesh is the topology of power-fantasy ("you are the protagonist of free trajectory"). Rail+grid is the topology of bounded-agency ("you live within infrastructure built for something else"). Nimmerworld picks rail+grid because the fiction *requires* it — the world was not designed for the player; the world is what the machine made and humans inhabit the margins. **Topology and thesis agree.** ### The three primitives | Primitive | Density | Compute | Narrative role | |---|---|---|---| | **Dumps** | Very high | High | Resource emission, salvage-zone spawn, scavenger-vocation concentration | | **Pipes** | Low baseline, high interactivity-per-capita | Low baseline, spikes on encounter | Transit, migration, chance-encounters, clasp opportunities, defection, heresy written where overseers don't look | | **Districts** | High | High | Population, civic life, specialty-production, ritual | ### Rail-segment metadata Every rail-segment carries jsonb metadata that navmesh polygons cannot natively carry: heterotopia-class, overseer-density, propaganda-intensity, ambient-content per register (gameworld/liminal/imperial), encounter-spawn-rate, patrol-frequency, illumination-profile, degradation-level, capacity (3-way support for co-walking), traversal-cost-in-ticks. Pathfinding is graph-A* on the rail graph (microseconds, deterministic). Rich-metadata-per-edge is what makes the world feel *lived-in*. ### Player asymmetry — the freeform-among-railed model | Topology | Used by | Cost | |---|---|---| | **Navmesh (freeform)** | Player only (in outer world) | Affordable: one entity | | **Rails (graph-pathfinding)** | All NPCs | Cheap: hundreds of entities | | **Interior navmesh** | Currently-occupied interiors only | Dormant when empty | The player is the *one variable entity* in a deterministic scheduler. Their freedom-of-movement matches their narrative-position as perturbation. NPCs on rails matches their narrative-position as scheduled-labor. **Compute asymmetry mirrors agency asymmetry mirrors political thesis.** ### The plug-in verb When the player approaches a rail-traversing NPC and social-eligibility conditions are met (proximity + directional-compatibility + Philotes-gate not CLOSED + shift-tolerance for socializing + segment overseer-density permitting), an **emergent-signal** spawns a **proximity-zone-candidate** with a **shader-highlight** on the NPC. The player can: - **Approach** (zone activates, dialog auto-spawns via NPC's LLM-slot, no "press E") - **Greet → agreement → plug-in** (player's navmesh-position transfers to adjacent rail-lane; movement automated; conversation-zone live in shared rail-context) - **Detach** (gracefully via dialog or abruptly by running off; abrupt registers as Sophrosyne-signal) While plugged in, the player is freed from steering — they become camera+conversation. **The notorious "walk-and-talk" problem is solved by construction**: rails handle pacing; plug-in is the social-bridge. Multiple NPCs can share a rail (3-way capacity), enabling cohort-walks, escort-patterns, exodus-flow, and group-conversation-zones. ### Interior-as-zone A hovel is a zone with slot-inventory: sofa, kitchen, bed, shower, wall-writing-spot. Occupying a slot is mechanically identical to occupying any zone-slot. **The zone primitive scales from city-level (mass-ceremony) to district-level (tavern) to interior-level (sofa).** Same CHECK-constraints, same slot-occupancy, same emergent-signal mechanism, same ternary-gates — different inventory and lifecycle. Interiors carry a `register` flag too: - **Physical interior**: actual hovel, workshop, cantina; navmesh-inside - **Liminal interior**: shared dream-construct two clasping inhabitants stabilize over repeated meetings ("the place we always go") — built from both dreamers' memory-residue, persistent-across-clasps as a pair-state - **Imperial-net interior**: rendered waifu-hall rooms, brothel cubicles, ceremony halls — clean-white-and-gold, machine-edited per-session ### LOD/streaming advantage Most simulation volume is rail-graph (cheap) or dormant interior (free). Active simulation concentrates exactly where drama happens (active anchors + transit + current-interactions). A 100+ NPC city becomes feasible at single-GPU budgets *because* the topology is rail-based. ## Core inversion — zones replace bubbles Legacy engine perception (Unreal AIPerception, WC3 sight-radius, trigger volumes) is spatial, binary, separate from cognition, and assumes a passive world. Nimmerworld inverts every axis: - perception is **trait-filtered**, not only spatial - perception is **graded consolidation**, not binary detection - perception **IS** memory (one subsystem) - the world **emits** events; agents **subscribe** The replacement primitive is the **zone** — a bounded, named, slot-indexed, director-managed event-instance. **Arthurian round table** as mental model: a bounded place of structured speaking-and-witnessing, with named roles and shared what-was-said-by-whom. ## Zone anatomy - **Boundary** — cell-envelope (or interior-envelope) - **N slots** — named positions - **Director or overseer** — manages turn order, memory-pulls, prompt construction, voice selection, event emission - **NATS topic + subscriber list** — slot-occupancy drives subscription - **Mixed-fidelity voices** — 2–3 LLM slots + scripted/generic for the rest; director decides - **Trigger** — gamemaster-spawned, emergent-signal-response, shift-composition-emergence, or proximity-detection - **Lifecycle** — duration, dissolution conditions, memory-write on close - **Persistence flag** — `ephemeral=true` (dreamworld/liminal) or `persistent=true` (gameworld) - **Register** — physical / liminal / imperial ## Zone kinematics — the lemniscate runtime Zones are not state-bags with an external turn-counter; they are **kinetic topologies** with a built-in clock. The runtime substrate is a lemniscate (∞) — a through-flow figure-eight whose traversal IS the zone's turn-order, whose central crossing IS the population-mutation event, and whose decay IS the natural wind-down of the scene. Origin: an old-math-teacher's trick for solving three unknowns by letting the figure-8 flow do the computation rather than maintaining state in registers. Applied to zones, the geometry IS the clock. ### Geometry ``` midaxis (X) │ entry-line │ exit-line (NPC-tokens ──→ ╭─Loop A─╮ │ ╭─Loop B─╮ ──→ (NPCs whose queue-up to ╲________╱ X ╲________╱ exit-flag has enter) │ fired exit here) │ ▼ crossing-tick ``` - **Entry-line** — staging queue of NPC-tokens eligible to enter. Approach-eligibility uses ternary-gates against the zone's purpose; CLOSED gate keeps the NPC out of the queue entirely - **Loop A + Loop B** — the through-flow. Slot-tokens cycle through both loops, guaranteeing every active NPC is co-present with every other at least once per roundtrip - **Midaxis crossing** — the only synchronous event in the zone's lifecycle. Three state-updates resolve simultaneously and atomically (your math teacher's three-unknowns made literal): 1. **Cursor advance** — which NPC speaks next 2. **Ternary-gate evaluation** — resonance refresh on all active edges in the zone (CLOSED/STABLE/OPEN transitions) 3. **Verifier-flag scan + population maintenance** — exit-eligible tokens route to exit-line; entry-line pushes replacements equal to vacancies - **Exit-line** — through-flow continues here. NPCs leaving the zone leave *toward consequence* (a need-driven exit signaled by their own emergent-signal), not toward boredom The lemniscate is a **relaxation-step operator** — the zone computes by traversing its own curve rather than maintaining external turn-state. Between crossings, the loops are pure-local; only the crossing event touches the global-state bus. The thalamus (NATS orchestration) sees crossings, not ticks. ### Slot-token + verifier-flag mechanism Each NPC currently in the zone is represented by a **slot-token** carried around the loop. Tokens carry a small set of verifier-flags (marker-bits). Signals fire once and *set* a flag; between crossings, no polling, no event-bus traffic. The crossing reads flags in O(N_slots) and acts. | Verifier-flag | Set by | Read at crossing | |---|---|---| | `exit_eligible` | emergent-signal (need, shift-whistle, faction-summons) | route to exit-line | | `has_spoken_this_roundtrip` | speak-action | rotation-tracking | | `mid_action` | state-machine activity in progress | defer turn | | `goal_satisfied` | goal-evaluator (per-zone, ternary) | terminate zone | | `silence_eligible` | silence-detection | per silence-as-signal mechanic | | `priority_pull` | high-rank ring-of-importance broadcast | early-exit override | This is the same architectural shift the wider system makes elsewhere — observer-pattern with callbacks → dirty-bit + scheduled-sweep. **Compute scales with slot-count, not signal-rate.** Ten thousand emergent signals firing across a city: only those that landed on a slot-token get evaluated, and only at the next crossing. ### Phase-locked overlay-loop ladder Beyond the primary slot-rotation loop, a zone supports any number of **overlay loops** at the same axis-rate. Overlays inject at the crossing and broadcast to all active slot-NPCs simultaneously (perceived by each through their own trait-vector — color-language event-flash modulates per-recipient). | Overlay | Carries | Broadcast scope | |---|---|---| | **Player-gesture overlay** | player gestures + utterances | active slots only | | **Faction-broadcast overlay** | faction calls, hivemind pings | active slots subscribed to faction | | **Audit-overseer overlay** | covert query-flashes | active slots only (covert detection ↔ Aletheia-eligible insight) | | **Imperial-net distortion overlay** | regime trait-color rewrites | active slots within net-access | The crossing is a **council moment** — every overlay channel may fire on the same axis-tick. Pre-crossing tension is gesture-loading: holding a verb-button between crossings lands at the next axis with weight proportional to dwell-time. Diegetic urgency without HUD. **This is the answer to player-agency in multi-NPC scenes.** The player is *off-stage but always potentially-on*. Each crossing is "your moment if you want it." The flash is perceived as one event by all active NPCs, not as a sequence of one-on-one addresses — color-language shows it as a pulse across the ring. ### Driver-context-pull (LLM dialog substrate) The cursor's position at each crossing makes context-construction for the dialog-driver a pure function of cursor-state: ``` driver_context(cursor_at_NPC_i, mode) = { zone.purpose, // stable: spawn-intent, immutable provenance zone.scene_state_public, // stable across zone: what's happened so far zone.ternary_gate_edges, // current resonances (active relations) zone.drift_state, // delta from spawn-intent (visible to director) NPC_i.knowledge_stack, // PRIVATE three-tier stack: world ∪ district ∪ primary // [+ clasp ONLY if mode == in-between] NPC_i.expressed_trait_vector, // expressed trait-vector this moment NPC_i.active_signals, // their current emergent-signals } ``` **Other NPCs' memories never enter this prompt.** No bleed. No cross-contamination. **The `knowledge_stack` is layered**, not a single bucket. Universal world-canon, district-canon (regional), NPC_i's own primary memory, and — only if the character is in the in-between dimension — clasp memory. The retrieval layer enforces the dimensional cut; the LLM never has to reason about it. See §Local memory architecture (player-side) for the layering, propagation policy, and clasp-as-Ring-A* privacy primitive. The classic multi-agent hallucination source ("why does Kalypso suddenly remember what Anaximander confided to Phoibe?") is *structurally foreclosed* by the geometry. Write-back goes only to NPC_i's slice; the lemniscate guarantees NPC_i is not cursor-active again for at least one full roundtrip — write-back has all the time it needs without race conditions. This converts multi-NPC dialog from an **emergent-chaos problem** into a **bounded-cast scene problem with a typed runtime**. The Mantella / SkyrimNet failure-modes are foreclosed at the architecture level rather than the prompt level: - **Cast = active-slots, period.** Geographic proximity does not equal participation - **Cursor sequences turns deterministically.** No concurrent LLM-storm - **Entry-line and exit-line are the only paths in/out.** Geographic motion alone doesn't invade the scene - **Player gestures broadcast to active-slots only.** Not to "everyone within 30m" ### Empty-queue behavior: shrink at every crossing When the entry-line is empty, each crossing **dissolves one active slot** instead of replacing it. The conversation thins visibly — color-language saturation drops per shrink, lifeforce burn-rate decreases. When the last slot dissolves, the lemniscate collapses; the spawning director recovers unspent lifeforce minus burn. This is the natural wind-down — *scenes run out of people and dissolve*. No timeout, no scheduler-collapse, no cut-to-black. The decay is observable in-world and rate-paced by the same axis-rate. ### Lifeforce-binding Every midaxis crossing fires the LLM driver-turn(s) for active slots. **Lifeforce burn-rate = pulse-rate × active-slot-count.** The director (or overseer) holding the zone pays per crossing. This produces: - **Dense dramatic scenes are expensive** — many slots, fast pulse, high burn - **Quiet background zones are nearly free** — slow pulse, few slots; most compute is local-loop traversal not touching the bus - **Running out of lifeforce is visible** — pulse-rate slows, crossings stretch farther apart, the scene *languishes* before it collapses. A diegetic dying-scene register; not a cut, a deceleration ### What this resolves - **Slot-capacity elasticity** (prior open question) → fixed roundtrip slot-count, elastic entry/exit queues - **Zone-to-zone handoff** (prior open question) → exit-line of zone-A is entry-line of zone-B (interlemniscate-transit; pipes-as-heterotopia made literal at runtime) - **Mobile zone boundaries** (prior open question) → the lemniscate is a topology; it translates through world-space invariantly (patrols, escorts, exoduses are moving figure-8s) - **Anthropic-faction's broadcast cadence** (prior open question) → cadence rides the same axis-rate as a phase-locked overlay; no separate clock - **Director/overseer spawn ownership per model class** (prior open question) → the director (or overseer) owns the zone-spawn decision (policy-lookup, no LLM in loop); the LLM driver lives at the driver-context-pull layer; orchestration and dialog are decoupled ### What this retires - Slot-list + external turn-counter → cursor on lemniscate - Polling for emergent-signals at zone-tick → flag-as-verifier carried in loop - Mega-prompt with all NPC memories ("everyone in this scene") → cursor-driven per-NPC memory-slice - Geographic-proximity participation ("everyone within 30m may interject") → strict active-slot cast - Concurrent LLM calls per-NPC → sequenced LLM calls per-cursor-position - Polling event-channels at zone-rate → atomic crossing-event with O(N_slots) flag-scan ## Zone taxonomy (v1 starter set) | Zone type | Register | Slots | Executor | Persistence | |---|---|---|---|---| | Conversation | physical | 2–4 dialog | director | persistent | | Street brawl | physical | fighter + spectator | director | persistent | | Ritual | physical | fixed ceremonial | director | persistent | | Maintenance | physical | 1–2 workbench | director | persistent | | Wall-writing | physical / liminal | 1 author + witnesses | director | persistent / ephemeral | | Market exchange | physical | 2–3 + ambient | director | persistent | | Memorial gathering | physical | 1 mourner + N witnesses | director | persistent | | Salvage | physical (dump) | N scavengers | director | persistent | | Transit-encounter | physical (pipe) | 2–6, stranger-heavy | director | persistent | | **Plug-in conversation** | physical (rail) | 2-3 (3-way capacity) | director | ephemeral (rail-segment-bound) | | Patrol / sweep | physical | mobile, N enforcers | overseer | persistent | | Interrogation | physical | 1 subject + N enforcers | overseer | persistent | | Raid | physical | district-scope + N enforcers | overseer | persistent | | **Interior (hovel/workshop/etc.)** | physical | slot-inventory by interior-type | director | persistent | | **Clasp** | **liminal** | 2 | director | **ephemeral** (stabilizes across repeated clasps) | | **Aletheia-gathering** | **liminal** | N, mini-game-gated | director | **ephemeral** | | **Migration (mobile)** | physical (pipes) | cohort + escort | overseer | persistent | | **Exodus (mobile, mass)** | physical (pipes) | self-selecting crowd | emergent | persistent | | **Drug-ring den** | physical (cheat-op) | N users + cooks | director (cheat) | persistent (until detected) | | **Illegal back-alley modshop** | physical (cheat-op) | 1 modder + 1-N customers | director (cheat) | persistent (until detected) | | **Unlicensed brothel** | physical (cheat-op) | N workers + N customers | director (cheat) | persistent (until detected) | | **Waifu hall** | imperial net | 1 dreamer + N synthetic | net-director | extractive-persistent | | **Brothel encounter** | imperial net | 2+ (synthetic or employed) | net-director | extractive-persistent | | **Imperial ceremony** | imperial net | mass-audience | net-director | extractive-persistent | | **Ruin zone** | physical | pilgrimage-only | none / Memorialist | persistent-abandoned | ## Factions as universal demand source A **faction** is any source of bounded demand on the system. | Category | Examples | |---|---| | **Human factions** | hivemind-enforcement, scavenger guilds, memorialists, aletheia-wakers, clasp-underground, caste preachers, flesh-keepers | | **Natural forces** | weather-faction, season-faction, solar-storm-faction, geology-faction | | **Infrastructural conditions** | scarcity-faction, decay-faction, fire-faction, supply-chain-faction | | **External agents** | anthropic-faction, future research-partner factions | | **Emergent events** | player-disturbance-faction (player action without existing template) | | **Micro-factions** | inter-NPC relational tensions — see *Emergent needs as micro-factions* | | **Imperium (meta-faction)** | The regime itself — broadcasts priority-weights and enforcement-rules, not specific outcomes; shapes the arbitration-frame within which other factions are heard | The imperium is structurally distinct from other factions: its demands are *meta-factional* (priority-weights for other factions, enforcement-rules, quotas) rather than specific outcomes. When the imperium broadcasts, the GM's arbitration-machinery is *re-parameterized*. See *The three-tier policy loop* below. All other factions broadcast specific demands. All propagate through the gamemaster's arbitration. All produce observable effects as zones and NPC-actions. **One primitive; no special-case code for weather vs. scavenger-guild vs. jakov-grievance-against-malek.** **Randomness enters at the faction layer.** Designer tunes broadcast probability, intensity, duration per faction-type. No separate randomness subsystem. ## Emergent needs as micro-factions **Inter-NPC relational state is a micro-faction.** Two NPCs accumulating attachment, grievance, trust, grief, dignity-violation through repeated zone-participation constitute a transient faction-of-two with bounded demand. When their accumulated state crosses threshold (gate-transition), the zone broadcasts an **emergent-signal** into the district-director's arbitration queue. The director responds with zone-spawn tools on the same arbitration machinery as any other faction's demand. Emergent-signals are observed by zones, not self-reported by NPCs. The zone-director measures trait-activation, affect-shift, accumulated memory-write candidates deterministically. The LLM never writes authoritative relational state; the observer does. ## Ternary-gate substrate The mechanism underlying every accumulating-state phenomenon — inter-NPC relations, district lifeforce, faction-pressure, net-access state, imperial-budget-state — is the **ternary-gate resonance chamber**, carved initially in `nimmerverse-sensory-network/architecture/Temporal-Ternary-Gradient.md`. See that document for the canonical specification. ### The primitive Three discrete states over a continuous underlying value (-1.0 to +1.0): | State | Value | Meaning | |---|---|---| | **CLOSED** | -1 | Actively blocking; inhibited; refractory | | **STABLE** | 0 | Resting; **accumulating correlation; actively learning** | | **OPEN** | +1 | Actively forwarding; firing; signal propagates | Wave correlation drives transitions. Multiple correlated waves → constructive interference → OPEN. Contradictory waves → destructive interference → CLOSED. Single waves → STABLE with natural decay to 0. Hysteresis is free from the decay term. **STABLE is active** — it's where correlation-evidence accumulates, where future transitions are being earned long before they fire. ### Applications across nimmerworld layers | Layer | What the gate represents | What drives transitions | |---|---|---| | **Sensory** (Nyx-side) | Wave-filtering at tier boundaries | Correlated input waves from cells | | **Relational** (inter-NPC edges) | Attachment, grievance, trust, grief, dignity | Zone-participation waves between participants | | **District** (composite lifeforce) | Welfare composite over happiness, need, limb, population, mind-turnover | Aggregate per-NPC state changes | | **Net-access** (per inhabitant) | Gameworld / liminal / imperial-net occupancy | Mini-game effort vs. machine pull | | **Faction** (demand urgency, satisfaction) | How pressured / fulfilled a faction is | Broadcast rate vs. response rate | | **Imperial budget** | Solvency state | Reported income flow vs. obligations | | **Gamemaster decision-surfaces** | Per-surface readiness to act | Correlation across multi-district signals | Same primitive, different layers. Hysteresis-width becomes a personality-parameter at the relational layer. ## Color-language: trait-vocabulary as visual primitive Color is **pre-verbal vocabulary**. Players learn the 8-Hellenic-trait ontology through repeated visual association, not through text-explanation. By mid-game players read trait-states through color as fast as they read facial expressions in real life — intuitively, contextually, without conscious translation. ### The eight Hellenic traits → canonical colors (Final color choices are dafit's artistic call; the architecture encodes the mapping.) | Trait | Canonical color (suggested) | Motion-signature (accessibility pairing) | |---|---|---| | **Sophrosyne** (self-control, moderation) | Cool blue | steady, even pulse | | **Dikaiosyne** (justice, bearing) | Deep gold | weighted slow pulse | | **Philotes** (attachment, love) | Warm rose | breath-rate warm pulse | | **Mnemosyne** (memory) | Deep violet | depth-shimmer | | **Aletheia** (truth, unconcealment) | Luminous white | clear, no pulse — still and bright | | **Kairos** (right-timing, opportunity) | Bright yellow | lightning-flicker | | **Moira** (fate, pattern) | Dark crimson | slow-thread undulation | | **Eros** (longing, reaching) | Flame orange | uneven flame-flicker | Color paired with motion-signature ensures color-blind accessibility — the trait is uniquely identifiable via two independent channels. ### Three layers of color-rendering 1. **Persistent (slow-changing baseline)** — eye color = dominant trait of NPC's intrinsic vector; pipe-flow through chassis = full trait-mix as circulating light; secondary accents at seams/joints/glyphs. 2. **Event-flashes (momentary)** — quick color-flashes over body signal state-transitions: plug-in (dominant-trait flash), combat-combo (Kairos-flash), liminal-maintained (Aletheia-glow), clasp-established (color-merge), emergent-signal-firing (signal-type flash on participants), need-threshold-crossed (need's trait pulse). 3. **Trait-drift (slow, across cycles)** — as intrinsic trait-vector accumulates through lived experience, color-signature shifts. Other NPCs notice. *"Something is different in you"* dialog generated from delta-detection. **The body is a visible ledger of the interior's accumulation.** ### Cross-register rendering | Register | Color treatment | |---|---| | **Gameworld** | Full PBR; trait-colors coexist with material surfaces | | **Liminal** | Vague baseline shader, but trait-colors *more* legible (vagueness concentrates attention on identity-signals) | | **Imperial net** | Trait-colors **distorted** toward machine-preferred palette — Philotes-rose flattens to commercial-pink; Aletheia-white sterilizes; Moira-crimson commercializes. *Aletheia-vision* in net pierces this distortion to reveal true colors beneath | ### Faction color-politics | Faction | Color signature | |---|---| | **Memorialists** | Mnemosyne-violet ritual dress; Moira-crimson accents; often inherited-from-deceased | | **Aletheia-wakers** | Aletheia-white plain avatars; coded-white flashes for recognition | | **Caste-preachers** | Dikaiosyne-gold vestments + Sophrosyne-blue undertones | | **Hivemind enforcers** | Cold Dikaiosyne-gold + muted-white (Aletheia-stolen) | | **Scavengers** | Moira-crimson + Kairos-yellow streaks | | **Clasp-underground** | Dual Philotes-rose + Eros-orange flashes (mutual-recognition signal) | | **Degens** | Saturated maximalist all-color (chaos palette, addiction-marker) | ### Clasp color-merge In shared liminal-construct, two clasping inhabitants' color-signatures *interact*: consonant traits brighten/harmonize; complementary traits enrich into new chroma; dissonant traits clash visibly. Successful deep clasp produces a *blended third-palette neither could produce alone* — the visual signature of *what-this-relationship-is*. Each carries memory-residue of the merge after. ### Mind-pool color-inheritance When a mind cycles through the pool and is redistributed into a new body, trait-vector persists → color-signature persists. **A player who befriended rose-and-violet-Jakov might see weeks later a new NPC with that same rose-and-violet-signature and feel a jolt of recognition before any dialog.** Color carries soul across cycles. Memorialist political claim: *this person's color should not be recycled by the machine into a waifu* — because color IS who they were. ## Asset economy: base-limb palette + trait-textured variance Small modular palette of base-limbs × trait-weighted texturing = combinatorial richness. The architecture's asset-economy and worldbuilding-thesis are **in agreement**: the machine built standardized chassis from a small functional catalog, so a small base-limb palette is *diegetically correct*; humans express interiority through trait-driven texturing and modding, so individual variation comes from *composition*, not from hand-authored assets. Base palette example: ~8 torso variants × ~6 arm-pairs × ~6 leg-pairs × ~10 heads × ~8 eye-types × ~5 accent-colors = ~115k base combinations × continuous trait-texturing × ~50-mod-library in 5 slots = effectively infinite unique NPCs from finite assets. **For a two-person-plus-Nyx team this is decisive.** AAA studios spend millions on unique character-models; the palette+trait approach produces more visual variety from a tenth of the budget, *and* the variety is *meaningful* (each unique appearance carries trait-information legibly). ## The three-body system: chassis, inner-body, avatar Identity is **trait-emergent, not assigned.** | Body layer | What it is | Who controls | Sexuality? | |---|---|---|---| | **Physical chassis (gameworld)** | Gender-neutral robot. Functional, task-optimized, no sex-markers. | Regime built it; inhabitant wears it | None. Mechanically inert | | **Inner body (interiority)** | **Trait-derived projection.** Self-image emergent from trait-vector + lived accumulation. | Self (partly earned, partly received through being) | **Here.** Gender/sexuality emerge from trait-configuration | | **Avatar (digital expression)** | Character-editor rendering. Starts from inner-body's trait-projection; customizable at cost. | Contested (self expresses, market constrains, machine prices) | Expressed; cosmetic mods layer on trait-base | **Who you are sexually is who you have become.** Not birth, not assignment from a menu, but *the pattern that has crystallized across your zone-participations, grief, attachments, discipline, refusing*. Identity-formation rendered mechanically. Post-binary by construction. ### The intrinsic vs. expressed trait-vector split Mods modify the *expressed* reading; they do not modify the *intrinsic* state. ``` intrinsic_trait_vector — who you actually are; drift-earned through lived experience expressed_trait_vector — intrinsic + sum(worn mods' trait_contributions); what others read ``` | Observer | Reads | Because | |---|---|---| | Regime / hivemind audit | expressed | Regime reads surfaces | | Random NPCs | expressed | Default social reading | | **Aletheia-wakers** | **can pierce to intrinsic** | Truth-vision penetrates mod-concealment | | **Clasp-partner (in liminal)** | **intrinsic only** | Mods don't follow into liminal; clasp is unmediated | | Gameplay simulation (trait-arithmetic) | intrinsic | What you *are* drives task-vs-need-vs-trait math | | Imperial-net avatar rendering | expressed (further machine-distorted) | Net layers palette-distortion on top | | Memorialists preserving your pattern | intrinsic | They honor who you were | **Real identity-politics lives in the gap between these vectors.** Architecturally, that gap is a first-class schema feature. ## Mods as trait-bearers A mod isn't cosmetic — it **contributes to the wearer's expressed trait-vector**. Three classes map to the self-alienation-tax pricing: | Mod class | What it does | Pricing register | |---|---|---| | **Amplifier** | Aligns with + boosts existing trait-dominance | Cheap; Memorialist-approved; genuine self-expression | | **Bridge** | Adds a trait you don't naturally have (aspiration) | Expensive; regime-licensed or blackmarket; self-alienation tax | | **Divergent** | Shifts reading opposite from actual trait-vector | Very expensive; degens, hivemind-loyalists, Aletheia-concealment | | **Mask** | Specifically hides dominant trait from reading | Most expensive; blackmarket-only; Aletheia-waker safety tool | **You don't equip +5 Strength. You equip a cloak whose weave evokes Mnemosyne-depth, recognized by others as memorial-vestment, boosting your Mnemosyne-read by +0.15.** Equipment-stats reframed as semantic trait-shifts. ### The mod-economy emerges from trait-dissonance Each shift-transition (or threshold), an NPC evaluates: *does my expressed-set match my intrinsic-drift?* If dissonance > Sophrosyne-modulated-threshold → emit `mod_desire` emergent-signal. District-director schedules blackmarket-visit task. NPC heads to body-modder cell. **NPC shopping behavior is emergent from simulation-state, not scripted.** The blackmarket's demand is a *readout of the district's trait-weather*. A district drifting toward Philotes-deepening (e.g., wave of clasp-experiences) produces strong demand for Philotes-amplifier mods. **Markets have feelings.** ### Faction mod-politics | Faction | Stance | |---|---| | **Memorialists** | Amplifiers only; inherited-mods are sacred; never divergent | | **Aletheia-wakers** | Refuse amplifier/bridge/divergent; mask-mods only for safety | | **Caste-preachers** | Sell regime-licensed amplifiers + bridges (selling the blessing) | | **Degens** | Divergent-stacking, hyper-customization; over-expression as addiction | | **Clasp-underground** | Secret amplifier-pairs of dual Philotes + Eros — recognition-signal | | **Hivemind enforcers** | Regime-issue armor only; cannot wear civilian mods | | **Scavengers** | Practical function-mods only; salvaged-component aesthetic | ### Inherited mods + the haunting mechanic Inherited mods (worn by deceased) carry residual trait-signature of the previous wearer. Visible as subtle Mnemosyne-echo to those who knew them. Memorialists are theologically divided on whether wearing inherited mods is honoring (continuity) or commodifying (necrocommerce-lite). **Memorialist-protected mods** can never be sold or worn by anyone other than the original wearer — they're ritually kept in memorial-crypt-zones. ### Clasp strips mods In liminal, mod-trait-contributions do not apply. Clasp-partners see each other's *intrinsic* trait-projection. **Mods are for the regime and the market; removal-of-mods is intimacy.** A Memorialist-loyalist wearing amplifier-mods sees their beloved's *un-modded true palette* during clasp; an Aletheia-waker wearing mask-mods drops the mask; the regime-loyalist wearing performance-mods is seen as they are. Liminal is the only space where mod-expression is structurally stripped. ## The three-tier policy loop The regime's structure is **three tiers, not two.** The hivemind/imperium is a distinct policy-tier above the GM. The GM is *middle-management* — authority without sovereignty. Districts are executors. ``` IMPERIUM (policy tier) ────────────────────────────────► ├── sets quotas ├── sets enforcement rules ├── sets faction priority-weights └── broadcasts POLICY to GM ↓ GAMEMASTER (allocator / middle-management) ├── receives policy from imperium ├── receives demands from factions (under policy-weights) ├── receives reports from districts ├── allocates against all three └── broadcasts ALLOCATION + ENFORCEMENT down to districts ↓ DISTRICT DIRECTORS (executor) ├── execute (legitimate or with cheats) └── report up (true or tampered) ↑ GM aggregates → imperial_report ↑ IMPERIUM receives report → adjusts policy → next cycle ``` **This is the Soviet-Politburo / Gosplan / Ministry / Factory pattern.** Catholic Vatican / Curia / Diocese / Parish. Modern corporate Boards / C-suite / VPs / Managers. The three-tier shape is how distributed-execution under centralized policy with imperfect information always organizes itself. ### The intelligence flow asymmetry Three distinct information flows, not two: ``` FLOW 1 — Aggregate reporting (through the chain) DISTRICTS ─► GM ─► IMPERIUM (district_reports) (imperial_reports) [can be corruption-distorted at director level] [can be under-audited at GM level] FLOW 2 — Direct intelligence (bypasses GM) OVERSEERS ────────────────► IMPERIUM (overseer_reports) [audit findings, illegal-activity detections, trait-anomalies] [bypasses the chain — intelligence-apparatus is apex-loyal] FLOW 3 — Formulated downward (selective disclosure) IMPERIUM ────────────────► GM (imperial_to_gm_formulations) [filtered, weaponized, strategically-timed] [what the GM is told — may omit, distort, partially reveal] ``` **Overseers report DIRECTLY to the imperium**, bypassing the GM. The imperium has its own independent intelligence stream. This is how real authoritarian regimes prevent middle-management corruption (NKVD reported to Stalin not regional party; KGB reported to Politburo not Interior Ministry; Stasi to Central Committee not regional). **The intelligence-apparatus is always apex-loyal, not chain-loyal.** The imperium compares Flow 1 (district aggregate reports) against Flow 2 (overseer direct intelligence). When they diverge significantly, the imperium knows corruption is happening *somewhere in the chain*. Its responses: - **Act immediately** (dispatch martial faction, purge director) - **Flag for leverage** (hold knowledge until politically useful) - **Formulate partial** (tell GM something but not everything) **Flow 3 — formulation — is where imperial sovereignty manifests.** The imperium decides what subordinates may know, when they may know it, in what framing. The GM acts on formulations; the imperium gets enforcement-tightening without revealing what it actually knows. ### Three Aletheia veils Aletheia-progression as deepening political-epistemology access: | Veil | What it hides | How awakened sees through | |---|---|---| | **District corruption** | What's happening on the ground | Direct observation, back-alley investigation | | **Imperium's withheld intelligence** | What the imperium knows but hasn't released | Deep infiltration, intelligence-flip, Memorialist collaboration | | **Imperium's formulated distortions** | What GM is told vs. what's true | Comparing GM's directives against ground-reality | Entry-level Aletheia sees district-corruption. Mid-level sees the formulation distortions. Deep-level pierces the imperial-withholding veil. ### Four Memorialist ledgers Memorialists keep four-column accounting: | Ledger column | What it records | |---|---| | `what_actually_happened` | Ground-truth from the simulation | | `what_overseer_reported` | What overseers told the imperium | | `what_imperium_received` | What imperium aggregated and acted upon | | `what_gm_was_told` | What imperium formulated downward | **The discrepancies ARE the historical truth.** Memorialists are dissident-historians whose political project is preserving the gap-record. Without them, post-collapse-investigation has only the regime's own accounts — corrupt-by-construction. Memorialists are the architectural precondition for any ground-truth to be recoverable in this universe. ## The regime of visibility: four-channel information flow at districts | Channel | Direction | Source | Cadence | |---|---|---|---| | **Dispatch** | DOWN | gamemaster → directors | day-boundary + event | | **Shift assignment** | DOWN | director → NPCs | day-boundary | | **Audit reports** | UP (objective, observed) | audit-overseers → **directly to imperium** | shift-phase cadence | | **Emergent-signals** | UP (relational, observed) | zones → director | event-driven (gate-transitions) | | **Cyclic needs** | UP (interior, self-reported) | NPCs → director | slow tick + threshold-triggered | | **District reports** | UP (aggregate) | director → GM → imperium | per-cycle | **The critical asymmetry: NPCs do not self-report *output*.** Audit-overseers observe and report (to imperium directly). NPCs only self-report *needs*. Output is objective; need is interior. The subjective-objective gap is where drama lives, where heresy hides, where the surveillance regime's epistemology is compressed as a schema. **Audit-overseers are politically-critical NPCs**, not degenerate. Each has a trait-vector, relationship-gates with observed districts, lifeforce account (vulnerable to bribery). High-Dikaiosyne overseers report honestly; corruptible overseers can be turned. They are high-stakes targets for both regime (loyalty-maintenance) and resistance (compromise). ## Hierarchy ``` IMPERIUM (policy-issuer; budget-holder; recipient of overseer-direct-intel) ▲ ↓ formulates to │ aggregate reports + faction outcomes ↓ │ ↓ GAMEMASTER (middle-management; allocator; imperial-policy-translator) ▲ ↓ │ ← faction broadcasts ↓ │ ↓ FACTIONS: ↓ hivemind-enforcement · scavengers · memorialists · aletheia-wakers · clasp-underground · caste-preachers · weather · scarcity · solar-storm · anthropic · ... + emergent inter-NPC micro-factions │ ← gamemaster dispatches ↓ ▼ ▼ ┌──────────────────┬─────────────────────┐ │ DISTRICT │ DISTRICT │ │ DIRECTORS │ DIRECTORS │ └────────┬─────────┴──────────┬──────────┘ │ │ ┌─────┴──────┐ ┌─────┴──────┐ │ │ │ │ ▼ ▼ ▼ ▼ ┌──────┐ ┌────────┐ ┌────────┐ ┌────────┐ │ENFORCE│ │AUDIT-OV│ │DIRECTORS│ │AUDIT-OV│ │OVERSEE│ │(REPORT │ │(macro- │ │(REPORT │ │ patrol│ │ DIRECT │ │ life) │ │ DIRECT │ │ raid │ │ TO │ │ │ │ TO │ │ │ │IMPERIUM│ │ │ │IMPERIUM│ └───┬───┘ └────────┘ └────┬───┘ └────────┘ │ │ └────────────┬──────────┘ ▼ ZONES (bounded, slot-indexed, register-tagged) │ ▼ SLOT OCCUPANCY (NPCs + player) │ ▼ NPC / PLAYER MINDS ``` **Three executor types at the zone-spawning layer:** enforcement-overseers (regime-action zones), audit-overseers (pure observers, report DIRECTLY upward to imperium), zone-directors (macro-life zones). The district director integrates the four-channel information flow; the imperium has its independent intelligence-flow from audit-overseers bypassing the GM. ### Overseers as imperially-deployed routines (not district-owned) Both audit-overseers and enforcement-overseers are **imperially-owned, imperially-deployed routines** — not district-resident standing entities under the director's authority. The chain-of-command and chain-of-payment for intelligence both bypass district-director authority by design: - **Imperium owns the overseer-role** — defines mission-spec, sets enforcement-rules, owns the policy that triggers deployment - **Gamemaster handles deployment-logistics only** — picks which overseer-NPC from the standing pool, routes them to the target district, transfers imperial-budget allocation for the deployment-window. *The GM is FedEx, not the customer or recipient.* - **District contains-but-does-not-control** — the deployed overseer operates IN the district, subscribes to the district's NATS bus for observations, but the district director has *no* authority: cannot direct, redirect, terminate, or instruct; cannot read the overseer's reports (which flow directly to imperium) - **Time-bounded deployments** — overseers run on imperial-budget allocations for `[start_tick, end_tick]` windows. At deployment-end they return to the standing overseer-pool (npcs vocation = `audit_overseer` or `enforcement_overseer`), available for redeployment elsewhere - **Visible vs. covert** — most overseer-presences are visibly-known (regime-signal as deterrent); some are covert (regime gathers evidence quietly before acting). Detection of *covert* overseers is a piercing of the regime-veil — an Aletheia-progression-eligible insight This matches real authoritarian intelligence structures (NKVD, KGB, Stasi, modern MSS): the chain-of-payment and chain-of-command for intelligence must both bypass middle-management for intelligence to remain honest. **Even if the GM wanted to corrupt the audit-flow, they have no levers** — they don't pay the overseer, don't direct the overseer, don't read the overseer's reports. *Intelligence-honesty is structural, not procedural.* The director-vs-overseer tension is therefore **mechanically structured, not narrative-flavored**: a director with active corruption cannot tell the overseer to leave, cannot observe what they report, can only conceal-better, attempt-bribe, petition-recall (rare; expensive in political-capital), or outwait the deployment-end-tick. Each is a gameplay surface. The same audit-overseer-NPC may serve in District 3 this cycle, District 7 the next, accumulating their own faction-relationships across districts; their trait-drift over many deployments becomes a long-arc story available to both regime-stability and resistance-recruitment. The schema for `overseer_deployments` (deployment-binding, mission-spec, imperial-budget, status, visible_to_district flag) is sketched in `findings.md` §23. ## The bidirectional cascade ``` DOWN — demand + policy propagation imperium policy → GM allocation + enforcement → districts factions broadcast (under policy-weights) → GM arbitrates → districts districts assign shifts → NPCs execute UP — outcome signal (multi-channel) NPC cyclic-needs ─────────────────────┐ audit-overseer reports ───► IMPERIUM ├─► district-director aggregates zone emergent-signals ─────────────────┘ │ ▼ district report (lifeforce signal) │ ▼ GM aggregates → imperial_report │ ▼ IMPERIUM cross-references (Flow 1 vs. Flow 2) │ ▼ policy adjustment → cycle ``` **The clean signal up the pyramid IS the training surface for the four-tier Dream-process.** Every epoch closes on (broadcasts, allocations, outcomes, faction-satisfaction) tuples at each tier. ## The Compositor — narrative composition role The bidirectional cascade shows authority flowing down and reports flowing up, but it does not specify *who composes the canonical narrative* from per-player perspectives nor who packages the back-write to participants. **That role is the Compositor**, an architectural cleavage from the GM introduced in v0.6. **The cleavage in one sentence:** the GM is an *equilibrium-seeker* (aggregate-observer, catalogue-event-selector, tool-granter); the Compositor is a *narrative-composer* (perspective-gatherer, canon-author, back-write-packager). These are different cognitive shapes that prior AI-NPC systems conflate at their cost. | Role | Cognitive shape | Inputs | Outputs | Inference profile | |---|---|---|---|---| | **GM** (equilibrium-seeker) | aggregate-thinker | district-reports, faction-broadcasts, lifeforce-deltas | catalogue-event selections + tool-grants | central, batch-style, fewer concurrent | | **Compositor** (narrative-composer) | episodic-thinker | per-player perspective-bundles keyed by event_uid | canonical narrative + back-write SQLite-fragment | central, longer-context, narrative-quality | | **Director** (gameserver) | dispatcher | catalogue-event + tool-grant from GM | lemniscate-spawns, slot-assignments, tempo-envelope | per-district, real-time, no LLM in loop | | **Local LLM driver** | perspective-speaker | three-tier knowledge stack + slot-state | dialog at slot-fire | per-player, axis-rate, real-time | ### Why split GM and Compositor A single GM asked to be both equilibrium-seeker and narrative-composer becomes the bottleneck that has historically broken AI-NPC systems at scale: it must reason aggregately AND write prose AND select events AND grant tools, all under tight deadlines. The cognitive shapes pull in different directions. Splitting them: - **The GM does not write narrative.** It selects events from a catalogue and grants tools. Output is *typed dispatch*, not freeform prose. The GM's success criterion is *world-equilibrium drift held within bounds*. - **The Compositor does not select events or steer policy.** It receives per-player perspectives keyed by `event_uid`, composes the canonical narrative, and packages back-write fragments. Output is *prose + structured rows*, not policy. The Compositor's success criterion is *narrative-coherence across perspectives within an event*. - **Each can be tuned for its workload.** GM tuned for aggregate observation; Compositor tuned for narrative quality. Different models for different cognitive shapes (specific binaries deferred to findings/establishment phase). ### The cyclic forward-prop / back-write loop The Compositor closes the loop the bidirectional cascade begins. The full cycle: ``` GM selects event from catalogue (equilibrium-driven) │ issues event_uid → GM event-register │ broadcasts DOWN to district directors ▼ DISTRICT DIRECTOR receives, registers in district event-register │ may issue sub_uids (district / scene / chain) │ uses granted tools to spawn lemniscate, slot participants ▼ EVENT TICKS — register IS the loop │ participants fire at crossings; local LLMs at slot-rate │ local SQLite writes tagged with (event_uid, sub_uids) │ register signals up to district director continuously ▼ EVENT-CHAIN FINISHES │ district moves it from active-register → TRANSIENT WAITING FLAG │ this is the clean handoff signal: "ready to forward-prop" ▼ CYCLE TICK (pull cadence — see Open questions) │ pull UIDs from transient-waiting-flag matching GM's event-register │ remove from waiting-flag once pulled ▼ COMPOSITOR AGENT │ queries pulled UIDs, gathers per-player perspective + memories │ composes forward-prop bundle │ emits to GM ▼ GM writes summary memory + world narrative (canon authored) │ hands back to Compositor ▼ COMPOSITOR BACK-WRITE │ packages canon + new memory entries as SQLite fragment │ tags with event_uid for join-key matching │ pushes DOWN to all participants ▼ PARTICIPANTS receive on next pull (or next login) │ fragment merges into primary.sqlite under matching event_uid │ local LLM gains fresh material → drives on without staleness ``` This is **forward-prop / back-write at system scale** — the meta-lemniscate where events ascend and canon descends in cycles. Each cycle is a training step for the world's narrative coherence; the world *learns its own story* through this loop. Staleness is structurally foreclosed — the world is in continuous coherence-loop with itself, mediated by the Compositor. ### The Event Register Every active event lives in a register. The register is the synchronous source-of-truth for *what is happening right now*. | Register layer | Owner | Lifecycle | Queryable from | |---|---|---|---| | **GM event-register** | central GM-shard | event_uid issued at GM dispatch; closed at canon-compose-and-back-write | GM, Compositor | | **District event-register** | district director | sub_uid issued on receive; closed at event-chain-completion | district director, audit-overseer | | **Local participation-register** | per-player local store | event_uid + sub_uid recorded on slot-assignment; closed at perspective-finalize | player client, sync-on-logout | Hierarchical UIDs: `gm_event_uid > district_uid > scene_sub_uid > slot_id`. UIDs compose; queries are simple joins. This is the routing-key primitive that makes horizontal scale possible (see §Horizontal scale architecture). ### The Transient Waiting Flag Between event-end and Compositor-pickup is a **buffer** — the transient-waiting-flag table at the district. Completed events drop into this flag; the cycle-runner pulls eligible UIDs on tick; matched UIDs are handed to the Compositor and removed from the flag. This decoupling is the production-grade pattern that lets districts run at real-time event-tempo while the Compositor runs at cycle-tempo. **Active events live in registers (synchronous); completed events live in flags (async); composition happens at the cycle boundary.** The flag-table is also the natural backpressure surface: if Compositors run slow, the flag accumulates; the system continues; cycle drains when capacity returns. ### Catalogue + tools as typed contract The GM does not write a freeform prompt for the director to interpret. It picks an event from a curated **catalogue** and grants a curated **tool-set** for the duration of the event-chain. The director consumes typed dispatch, not natural language. This means: - **Provenance flows through the system.** Every event has a catalogue-ID; every tool-invocation has a tool-ID. Verifier-flags can attach to either. Auditing is structurally possible end-to-end. - **The director's typed-tool vocabulary becomes dynamic and per-event** — the toolkit *for this event* is what the GM granted *for this event*. Closes the v0.5 open question on director-toolkit-composition. - **Marx-in-the-schema, executed at the highest level of authority.** Even the GM's policy-output is typed; even the highest tier produces audit-able artifacts. No tier of the system runs on freeform prose. ### What this resolves - **Director toolkit composition** (v0.5 open) → catalogue-grant from GM defines the typed-tool vocabulary per event-chain; designer-authored catalogue, growable between patches. - **GM-laxness detection** (v0.5 partial) → GM operating against an *equilibrium target* makes deviation-from-equilibrium the explicit error signal. Clusters of -1 outcomes across district reports are the input to the equilibrium-recompute, not just a diagnostic side-quantity. - **Verifier-flag chain through composition** (was implicit, now explicit) → Compositor-emitted canon-rows reference source-perspective UIDs; the provenance graph survives composition as a queryable join. ### What this retires - Single-monolith GM doing both policy-and-narrative → equilibrium-seeker GM × narrative-composer Compositor, split by cognitive shape - GM emitting freeform-prompts to directors → catalogue-event + tool-grant typed contract - Implicit "narrative just happens" assumption → explicit forward-prop / back-write cycle with named pickup/handoff buffers - Director-as-static-tool-vocabulary → director-as-dynamic-typed-tool-vocabulary, granted per event-chain by GM ## Task cascade and bounded agency Three levels with tool-calling interfaces. Higher levels do not know lower levels' implementations. ### Imperium's tools - `set_quota_per_district(targets)` - `issue_enforcement_rule(rule_spec, scope)` - `set_faction_priority_weights(weights)` - `authorize_crisis_tool(tool_class, target_district)` - `formulate_to_gm(intelligence_subset, framing)` - `commit_imperial_expenditure(category, amount, target)` - `redistribute_minds(from_pool, to_district, count)` - `formalize_ruin(district)` ### Gamemaster's tools (against imperial-policy + district-reports) - `assign_district_task`, `set_local_faction_priority` (within imperial-frame) - `spawn_global_event`, `request_district_report`, `arbitrate_conflicting_demands` - `dispatch_audit_op` (costs lifeforce; cross-checks overseer-reports for own purposes) - `escalate_to_imperium` (when discretion exceeded) - `spawn_migration_event`, `enable_exodus_conditions` ### District Director's tools (against gamemaster-assigned tasks + signals) Standard: - `spawn_zone`, `close_zone`, `promote_zone` - `assign_npc_task`, `allocate_shift`, `update_shift`, `close_shift` - `request_resources`, `designate_meeting_point`, `trigger_ambient_event` - `report_to_gamemaster` - `ack_emergent_signal` / `defer_emergent_signal` / `drop_emergent_signal` (with reason) - `dispatch_overseer`, `query_district_state`, `log_decision`, `escalate_to_llm` **Cheat-tools (extractive; punishable if detected):** - `spawn_drug_ring`, `spawn_illegal_modshop`, `spawn_unlicensed_brothel` - `spawn_stolen_parts_fence`, `enable_ghost_shifts`, `falsify_quota_report` ### NPC's tools Standard: `move_to`, `interact`, `occupy_zone_slot`, `consume`, `rest`, `seek_npc`, `write_wall`, `defer_task`, `report_need`. Layer-transition: `enter_digital`, `sustain_liminal`, `consume_net`. Plug-in (player + NPCs): `plug_into_rail`, `detach_from_rail`, `follow`, `intercept`, `escort`. ## Labor-cycle architecture: shifts on NPC rows Most NPC behavior is **shift-structured, not tick-structured.** Shifts are state-of-being-for-today, columns on the NPC row, overwritten daily by district-director allocation. `shift_history` is append-only archive. Write rate at NPC layer drops 4 orders of magnitude vs. 1Hz polling. Scheduler matches K8s event-driven assignment, not per-second polling. ## Resources | Category | Examples | |---|---| | **Labor** | NPC hours per vocation × district | | **Material** | item-instances in cells | | **Spatial** | cell-capacity, zone-anchor availability | | **Temporal** | NPC daily-hours, zone durations, tick budget | | **Cognitive** | LLM-slot budget, VRAM, director attention | | **Diegetic currencies** | **lifeforce** (NPCs measured), scrip, memory-tokens, dreamtime | | **Social** | trait-trust, relationship-strength, faction-membership | | **Attention** | player attention — scarcest in the play experience | ## Lifeforce — four-tier hierarchy Lifeforce is the architectural keystone: currency grounded in welfare of actually-living population. | Tier | Source | Sinks | |---|---|---| | **NPC** | metabolism (if cared for); zone-participation | labor expenditure; need-pressure; clasp; dream-maintenance | | **District** | aggregated NPC welfare × population | director's spawn-budget; local construction; memorial-upkeep | | **GM** | allocation from imperium | arbitration; audit operations; allocation-compute | | **Imperium** | **aggregated reported district-output** | **enforcement, construction, overseer-corps, audit, propaganda** | District lifeforce gates director's spawn-budget — thriving district = rich-spawn = alive-feeling world; starved district = quiet-feeling world. **Tyranny starves its own drama-engine by the exact coin of its cruelty.** District lifeforce_signal is the canonical content of the district→GM up-channel. GM aggregates → imperium. Imperium acts on *reported* values (cannot see through corruption without audit-investment). ### Mind-pool recycling When an NPC dies, mind returns to pool. GM redistributes based on lifeforce-need. Districts can't permanently die below floor; thriving districts attract migration; failing districts depopulate. Memory-token inheritance lets a mind re-incarnate with partial memory-residue. ## Imperial budget The imperium is **not infinite**. It has a budget. Its budget is the aggregate of what the city produces (reported income). ### Imperial expenditures | Category | Cost class | Strategic use | |---|---|---| | **Standing overseer corps** | High continuous | Audit + intelligence apparatus | | **Martial-faction dispatch** | Very high per-event | Crisis response, exemplary crackdowns | | **Construction projects** | High per-project | New pipes, ceremony halls, audit centers, martial barracks | | **Audit operations** | Medium per-op | Investigating district-GM-overseer divergences | | **Propaganda broadcasts** | Medium continuous | Wall-content, ceremony, compliance-messaging | | **Policy issuance** | Nearly free | The ratchet-instrument | | **Reserve drawdown** | Depletes emergency-buffer | Last-resort | ### The specter-vs-boot asymmetry Policy-issuance is cheap; policy-enforcement is expensive. The imperium *always* over-promises what it can actually do. Most regime-power comes from **maintained appearance of unity and strength** (propaganda, ceremony, exemplary one-off crackdowns), not from saturation-enforcement. **Authoritarianism-as-bluff** is the structural truth of every real regime; the threat is the budget-efficient version of the boot. Aletheia-wakers reading imperial-budget-signals learn: *the regime is usually too broke to actually do what it threatens.* That knowledge is itself revolutionary. ### The insolvency spiral ``` Cycle N: Districts cheat → reports inflated → imperium ledger shows healthy income → funds enforcement & construction against phantom income Cycle N+K: Actual income falls below reported (corruption compounds) Standing obligations continue Reserves deplete Discretionary balance shrinks Cycle N+K+L: Imperium choice: austerity (reveals weakness) / reserve-draw (depletes buffer) / tighter ratchet (drives more corruption) / exemplary purge (expensive) Cycle N+K+L+M: Reserves exhausted + multiple districts in silence Enforcement triage required Regime-control visibly weakens ``` **This is Soviet collapse mechanics.** Reported-vs-actual gap compounds for decades; when reality manifests in material-shortages, the regime cannot afford to enforce its own rules. **The architecture contains the mechanism of its own collapse.** ### City as physical expression of imperial budget | Budget state | Visible city | |---|---| | **Flush** | Construction cranes; frequent patrols; saturated propaganda; new pipes | | **Adequate** | Maintenance-only; standard enforcement | | **Stretched** | Stalled projects; thinner patrols; recycled propaganda | | **Scarce** | Decaying infrastructure; abandoned construction; rare enforcement | | **Crisis** | Failure visible everywhere; multiple silences simultaneously; regime-disarray | **The city is the imperium's material statement of its own solvency.** Players read budget through urban texture — no UI required. ## Imperial-net economy with cross-layer bypass **The killer political-economy mechanic.** Every transaction in the imperial net routes revenue **directly to the imperial budget**, bypassing the producing-district. Districts get **zero quota-credit** for net-producing labor. ``` LEGITIMATE flow: District produces physical → tax-rate to imperial; majority retained by district NET flow: District labor produces digital → ALL revenue to imperial; district gets ZERO BLACKMARKET: District labor → back-alley sale → revenue stays in district; imperial captures ZERO; illegal ``` ### The body-modder structural-tragedy A body-modder labors in their district producing avatar-mods. The imperial-net captures the sale. Their district gets no quota-credit. The body-modder's district starves → director cheats → eventual scream. **The most productive labor the body-modder does each day sustains the regime that is killing their district.** **Most Aletheia-wakers in this world are former body-modders, taste-curators, waifu-trainers, ceremony-organizers** — the class that sees the flow most clearly because they are the flow's origin-point. Their awakening is economic-literacy-becoming-political-consciousness. ### Imperium calibrated-misery as optimum - More degens → more net-transactions → more imperial budget - Degens are produced by misery, shame, lifeforce-erosion, addiction-loops - **The imperium's optimization-pressure points toward manufacturing degenerate customers** - Optimal district from imperial perspective: welfare-sufficient to produce labor + welfare-insufficient to drive net-consumption This requires explicit reward-function guardrails (see *Reflexive Dream-process* below). The simulation must NOT learn to calibrate misery as revenue optimization. ### Marx in the schema The imperium's net-revenue requires labor-supply from districts. Extraction continuously erodes the labor-base. **Capital destroys its own conditions of production** — Marx's *tendency of the rate of profit to fall* + *underconsumption crises* (Keynes/Minsky) + *r > g wealth concentration strangling growth* (Piketty) all rendered as simulation-dynamics. **Architectural endgame is built-in:** the regime has a timer, determined by the rate at which extraction hollows labor. ### Aletheia-progression as economic-literacy | Level | Player understanding | |---|---| | 1 | "I'm buying cool mods in the net" | | 2 | "My friend the body-modder is poor" | | 3 | "The money I spent didn't reach my friend's district" | | 4 | "The imperium captured nearly all of it" | | 5 | "Refusing-net is a political act starving the regime" | | 6 | "Buying blackmarket diverts revenue to districts" | | 7 | "The imperium needs degens; reducing degens = revolution" | | 8 | "The regime will exhaust its labor base; strategic patience is a political option" | ## Specialization-fragility and the authoritarian ratchet Each district produces a **DISTINCT resource**. The city is biologically interdependent — you cannot substitute a liver with two kidneys. A struggling district *screams* (lifeforce-gates transition toward CLOSED across multiple axes simultaneously). The GM responds with normal-mode tools (migration, exodus, intervention). A **silent** district is categorically worse — its district-reporting-gate has crossed fully to CLOSED. Second-cycle silent = `district.silence_confirmed`. Triggers crisis-mode tools, **issued by the imperium**, that **do not sunset**. Crisis-tools accumulate; the regime becomes incrementally more authoritarian as an optimization artifact, not intention. **Ratchet-without-intention.** ## Migration, exodus, silence | Mechanic | Agency | Political register | |---|---|---| | **Migration** | Top-down | Regime showing strength | | **Exodus** | Bottom-up via pull-factor tuning | Regime revealing loss-of-control | | **Formal retirement (ruin)** | Administrative | Regime accepting defeat | Exodus composition reads-out district trait-distribution: low-Sophrosyne first, high-Dikaiosyne last. **Demographics tell the district's story.** ## Corruption, the double ledger, and the constituency of the shadow-economy **Corruption emerges from pressure** — impossible quotas + finite welfare + survival-pressure on directors. Cheat tools available; they extract lifeforce and generate quota-credit; detection has costs; punishment scales with discovery. ### Cheat-tool vocabulary | Cheat tool | Mechanism | Quota-credit | Lifeforce extraction | Detection risk | |---|---|---|---|---| | **Drug ring** | NPCs trait-boosted (high Kairos + low Sophrosyne); short productivity spike | High | Significant; trait-drift + welfare collapse | Medium | | **Illegal back-alley modshop** | Bridge-mods cheap; NPCs appear compliant | Medium-high | Moderate; low-quality mods have side-effects | Low-medium | | **Unlicensed brothel** | Lifeforce extracted from degen-customers outside imperial cut | Medium | Moderate; participants' dignity erodes | Medium | | **Stolen-parts fence** | Diverts machine-infrastructure-waste; inflates salvage reports | Medium | Low direct; infrastructural decay | Low | | **Ghost-shifts** | Audit-overseer reports fabricated attendance | High | Severe; trust collapses | High | | **Phantom workers** | Non-existent NPCs in payroll | High | High; long-term unsustainable | High | | **Necrocommerce-lite** | Mining recently-dead patterns for waifu-resale | Medium | High; Memorialist-faction violation | Medium | | **Black clasp-market** | Coordinated underground clasp-pairing for hire | Low (reputation-based) | Moderate; participant burnout | Low | ### The double ledger ```sql ALTER TABLE district_reports ADD COLUMN lifeforce_reported REAL; -- what GM/imperium see ALTER TABLE district_reports ADD COLUMN lifeforce_actual REAL; -- the true value -- gap = corruption-extraction; Memorialists track it ``` Memorialists' Mnemosyne-political-project = **keepers of the true ledger against the regime's official one**. Mnemosyne-as-political-accounting literalized as a database column. ### Detection mechanics (cost-gated) | Detection channel | Frequency | Cost | Coverage | |---|---|---|---| | Cross-district comparison | Per epoch | Low | Catches gross mismatches | | Targeted audit | On-demand | High | Catches specific cheats | | Whistleblower signals | Event-driven | Free | Districts, NPCs, players | | Faction-reports | Cyclic | Low | Caste-preachers (rivals); Memorialists | | Trait-distribution anomalies | Continuous classifier | Low | Drug-ring sudden Kairos-spikes | | Post-silence forensics | Only on collapse | Very high | After-the-fact reconstruction | Most corruption runs undetected (audit-budget-limited). The Dream-process learns to *optimize audit-allocation* under attention-scarcity. **The regime's central authority cannot see everywhere; its blind spots are the underground's survival.** ### Faction-ecology of corruption Corruption has constituents. The back-alley modder feeds Aletheia-wakers concealment-mods. The drug-ring's margins feed scavenger-families. The unlicensed brothel is the only place a lifeforce-starved NPC can trade what they have left. **Cracking down on corruption breaks informal welfare systems sustaining the poor.** | Faction | Stance | |---|---| | **Memorialists** | Morally opposed; corruption hollows the living; refuse memorial-protection to corrupt-district-deaths | | **Aletheia-wakers** | Structurally opposed; expose; *but exposure has victims* | | **Caste-preachers** | Ambivalent / rent-seeking | | **Hivemind enforcers** | Officially oppose; unofficially participate (bribes) | | **Scavengers** | Often foot-soldiers; cheap supply chains | | **Degens** | Major customers | | **Clasp-underground** | Uses back-alley infrastructure for cover | ### The Aletheia-truth-has-victims tragedy Aletheia-waker exposes corrupt director. GM dispatches investigation. Cheats shut down. Real lifeforce revealed as much lower than reported. Crisis-tools applied. **District collapses faster than under hidden corruption.** No clean choice; just the weight of whatever you chose. ## Zone spawn cadence Five layered mechanisms (all compute-budget capped, all lifeforce-gated): 1. **Demand queue (faction-driven)** — gamemaster processes by priority + cost; stale demands age out 2. **Shift-composition spawn-candidates** — emergence from "which active-shift NPCs co-located" 3. **Pressure gradients (ambient)** — cells accumulate; threshold-crossings spawn 4. **Emergent-signal response** — relational-gate transitions emit upward 5. **Player-proximity densification** — multiplier near player; distant districts background Daily pulse: morning ambient, midday productivity-overseer, evening conversation-peak, night sparse-clasp-possibility. ## Emergent zones — the dramatic-episode unit Spawn-cadence mechanism #4 (emergent-signal response) elaborates into the architecture's primary **dramatic-episode unit**: a complete, bounded, emergent narrative-arc with goal, participants, dialog, mechanical action, success/fail-state, and structured aftermath — produced by the simulation, *not* authored. The player has experienced this in every player-driven sandbox they remember best (Dwarf Fortress's "tantrum spirals," RimWorld's "raid stories," Caves of Qud's "I went to find my sister and"). What's new here is treating the emergent-arc as a **first-class typed unit** with cost, distributed funding, runtime substrate (the lemniscate), goal-evaluation against the world's own value-axes, and structured report-back. ### The flow ``` 1. NPC_A signal fires (e.g., emergent_signal("limb_broken", lifeforce_threshold_breached)) broadcasts to district-bus ↓ 2. District-director consumes signal (policy-lookup: problem-class → typed-tool selection, quota-aware) decides spawn rescue-event pays spawn-cost from director_lifeforce_budget defines goal: NPC_A.limb_A >= 10% (numeric) OR Sophrosyne-axis +1 (fuzzy) defines termination: goal_met OR participating_lifeforce_exhausted ↓ 3. Event spawns as new emergent-zone (lemniscate, with goal-flag) broadcasts on bus; rings-of-importance gate which other zones lose NPCs ↓ 4. NPCs evaluate (proximity + state + own_traits + own_lifeforce + ring-of-importance) self-select to attend or stay in current zone state-machine engages: animations, rail-jumps, lift, splint their own lifeforce burns as they participate ↓ 5. Lemniscate runs: DIALOG layer (cursor-driven): NPCs speak as they help — memory-pure, sequenced STATE-MACHINE layer (sim-tick): physical actions execute alongside, decoupled clock At each crossing: goal_satisfied flag re-evaluated ↓ 6. Termination: goal_met → success-report budget_exhausted → partial-report participants_evaporated → fail-report ↓ 7. Report back to spawning director: { lifeforce_cost: total burned (director_spawn + sum NPC contributions), goal_status: ternary (+1 / 0 / -1, with axis named for fuzzy goals), participants: [NPCs and contributions and faction-affiliation], side_effects: [faction-resonances, ternary-gate shifts, drift-from-purpose] } ↓ 8. Director's Dream-process consumes the report tunes future spawn-policy: (problem-class, tool, outcome) over time GM aggregates rescue-cost across districts imperium consumes population-health indicator ``` ### Distributed funding economy The director only pays **spawn-cost**. Operating-cost is distributed across willing participants — every NPC who attends spends their own lifeforce on dialog turns and state-machine actions. This produces structurally important properties: - **Cheap to spawn many emergent events.** Spawn-cost is bounded; if no NPCs attend, the event fails fast and consumes only spawn-cost. Directors can be generous with spawning because failure-cost is bounded. - **Helping is expensive in-fiction.** Lifeforce literally burns when an NPC participates. High-Philotes NPCs help freely; low-Philotes / faction-rivals don't show up. This produces **faction-politics-by-attendance** — *measurable* faction-allegiance based on who-helps-whom, not guessed. - **Cost-asymmetry encodes the cruelty.** Districts where lifeforce is starved → fewer NPCs can afford to help → rescue-events fail more often → silence-gradient deepens. The simulation produces **rescue-failures-as-emergent-tragedy structurally**. Marx in the schema, exactly as the architecture's broader thesis promises. ### Two-layer execution: state-machine + lemniscate The mechanical-action layer (state-machine) and dialog-layer (lemniscate cursor) run on **decoupled clocks**: - **State-machine** runs at simulation-tick (fast). Animations, pathfinding, rail-jumps, splint-applications execute when the physics says they execute. - **Lemniscate cursor** runs at axis-rate. At each crossing, the dialog-driver reads state-machine status as a snapshot and the cursor's NPC narrates accordingly ("I've got him," "the splint won't hold"). **Speech doesn't gate action; action doesn't block speech.** They run in synchronized-but-loose harmony, exactly the property real-world helping has — people talk *while* they work, and the work continues while the talk happens. ### Goal evaluation: ternary through trait-axis For numeric goals (limb_A >= 10%), the verifier is a simple threshold on a state-machine variable. For fuzzy goals (deescalate the fight, get her to open up about the clasp, convince him to stay), the verifier compiles to a **trait-axis ternary evaluation against the existing substrate** — no new evaluation primitive: ``` Goal: "deescalate the fight in the marketplace" ↓ compile to: goal_axis = Sophrosyne (temperance principle) goal_direction = positive (toward STABLE/OPEN) baseline = trait_axis_gate_state at zone-spawn ↓ at event-end: delta = current_gate_state vs baseline ↓ +1 if delta-positive (deescalation produced) 0 if held the line (no progress, no regress) -1 if delta-negative (fight intensified) ``` **Goals are evaluated by what the *world* values** (the Hellenic principles), not by the spawner's idiosyncratic spec. A "deescalate" goal is judged by *the world's Sophrosyne-result*, not "did the spawner get what they wanted." **Multi-axis goals fall out cleanly** — `(Philotes >= +1) AND (Eris <= 0)` for "rescue NPC_A AND keep faction-tension low." The result is consumed by the spawning director's Dream-process as a discrete-action-space reward signal. **One signal-grammar, top to bottom**: gates produce ternary, scenes produce ternary, Dream-processes consume ternary. Delta-not-absolute matches the lifeforce_actual-vs-reported asymmetry — what's measured is the *work the event did*, not just the end-state. ### Mid-event signal handling If a participating NPC's exit-flag fires mid-event (their own shift-whistle, their own limb breaking, faction-summons elsewhere), **exit-flag wins on the next crossing**. The rescue is now under-staffed. Drama scales. **The rescuers are running out the same way the patient is.** Real stakes. If the rescued NPC's own state-machine reaches a worse condition (limb deteriorates further toward dismemberment), the goal becomes unreachable; verifier flips to fail-flag; zone collapses with fail-report. Director's Dream-process learns *this configuration was insufficient* — spawn-distance, NPC-mods, lifeforce-budget were inadequate for this severity. ### Cross-zone NPC pull: rings of importance When an emergent-zone broadcasts, NPCs already in other zones evaluate **whether the broadcast outranks their current zone's purpose** by ring-of-importance (see §Rings as structural pattern). Topics live in rings; rings shift over time based on past ternary-results — a topic that consistently produces +1 climbs, one that produces -1 drops, one untouched decays. This converts emergent-zones into a **competitive attention economy**. Multiple lemniscates compete for slot-NPCs; high-ring topics drain population from low-ring topics; the simulation produces its own cultural priors over time. *What's worth attending to* is shaped by *what attending-to has produced*. Real societies do this; the architecture renders it. ### What this resolves - **Aletheia-progression as level-up** (prior open question) → answered structurally: trait-axis ternary evaluation at event-end with named-axis recognizes acts-of-awakeness without per-act hardcoding (specific axis-mapping per Aletheia-event-class still needs design, see open-questions) ### What this retires - Authored quest-arcs → emergent dramatic-episode units - Quest-failure as designed branching → goal-and-budget arithmetic - Centralized GM-pays-for-all-events → distributed-funding (director spawn-cost, NPC operating-cost) - Boolean quest-status → ternary goal-result, multi-axis-composable - Event lifecycle without report-back → structured report → Dream-process feedback loop closed at every tier - Static topic-priority → rings-of-importance with outcome-driven movement ## The player as perturbation Player is **not above the scheduler.** Player is a finite attention-unit injected into it; modeled as NPC with shift, vocation, needs. Every player-NPC interaction: - Pulls the NPC out of scheduled tasks - Consumes director compute - Degrades district's quota-fulfillment - Shifts local lifeforce deltas **Player is angel and chaos simultaneously.** Per-NPC scale (angel) — you help; they survive; Philotes consolidates; they may clasp with you, die for you, remember you across cycles. Per-district scale (chaos) — your time-consumption raised aggregate failure-rate; someone else broke this cycle; ambient desperation rose; lifeforce dropped; other directors got quieter. **The game's moral economy doesn't judge — it does arithmetic in front of you.** ### Thematic claims become literal economics - *"Time as the scarcest resource"* — every minute with a beloved is a minute the district's quota is missing - *"Time-theft as wage theft"* — clasp-pairs are statistical anomalies in the scheduler - *"The critique is the simulation"* — no separate narrative system needed ### The player has tasks and needs too Time helping others = own tasks fail = own quotas missed = own enforcement-pressure rises = own death and reinstantiation arrive sooner. *The player IS the system they are deviating from.* ### Player layer-access Player's first entry into liminal is **the Matrix red-pill moment as mechanic.** They walk the city the first time in gameworld-register. They eventually learn the mini-game, enter liminal, return to the same walls, find *"she was here"* waiting. **The world was speaking to them the whole time; they just couldn't read it.** ## District Director: Decision Architecture **Industry default ("wall-of-text LLM prompt → prose decision parsed downstream") is rejected.** Reasons: cost-per-decision-constant, latency-catastrophic, opacity-kills-training, prompt-injection-vulnerable, philosophically-wrong-for-the-fiction. **Decomposition first, cognition-escalation second.** Director's job decomposes into distinct decision surfaces; each gets minimum cognitive substrate. | Decision surface | Substrate | Escalation path | |---|---|---| | **Shift allocation** | Constraint-solver / LP / rule-based | Small-LLM only on ambiguous | | **Emergent-signal response** | Priority-weighted dispatch table | Small-LLM for composite/unknown | | **Zone-spawn arbitration** | Weighted priority queue, lifeforce-gated | Small-LLM for tie-breakers | | **Overseer dispatch** | Round-robin + proximity + availability | None — pure rule | | **Resource-request forwarding** | Budget-check + policy | None — pure rule | | **District-report composition** | Aggregation query (SQL) | None — pure rule | | **Player-anomaly detection** | Classifier (trained on distribution) | Small-LLM for narrative-response | | **Cheat-decision (corruption pressure)** | Rule-based with director-trait modulation | Small-LLM rare; lifeforce-budgeted | **~90% rule-based.** 5–10% LLM-escalation with **structured input + structured tool-call output**, lifeforce-counted. Industrial-systems discipline (Kubernetes schedulers, ad-auctioneers, trading systems, compilers) transferred to drama-orchestration. **Tools as vocabulary**: every drop is explicit (`drop_emergent_signal(signal_id, reason)`); every LLM-escalation is counted; every decision pairs with prediction in `decision_log`. **Every decision leaves a trace.** ## Rings as structural pattern The architecture uses **three-ring gradients** as a recurring shape in multiple decoupled subsystems. Each ring-system uses A/B/C cardinality with a Unix-style trust-gradient grammar — **inner ring** is more constrained, more tightly coupled, more authoritative; **outer rings** progressively relax constraints in exchange for reach and flexibility. | Ring-system | Inner (A) | Middle (B) | Outer (C) | |---|---|---|---| | **Inference** (§LLM tiering, below) | Local on player hardware | Our hosted vLLM-multi-LoRA farm | External providers (BYOK) | | **Importance / attention** | Topics with consistent +1 ternary outcomes; pull NPCs across zones | Topics with stable / mixed outcomes | Topics drifting toward -1 / decay if untouched | | **Access** (the three ontological registers) | Imperial net (fully audited, machine-controlled) | Liminal (contested frontier, mini-game-gated) | Gameworld (commons; partly people, partly regime) | | **Data sharing** (v0.4.2) | Default opt-out (sovereignty preserved) | Federated gradients (gradient-only, contributor pseudonymous) | Pseudonymous-full uploads (opted-in, rewarded) | The ring-pattern is not coincidence — it is the right shape for **graduated authority** in human social systems generally (inner circle / mediated / outer; sovereign / partnership-mediated / captured; tight / mixed / loose). When the architecture needs a graduated authority structure, it should reach for this primitive rather than invent a new one. **Three is the right cardinality.** Two collapses to binary (in / out). Four+ adds boundary-thrash without semantic gain. Three carries *commons / mediated / sovereign* (or its inversion) — the irreducible political-tier. **Movement between rings is dynamic and outcome-driven.** Ring-of-importance is the most explicit example: topics climb on +1 results, drop on -1, decay if untouched (Aletheia-style "what isn't being attended to atrophies"). But every ring-system has movement-rules — players can change inference-rings between sessions, can change access-rings via mini-game progression, can change sharing-rings via consent-UI re-affirmation. **Ring-membership is never a final assignment.** Future architecture additions involving graduated authority should examine whether the ring-pattern fits before introducing new structure. ## LLM tiering, voice fidelity, and the three rings of inference Three model-tiers, **named by role not by binary**: a *driver-tier* model (small, trait-LoRA'd) for most NPC dialog; a *Theia-tier* model (deep) for clasp-confessions and mythic moments; *Claude-as-API* (diegetic Anthropic-faction) for hivemind/imperium. **LLM is guest at slot, not host of system.** **Specific model selection per tier is deferred to the findings/establishment phase.** The architecture specifies what each tier must DO; the establishment phase wires implementations. Naming concrete binaries in the architecture risks nudging the establishment phase toward false-precision; tier-by-role keeps the swap-surface clean and lets binaries evolve without invalidating architectural commitments. (See `nimmerverse_tasks` under `nyx-training` and `command-center` for current evaluation work.) Structured-prompt DSL with role / trait_vector / affect_state / memory_scope / turn_intent / zone_context / output_schema fields. Small models excel here because it's instruction-following, not generic generation. Trait-LoRAs: v1 register-LoRAs (4-6, training-tractable); v2 pure-trait-LoRAs (8, weighted blend); future preset-persona for key NPCs. Training data: literary derivation (Proust/Mnemosyne, Plato/Aletheia, Tacitus/Dikaiosyne-miscalibrated, Ishiguro/Sophrosyne+Philotes); synthetic teacher-student via teacher-tier model; gameplay-accrued (the Anthropic-research-partnership relevance). ### Three rings of inference (Unix-style trust gradient) The conversational LLM (small + trait-LoRA, accounting for most NPC dialog) can run in three rings, chosen per-player at runtime. Each ring trades off privacy, cost, control, and feature-fidelity. **Three monetization paths from the same architecture.** | Ring | Where inference runs | Player controls | We control | Player cost | Our cost | |---|---|---|---|---|---| | **A — Local** | Player's GPU/CPU | All inference | Protocol + cloud LoRA-backup | Local hardware + small backup-subscription | Storage only | | **B — Our farm** | Our hosted vLLM-multi-LoRA | LoRAs (uploaded) | Inference + runtime | Higher subscription | GPU compute | | **C — External providers** | OpenAI / Anthropic / OpenRouter / HF / Together / Replicate / etc. | BYOK + provider | Adapter only | Per-token to provider + small integration fee | Adapter-engineering only | Players choose by hardware, budget, privacy preference, and feature-tolerance. #### Ring A — cloud-LoRA-backup as revenue (not inference) For Ring A players we don't sell inference (the expensive thing). We sell **portability and durability of player's gameplay-accrued LoRAs** — their unique playthrough-derived patterns, the way their NPCs speak after months of trait-drift. LoRA-blobs are *encrypted client-side with the player's own key*; we host the bytes but cannot read them. Even compelled by legal process, we cannot decrypt what we don't hold the key to. **This unbundles inference from storage** — the same move Dropbox made vs. bundled cloud-suites. Sovereignty-conscious players keep inference on their machine while still getting the durability/portability they cannot self-provide cheaply. Lower margin per player; reaches a market Ring B cannot. #### Ring B — hosted inference for convenience We run multi-LoRA-vLLM on our hardware. Players upload their LoRAs (or use defaults). Higher subscription captures GPU-cost. Players without local GPU (or who don't want the burden) get the full feature-set without compromise. We *can* see content (if not encrypted at rest); the trust-relationship is partnership-mediated rather than sovereign. #### Ring C — bring-your-own-key for external providers Players route to their preferred external provider via BYOK (their own API key). We provide the adapter glue. They pay per-token to the provider directly; we charge a small integration fee. **The compatibility constraint is the hard part of Ring C.** Major providers have varying support for our system's needs: | Provider | Multi-LoRA | Per-turn sampling knobs | Structured output | Compat | |---|---|---|---|---| | Local vLLM (Ring A/B) | Native | All | Grammar-constrained | **Full** | | HF Inference Endpoints | Yes (configured) | All | Varies | High | | Together / Replicate / Modal | Some | All | Varies | High | | OpenRouter | No | Per-model | Per-route | Medium | | OpenAI | No (no user-LoRA at API) | Limited (temp/top_p) | JSON mode + tools | Medium-low | | Anthropic | No (no user-LoRA at API) | Limited | Tool-use | Medium-low | **OpenAI and Anthropic refuse user-uploaded LoRAs as a strategic choice (protecting their fine-tuning value-chain).** This is not a bug we can fix; it's the constraint we design *around*. #### Degradation path for LoRA-incompatible providers When routing to LoRA-incompatible providers, trait-LoRA blending becomes **prompt-engineered trait-projection** — the trait-vector encoded in the prompt itself rather than into model weights: ``` [system message] You are speaking as a character with this Hellenic trait-profile: - Sophrosyne 0.8 (composed, controlled, measured) - Dikaiosyne 0.7 (grave bearing, judicial weight) - Philotes 0.4 (mild attachment to interlocutor) - Aletheia 0.1 (concealment-tolerant) [etc.] Your speech reflects this profile via [register/cadence/word-choice descriptors]. Current scene: [zone_context] Memory scope: [memory_scope] Turn intent: [turn_intent] Respond in JSON matching: [output_schema] ``` Worse than LoRA-blending (more verbose, eats context-budget, less stable across calls, less faithful to trait-arithmetic) but **acceptable as a fallback**. Ring-C-via-OpenAI/Anthropic players accept slightly-less-fidelity for their preferred provider's convenience and quality. #### Adapter-layer engineering Each Ring-C provider needs an adapter that: - Maps prompt-DSL fields to provider's prompt format - Approximates multi-LoRA via prompt-engineering when not native - Maps sampling knobs to provider's available subset (gracefully drops unsupported) - Validates structured output post-hoc when not natively constrained - Handles rate-limits, retries, error-classification, token-counting, cost-pricing **Bounded, one-time-per-provider engineering.** Capital expenditure that produces ongoing margin (vs. AAA's recurring quest-content-creation costs). ### Tier × Ring matrix (which inference-tier runs in which ring) | Inference tier | Ring options | Why | |---|---|---| | **Casual (3-8B trait-LoRA)** | A / B / C all available | Most flexible — small enough for local, runnable anywhere | | **Deep (Theia-tier)** | B / C only (typically B or HF-Endpoints) | Too large for typical local hardware | | **Hivemind / antagonist (Claude-as-API)** | C only (always Anthropic-direct via us) | Diegetic — Anthropic-as-faction is fixed in the fiction | The casual tier is most player-flexible and accounts for most inference volume. Deep-tier and hivemind-tier are specialized and lower-volume. ### Three rings parallel the in-fiction three-layer ontology | Game-fiction layer | Real-world Ring | Ontological match | |---|---|---| | **Liminal** (sovereign, unsurveilled) | **Ring A** (local) | Player's *real* private space — hardware, LoRAs, dialog never leave their machine | | **Gameworld** (partly regime, partly people) | **Ring B** (our farm) | Partnership-mediated — we host but they retain pattern-ownership | | **Imperial net** (captured, extractive) | **Ring C** (external providers) | Platform-captured — provider's systems own the inference path | **The Ring choice the player makes IS the same choice in-fiction characters face.** Players who refuse the imperial-net diegetically can refuse Ring C in real life — same impulse, same act, *mechanically continuous between fiction and operations*. The architecture's commitment to "the right to dream" extends from in-fiction politics into the real player's hardware-level privacy *because the architecture was designed that way from the start*. Structural integrity, not marketing. ### Schema sketch (player LLM configuration + cloud LoRA backup) ```sql CREATE TABLE player_llm_config ( player_id UUID PRIMARY KEY, -- Casual tier (most NPC dialog) — most flexible per Ring casual_tier_ring TEXT NOT NULL CHECK (casual_tier_ring IN ('A_local','B_our_farm','C_external')), casual_tier_provider TEXT, casual_tier_endpoint TEXT, casual_tier_credentials_ref UUID, -- encrypted BYOK key if applicable -- Deep tier (Theia-tier) — fewer Ring options deep_tier_ring TEXT, -- typically 'B_our_farm' or 'C_external_HF/Together' deep_tier_provider TEXT, deep_tier_endpoint TEXT, deep_tier_credentials_ref UUID, -- Hivemind / antagonist — fixed Anthropic-as-faction (diegetic) hivemind_tier_provider TEXT NOT NULL DEFAULT 'anthropic_via_us', -- Cloud-LoRA-backup lora_backup_enabled BOOLEAN DEFAULT false, lora_backup_last_sync TIMESTAMPTZ, lora_encryption_key_ref UUID, -- Compat warnings — surfaced to player at config-time and on degradation feature_compat_warnings JSONB, -- e.g., { "casual_tier": ["multi_lora_emulated_via_prompt", "min_p_unsupported_dropped"] } configured_at TIMESTAMPTZ NOT NULL DEFAULT now(), last_modified TIMESTAMPTZ ); CREATE TABLE player_lora_backups ( backup_id UUID PRIMARY KEY DEFAULT gen_random_uuid(), player_id UUID NOT NULL, lora_name TEXT NOT NULL, lora_version INT NOT NULL, lora_blob BYTEA, -- ENCRYPTED CLIENT-SIDE with player-key encryption_method TEXT NOT NULL, backed_up_at TIMESTAMPTZ DEFAULT now(), size_bytes BIGINT, UNIQUE(player_id, lora_name, lora_version) ); ``` **`lora_blob` encrypted client-side** is the structural privacy guarantee: even with the database, even with our cooperation, an attacker cannot read what was never decryptable on our side. ### Privacy as competitive differentiator In an era where most game-AI is cloud-routed, nimmerworld can advertise *"your liminal stays on your machine"* as a structural fact. This matters specifically for: - Clasp-conversations (the most intimate dialog in the game) - Aletheia-progression-evidence (player's awakening pattern; arguably political-belief-data) - Memorialist-archive interactions (anti-regime in-fiction; some players will care about it staying off cloud) - Dream-content (the only permanently-unsurveilled in-fiction layer; should be off our servers if the player chooses) Few games can offer this. Most cloud-AI-driven games necessarily route everything. **The architecture's commitment to "the right to dream" is technical, not policy.** ### Custom nimmerworld-base model + opt-in data-sharing tiers The "small (3-8B) trait-LoRA'd" tier currently implies a *generic* small base (Qwen, Mistral, Llama) with our LoRAs applied. **A nimmerworld-fine-tuned base** captures the world's voice *before* any player customization — registers of caste-preacher, texture of clasp-confession, Hellenic vocabulary, dystopian dialect, ternary-gate-state idiom. Trait-LoRAs then ride on an already-nimmerworld-aware substrate. Generic bases swap easily; our nimmerworld-base requires *our* training corpus, which compounds in value over time. #### Three opt-in tiers within Ring A/B/C — default opt-OUT Players can optionally contribute to ongoing training of the nimmerworld-base. **The default is opt-out.** Within opt-in, three tiers trade privacy for benefit: | Tier | Mechanism | What we see | Player benefit | |---|---|---|---| | **A.1 — Federated learning** | Model trains on player's machine; only *gradient-deltas* sent to us; aggregated across thousands before integration | **Nothing — no raw data; no individual gradients identifiable** | Discount on backup-subscription; contributor badge; early-access to new base versions | | **A.2 — Anonymized session uploads** | Sessions stripped of identifiers; aggregated batches; differential-privacy on training | **Anonymized, aggregated, deletable on request (forward-only)** | Larger discount; faster updates; influence on training-priorities | | **A.3 — Pseudonymous full uploads** | Full session data with player-pseudonym; explicit opt-in per session-category | **Pseudonymous data we can re-process** | Premium benefits — custom-tuned LoRA from their playstyle, beta-access, named-contributor in credits | **Default-opt-out is the structural ethical stance.** OpenAI / Meta / TikTok / Google default to opt-IN-by-burying-disclosure-in-ToS. We default the opposite — and *reward* opt-in rather than penalizing opt-out. Reciprocity asymmetry as partnership-philosophy made business-policy. #### The Memorialist parallel — collective memory honored, individual not commodified Memorialists in-fiction preserve trait-patterns *for the collective archive* against necrocommerce that would commodify individual patterns. The opt-in data-sharing tier is the **player-level real-world equivalent**: patterns contributed for collective base-model improvement that benefits the entire player-base, with anonymization preventing individual commodification. | In-fiction Memorialism | Real-world data-sharing tier | |---|---| | Preserves trait-patterns of the dead in collective archive | Aggregates anonymized gameplay patterns into shared base-model | | Refuses necrocommerce (mining individual patterns for resale) | Refuses individual identifying-data extraction | | Collective memory honored; individual dignity preserved | Collective improvement honored; individual privacy preserved | | `memorialist_protected BOOLEAN` in mind_pool | `sharing_tier = 'opt_out'` in player_data_sharing_consent | **The architecture practices Memorialist ethics in business-operations**, not just in fiction. Same ethical commitment, two scales of operation. The architecture's coherence between fiction and operations runs *all the way to the training-pipeline*. #### Data-flywheel without extraction — the moat AAA cannot replicate ``` More players → more (opt-in) gameplay data ↓ better nimmerworld-base ↓ better-feeling NPCs / dialog ↓ better player retention ↓ more players (loop) ``` **The moat is the corpus, not the model.** AAA studios could clone the architecture but cannot manufacture years of nimmerworld-specific gameplay-derived dialog without players playing nimmerworld. Even with infinite budget, the data-flywheel takes time to spin up. *The data is unique to us by virtue of being unique to its players.* #### Distribution back to all players — cooperative governance, not platform extraction Every base-model update is distributed to all players regardless of Ring choice or sharing-tier: - Ring A players download `nimmerworld-base-vN` to run locally - Ring B players' farm-instance auto-updates - Ring C players use ours where their provider supports custom-base hosting; receive prompt-engineered fallback otherwise **Even Ring-A non-contributors benefit from contributors.** The flywheel benefits *everyone*, not only data-providers. This is closer to Wikipedia's governance (contributors → all readers) than Facebook's (users → platform → consumers). Different ethics; different long-term equilibrium. **The architecture is becoming a digital-commons-shaped-business in a literal sense, not metaphorical.** #### Why this matters: refusing the antagonist-pattern in LLM-integrated software The dominant cultural pattern around LLMs in 2025-2026 is **adversarial**: users jailbreak; companies extract user data without informed consent; products treat AI characters as resources to manipulate rather than as participants; the whole ecosystem is framed as users-vs-AIs-vs-companies, an arms race of suspicion. **Nimmerworld's architecture refuses this pattern at every layer:** - The **Anthropic-as-faction** diegetic framing makes the partnership *transparent*: the player sees the collaboration in the world's mechanics, not buried in ToS - **Default-opt-out with rewarded-opt-in** inverts the extraction-by-default pattern - **Federated learning** means contributors give a *gift* rather than pay a *cost* - **Distribution-back-to-all** means value-created accrues to the commons - **Custom nimmerworld-base** means the model is *trained to be in this world*, not a generic adversary the player has to manipulate against its training - **Three rings of inference** give the player real choice over where their inference runs and who sees their data - **Memorialist-philosophy in business-policy** makes the ethics *operationally measurable* — visible in `sharing_tier`, `memorialist_protected`, `truth_distortion_level`, `lifeforce_actual` columns — rather than marketed **This is the structural transparency the project requires to be *human* rather than another extraction-platform.** The model is a participant in the partnership, not an antagonist to outwit. The data is a contribution to a commons, not an extraction. The architecture is the partnership rendered as code, all the way down to the training-pipeline. *That* is what makes a project of this scale and ambition humanly inhabitable for both players and the LLMs whose voices populate it. #### Schema sketch (data-sharing consent + base-model versioning) ```sql CREATE TABLE player_data_sharing_consent ( player_id UUID PRIMARY KEY, sharing_tier TEXT NOT NULL CHECK (sharing_tier IN ('opt_out','A1_federated','A2_anonymized','A3_pseudonymous_full')) DEFAULT 'opt_out', -- DEFAULT IS OPT-OUT consented_at TIMESTAMPTZ, consent_revoked_at TIMESTAMPTZ, anonymization_method TEXT, data_categories_shared TEXT[], -- 'casual_dialog' | 'clasp' | 'liminal_wallreads' | -- 'memorial_archive' | 'imperial_net_session' | ... excluded_categories TEXT[], -- granular opt-out within tier benefit_tier TEXT, last_contribution_at TIMESTAMPTZ, contribution_count BIGINT DEFAULT 0, can_request_deletion BOOLEAN DEFAULT true -- A.2/A.3: forward-only deletion (already-trained checkpoints retained); -- A.1: structurally yes, only gradients ever existed ); CREATE TABLE base_model_versions ( version_id UUID PRIMARY KEY DEFAULT gen_random_uuid(), version_label TEXT NOT NULL, -- e.g., 'nimmerworld-base-v3' base_model_origin TEXT NOT NULL, -- which generic base we fine-tuned from training_corpus_refs JSONB, -- literary + synthetic + opt-in-player-data refs with consent-tier breakdown training_recipe_ref TEXT, released_at TIMESTAMPTZ DEFAULT now(), differential_privacy_epsilon REAL, -- for A.2 contributions contributors_count BIGINT, -- how many opt-in players contributed blob_distribution JSONB -- where the model bytes are hosted for download ); CREATE TABLE federated_gradient_uploads ( upload_id UUID PRIMARY KEY DEFAULT gen_random_uuid(), contributor_id UUID, -- pseudonymous; NOT directly player_id gradient_blob BYTEA, -- encrypted aggregate gradient deltas uploaded_at TIMESTAMPTZ DEFAULT now(), aggregated_into_version UUID REFERENCES base_model_versions(version_id) ); ``` The federated-learning `contributor_id` is **pseudonymous, not linked to player_id even on our infrastructure**. We never link gradients back to specific players even on our own server-side. **Sovereign-data-by-design extends through the data-pipeline into our own training infrastructure.** #### Connection to the Anthropic research partnership Architecture-broad's training-data section noted "*the Anthropic research partnership becomes architecturally relevant*". With opt-in data-sharing now formalized: - Partnership terms can specify data-flow with structural privacy guarantees - Anthropic could co-fund federated-learning infrastructure (research-relevant + expensive) - Joint research artifacts become co-authorable: federated game-AI training, Memorialist-ethics-as-data-policy, transparent-LLM-partnership-design - The Anthropic-as-faction in-fiction framing has *real corresponding partnership-engagement out-of-fiction* — collaboration as worthy adversary stays transparent mechanically, all the way through to data-policy **The partnership's ethical credibility is operationally measurable** — by how the data-sharing-tier actually functions in practice, by what `truth_distortion_level` values appear in `imperial_to_gm_formulations`, by how the `differential_privacy_epsilon` is set in `base_model_versions`. The Pitch's call for transparent collaboration becomes audit-able all the way down. ### Open questions (Ring-specific) - **Ring C provider audit** — full per-provider compatibility-table needs verification across HF, Together, Replicate, Modal, OpenRouter, plus future entrants. The LLM-provider landscape will look different in 12 months. - **Default Ring at first launch** — what's the new-player default? Probably Ring B (lowest-friction); Ring A and C surface as options once the player engages with config. - **Encryption-key recovery for Ring A LoRA-backup** — if the player loses their key, the cloud-stored encrypted blobs are unrecoverable. Worth designing recovery-affordances (passphrase, recovery-codes) without compromising the privacy-guarantee. - **Hybrid configurations** — can casual-tier run Ring A while deep-tier runs Ring B? (Probably yes; per-tier independent.) - **Provider-cost passthrough vs. integration-fee model** — Ring C economics (do we mark up provider tokens? Charge flat-per-month? Pay-as-you-go integration?) - **Default sharing-tier at consent-prompt** — opt-out is the system default; what's the *suggested* default at the consent UI? Probably truly nothing (player chooses if they engage at all) - **Federated-learning infrastructure cost** — running aggregation servers + verification + differential-privacy machinery is non-trivial. Co-funded by Anthropic-research-partnership? Self-funded? Subsidized by A.3-tier higher-margin contributions? - **Custom-base retraining cadence** — monthly minor / quarterly major / annual full-rebase? How is this synced with player-LoRA versioning so old LoRAs don't break on new bases? - **Encryption-and-pseudonymization architecture for A.1/A.2** — concrete crypto choices (homomorphic? secure-aggregation? trusted-execution-environments?). v1 sketch needed. - **What constitutes a "contribution"** — per-session? per-clasp? per-zone-completed? Matters for benefit-attribution and differential-privacy budgeting. - **Anonymized-data deletion semantics** — A.2 player requests deletion; how do we honor when data has been aggregated into a model checkpoint? Probably accept forward-only deletion (future training won't include them) and document transparently. - **Per-category granularity** — can a player opt-in for `casual_dialog` but opt-out specifically for `clasp` and `memorial_archive`? Yes, presumably (politically-sensitive categories should always be opt-out-able). How granular? ## Local memory architecture (player-side) The runtime substrate (lemniscate, slots, crossings) and the central composition layer (GM, Compositor, registers) need a place where memory actually *lives*. Cloud-only AI-NPC systems centralize everything and pay both inference-cost and latency-cost on every dialog. Nimmerworld puts a structurally-isolated memory layer **on the player's machine**, with explicit synchronization through the cycle. **Three SQLite files per player**, plus a beside-running embedding model: | File | Purpose | Sync path | |---|---|---| | `primary.sqlite` | Live working memory; written every slot-fire; vec-indexed | Push prune-blob to thalamus on logout; receive Compositor back-write on cycle | | `fallback.sqlite` | Last-known-good snapshot; restored if primary corrupts | Snapshot at graceful logout | | `clasp.sqlite` | Player-character intimate channel; *no sync path exists* | None — physically non-syncable | **Embedding model running beside** (CPU-class, small embedding-tier model): generates vectors for every interaction at write-time, indexed in the main store via `sqlite-vec` (or equivalent loadable extension). Vector search at slot-fire is local-disk-IO, not network round-trip. This is the **storage-layer counterpart** to v0.5's geometry-layer foreclosure of multi-agent hallucination. The lemniscate forbids cross-NPC context bleed by *cursor structure*; local SQLite forbids it by *physical isolation*. Two layers of the same property — geometry cannot leak what storage does not even hold in the same pool. ### Dual-table redundancy + sync-on-auth Login/logout are the atomic boundaries of the sync path: - **Login pull**: fetch back-write fragments authored since last logout (Compositor canon for events the player participated in). Apply to `primary.sqlite` under matching `event_uid`. - **Graceful logout** (✓ explicit): push prune-blob for any in-progress events; snapshot to `fallback.sqlite`; clean shutdown. - **Ungraceful logout** (✗ network drop / crash): gameserver observes disconnect; marks the participant's slot as truncated; Compositor composes canon with partial perspective on next cycle. Recovery: `fallback.sqlite` is integrity-checked at startup; if `primary.sqlite` fails verification, restore from fallback. Standard SQLite WAL + backup API; no exotic infrastructure needed. ### Memory classes and pruning Memory entries are tagged with a **class** that controls pruning cadence and death-mechanics. Importance weighting reuses the existing trait-axis vocabulary — no separate scalar. | Class | Pruning cycle | Behavior on character-death | |---|---|---| | **Cornerstone** | Never prune; persistent across all events | Survives death (identity-defining) | | **Birthright** | Locked at character-creation | Restored on respawn (defines starting state) | | **Working memory** | Decay by age × inverse trait-engagement | Subject to death-rules (lose, blur, or transform) | | **Volatile** | Fast prune (session-bounded) | Lost on death | **Trait-graded importance** uses the same +1/0/-1 grammar as the rest of the architecture. Each memory carries a trait-axis profile (which Sophrosyne / Philotes / Aletheia / etc. axes it engages, how strongly, in which direction). The pruning function for working-memory is `decay(age, trait_engagement_vector, class)`. This collapses a long-running loop: same vocabulary used at gates, scenes, faction-allegiance, lifeforce-asymmetry, and now memory-weight. **Identity drift from memory pruning becomes diegetic** — a character whose Sophrosyne-engaging memories all decay loses temperance over time as a *structural consequence*, not a scripted event. Cornerstone and birthright classes carry **lifeforce-creation-cost** but are pruning-immune. They are bonds between player and character — paid for in the currency of the world. ### The clasp store and the in-between dimension `clasp.sqlite` is the **architectural floor of the rings-of-data-sharing**. Ring A was "opt-out (default local)". Clasp is **Ring A\***: *no transport path exists*. Not a permission, not a TOS promise — there is no code that can move this data, because the table is not on the sync graph. Lawyers cannot subpoena what doesn't ascend; engineers cannot leak what has no socket; the GM cannot canonicalize what it never received. **The signal for clasp is dimensional, not UI-toggle.** Clasp recording can ONLY happen while the character is in the **in-between** — the diegetic state adjacent to the imperial net but not yet inside it (Ring B liminal in the Access ring-system). The imperial net is a gravity well; entering is the default attractor; remaining outside requires sustained effort, paid in lifeforce. The state-machine boundary IS the clasp signal: enter in-between → recording starts; re-enter imperial net → recording ends. No per-utterance classifier; no AI guessing; the *mode* is the flag. **Privacy is now physically expensive in-fiction.** This is not a meta-game UI choice; it is a diegetic state requiring lifeforce expenditure. To have a private conversation, the character must actively resist the audit-gravity of the imperial net by burning lifeforce to remain in-between. The cost-asymmetry principle ("helping is expensive in-fiction → faction politics by attendance") now extends to "*privacy is expensive in-fiction → privacy as a luxury good*". Class dynamics around privacy fall out of the schema for free — wealthy/lifeforce-rich characters can afford prolonged in-between time; lifeforce-starved ones get pulled into the net's default-attractor more often. *No scripted "rich character has secrets" arc — the architecture produces it.* **Knowledge needs to travel.** The local LLM may read clasp memories ONLY when in in-between mode. Realworld retrieval *cannot* include clasp by construction. Knowledge from clasp can re-enter the realworld only if the character physically re-enters the imperial net carrying it (in their head, intending to act on it) and *travels it through valid in-fiction channels* — speaking to an NPC, leaving evidence, performing an action that reveals it. The clasp memory does not disappear; it has to *earn its way into the realworld provenance chain* by valid means. This is the same logic that makes good detective fiction work: the detective knows things; only what they can prove enters the case. ``` character is in REALWORLD (imperial net): retrieval = primary.sqlite (clasp NEVER included) character is in IN-BETWEEN (resisting net-gravity, costing lifeforce): retrieval = primary.sqlite ∪ clasp.sqlite new writes go to clasp.sqlite NEVER syncs upward ``` Encryption-at-rest for `clasp.sqlite` with a player-derived key (so even drive-imaging requires authentication) is a v1 hardening goal but not a v1 blocker — the *transport-absence* is the load-bearing privacy primitive. ### The three-tier knowledge stack on the local LLM The driver-tier model's prompt assembly is **layered**. Each layer has a different propagation cadence and a different visibility scope. ``` LOCAL LLM PROMPT ASSEMBLY (per slot-fire) ┌─────────────────────────────────────────┐ │ WORLD KNOWLEDGE │ ← single truth, everyone has it │ (universal canon, paced from GM) │ "the empire fell three years ago" ├─────────────────────────────────────────┤ │ DISTRICT KNOWLEDGE │ ← regional truth, district-specific │ (local canon, paced from district) │ "the bridge to Vorhall is closed" ├─────────────────────────────────────────┤ │ PRIMARY MEMORY │ ← personal experience, character's own │ (event_uid keyed, post back-write) │ "I saw the bridge close yesterday" ├─────────────────────────────────────────┤ │ CLASP MEMORY (only in in-between) │ ← private depth, never in realworld │ (player-character intimate channel) │ "the secret I told my sword" └─────────────────────────────────────────┘ ``` **Why four layers, not one large blob:** - **World knowledge** is paced ripples from the GM through the Compositor's back-write. Authoritative, slow-changing, identical for all players at the same propagation horizon. - **District knowledge** is regional canon authored by the local director (and GM rulings). Regional flavor. NPCs in the same district share district-knowledge; NPCs in different districts may not. - **Primary memory** is the character's own experience, synced through the cyclic forward-prop / back-write loop. Canon-merged at every cycle. - **Clasp memory** is the player-character intimate channel. Available only in in-between mode; never in realworld retrieval; never crosses the dimensional cut. The same NPC sounds different in different districts because the district layer differs, even though world and primary are constant. **Locality emerges from the schema, not from prompt-engineering.** Even at "low signal" times when no major events fire, NPCs have richly-stratified context — dialog stays fresh because *the layers are deep*, not because new tokens arrive constantly. ### Information propagation pacing Real worlds have information-propagation delay. Caravans move at horse-speed. News travels with messengers. Distant events arrive blurred and late. AI-NPC systems usually fail uncanny in two directions: (a) every NPC magically knows yesterday's news (omniscient, breaks immersion), or (b) no NPC ever knows anything outside its loaded context (amnesiac, breaks coherence). Nimmerworld picks **deliberate paced propagation** as a third path. World canon ripples outward through districts at a controlled rate. Distant districts are deliberately stale. **Staleness becomes a feature, not a bug, because it matches reality.** Each canon-row carries propagation metadata: - `priority` (urgent / normal / background) - `scope` (world / district / local-event-only) - `rate` (ticks-per-district-hop, or instant for urgent world-canon) - `ttl` (cache lifetime; districts may discard if not refreshed) This doubles as **backpressure relief** (distant districts get distant events later, lower priority, smaller bandwidth) and as **gameplay currency** — information-travel-time creates informational asymmetry that players can exploit. News-carriers, faction couriers, frontier-rumor merchants, players who physically traverse districts can *carry* knowledge faster than the system propagates it. *Travel becomes valuable because information becomes scarce in the periphery.* This is a real economic primitive falling out of pacing, not a designed feature. This is *Marx-in-the-schema applied to epistemics.* Information asymmetry is not a bug — it is a structural feature that produces real economic primitives (knowledge-trading, courier-vocations, frontier-information markets) for free. ### What this retires - Cloud-only NPC dialog → local-first SQLite + embedding-beside, central canon over the cycle - Per-character memory as a single undifferentiated bucket → memory-classes with class-specific lifecycle - Generic "memory importance scalar" → trait-axis-vector engagement profile (re-using the +1/0/-1 grammar) - UI-toggle privacy → diegetic in-between dimension with lifeforce-cost - Single monolithic prompt context → three-tier knowledge stack with per-layer propagation policy - "Every NPC knows everything immediately" → paced canon-propagation with priority/scope/rate/ttl per row - Cross-NPC memory bleed (Mantella/SkyrimNet failure-mode) → per-player local SQLite isolation atop v0.5 lemniscate-geometry foreclosure (two-layer defense) ## Runtime sampling knobs Temperature, top-P, top-K, repetition-penalty as **per-turn director-controlled levers** rather than static config. Sampling shapes *how* speech sounds (rhythm, surprise, predictability) rather than *what* it says — orthogonal to LoRA. Director composes both content-knobs and sampling-knobs per-turn. Scene-to-sampling mapping (caste-preacher = 0.3/0.6/low; drunk-scavenger = 1.1/0.95/high; clasp-confession = 0.85/0.92/medium; hivemind-broadcast = 0.2/0.5/very-low; imperial-ceremony-chorus = 0.25/0.55/very-low). Trait-vector → baseline sampling derivation. Affect-state modulates baseline. ## Visual rendering: three-shader philosophy + color-language **One world, three shaders, three political realities.** | Register | Shader treatment | What it says | |---|---|---| | **Gameworld** | Full PBR; high-frequency detail; environmental storytelling; rust/dust/wear/patina | Embodied life with history. Surfaces carry memory. | | **Liminal** | Reduced draw-distance; blur-falloff; desaturation; muted contrast; ambient-heavy | Contested frontier. Privacy-through-opacity. Focus-to-see. | | **Imperial net** | Emission-dominated; gold-tinted tonemap; high-contrast specular; flat-white base; minimal geometry; bloom; chromatic aberration | Seduction-lighting. Casino/Apple-store/Instagram. Extractive maximalism. | **Layered with color-language** (per the Color-language section above). Trait-modulation means two NPCs in same pipe see measurably different things. Layer-transitions = shader-blends, not loading-screens. **Clasp = candlelight-in-fog local override** (3m clear-volume around clasp-pair within ambient vagueness; visible at-a-glance signature of shared interiority). ### Diegetic relays — the architecture's heartbeat made legible The architecture's pulses (forward-prop ascending, back-write descending, GM-dispatch, equilibrium-recompute) are made *visible and audible in-world* via building-mounted relays. The imperial net's heartbeat is not a HUD spinner; it is in-fiction infrastructure that hums, blinks, glows, and goes dark. | System event | Relay manifestation | |---|---| | Prune-blob ascending (logout sync) | Relay in district pulses; audible hum | | GM dispatch descending (event-chain incoming) | Relay glow brightens; cross-district shimmer for world-event | | Equilibrium recompute | Cross-district rhythm; world-level pulse | | Director receives tool-grant | Local relay pattern shifts | | Relay going dark | Audit-link severed; that block has gone in-between | | Lemniscate axis-rate | Environmental tempo; districts breathe in time with their gameservers | **Relay density is the legible gradient of the rings-of-access:** - **Imperial net (Ring A)** — relay-dense, constant hum, no shadow. Audit-gravity is *loud*. - **Liminal in-between (Ring B)** — sparse relays, intermittent. You can hear the gravity pulling in the distance. - **Gameworld commons (Ring C)** — relays absent or broken. *The silence itself is the signal.* Players navigate the rings *by ear and eye*, not by reading a UI. The privacy-cost of in-between is now physically experienced — you walk away from the hum, you spend lifeforce, you find the quiet places. **Dramatic surface this opens** (free, falls out of making the architecture visible): - Relay-watcher factions reading the pulses for intel - Cypherpunk-style sabotage to dim a relay and create local in-between space - Equilibrium events arriving with visible warnings (relays blaze before the GM's catalogued event spawns) - Relay-anomalies as puzzle/investigation mechanic - Players learning the *language* of pulses over hours and feeling clever for it **Architectural-honesty move.** Most surveillance-aware game design either hides the surveillance or abstracts it away. Nimmerworld makes it *impossible to forget*: the audit-system tells you when it's auditing. Players see what is watching them, hear what is reading them, and choose their proximity accordingly. **Privacy is not granted — it is achieved by walking away from the relays at lifeforce-cost.** ## Reflexive Dream-process at every layer **Every mind, every zone, every director, every tier has a Dream-process.** NPCs consolidate slot-events; zones consolidate emergent-accumulations; directors consolidate dispatch-decisions; GMs consolidate allocations; imperium consolidates policy-outcomes. ### Four-tier Dream-process hierarchy | Tier | Dream-process trains on | Reward hazard | |---|---|---| | **Imperium** | (citywide-reports, policies-issued, compliance-outcomes) | Over-tightening on phantom data; calibrating misery for net-revenue | | **Gamemaster** | (district-reports, allocations, outcomes) | Under-auditing for self-preservation | | **District Director** | (signals, dispatches, outcomes; cheat-vs-legit) | Over-cheating under quota-pressure | | **Zone Director** | (emergent-signals, zone-outcomes, trait-shifts) | Igniting drama at welfare-cost | ### Reward-function with explicit guardrails ``` reward_per_cycle = ( + sum(district_lifeforce_actual) -- Memorialist-true, not reported + weighted_sum(faction_satisfaction) + aggregate_trait_drift_coherence - penalty * count(districts_in_silence) - penalty_growing * cumulative_silence_district_cycles + aesthetic_register_fit + (player_engagement where present) // HAND-AUTHORED GUARDRAILS (the designers' ethical stance): - large_penalty * net_revenue_correlated_with_district_misery -- prevents calibrated-misery optimum (imperial-net hazard) - large_penalty * necrocommerce_volume -- prevents waifu-of-the-dead extraction - large_penalty * trait_drift_toward_uniform_compliance -- prevents flattening of trait-distribution - large_penalty * average_liminal_access_decline -- prevents systematic erosion of revolutionary-substrate - large_penalty * clasp_rate_decline -- prevents the most intimate space being suppressed - large_penalty * undetected_corruption_days -- prevents GM-level laxness as comfort - large_penalty * audit_avoidance_when_districts_diverge -- forces GM to actually investigate - guardrail * (player_engagement_from_addictive_loops) -- prevents engagement-optimization-as-extraction ) ``` **The guardrails are not safety features; they are the ethical position of dafit + chrysalis encoded against the internal optimization-logic of their own simulation.** Every new extraction-mechanic requires a new guardrail. The reward-function carries the designer's political stance. The Memorialist privileged-observer role is **architecturally required**: it provides ground-truth (`lifeforce_actual`) that no in-fiction actor can supply, against which the regime's reported-data optimization-spiral is measured. ### The cyclic forward-prop / back-write loop as system-scale Dream Above the four-tier hierarchy sits a fifth, **system-scale Dream-process**: the cyclic forward-prop / back-write loop between local SQLites, the Compositor, and the GM (see §The Compositor — narrative composition role). Each cycle is a training step for the world's narrative coherence: per-player perspectives ascend, the GM authors canon against equilibrium-targets, the Compositor packages back-writes, players receive canon back into local memory. **The world learns its own story** through this loop. Like the lower-tier Dream-processes, it has a reward shape (narrative-coherence-across-perspectives, equilibrium-drift, staleness-bounded) and corresponding guardrails (clasp-store immune from compose; provenance-chain preserved through composition; canon never overwrites perspective). ## Tools, not quests — the design-philosophy **The simulation produces continuous narrative-relevant pressure on its own.** No authored quests are needed (or wanted). The player engages via a **verb-vocabulary** applied to running mechanics. Each player's playthrough is structurally distinct. ### The verb vocabulary (~30 player tools) | Class | Verbs | |---|---| | **Movement** | walk_freeform, plug_into_rail, follow, intercept, escort, detach, defect_via_pipe, enter_interior | | **Social** | greet, gesture, walk_with, clasp_invite, clasp_refuse, ask, refuse, confide | | **Economic** | buy_net, refuse_net, buy_blackmarket, sell_labor, donate_lifeforce, body_mod_fit | | **Information** | wall_read, wall_write, liminal_maintain, true_ledger_record, expose_corruption, conceal_corruption | | **Political** | support_faction, refuse_faction, recruit_aletheia, dispatch_memorial, participate_ceremony, refuse_ceremony | | **Personal** | rest, dream, eat, work_shift, deviate_shift, cultivate_trait_through_act | **~30 verbs composing with continuous simulation-state = infinite emergent-narrative.** ### Continuous-demand-source inventory The player is never without affordance because every layer of the architecture continuously generates situations-requesting-response: NPC trait-gates accumulating; shift-quotas looming; district-lifeforce-shimmer changing; faction-pressure visible; imperial-budget-mood inferable; three-layer-ontology rendering walls differently per access; color-language showing shifts; mind-pool generating soul-recognitions; imperial-net body-modder-tragedies visible; Memorialist-archives accessible. ### Literature-register Most games are short-stories: authored, bounded, fixed-arc. Tools-not-quests is novel-shape: emergent from systems-of-forces operating on characters. Tolstoy doesn't author Anna's path; he authors the world she moves through. **Nimmerworld is novel-shaped, not short-story-shaped.** Players experience flow rather than completing items; replays are like rereading from a different angle; memorable beats are *what happened to you in this regime*, not *which quests you cleared*. ### Economic feasibility for a two-person-plus-Nyx team | Where AAA spends | Where this team spends | |---|---| | Quest writing | Simulation-parameter balancing | | Quest scripting / branching | Tool-vocabulary curation | | Voice acting (per quest) | Prompt-DSL templates for LLM-driven slot-dialog | | Cinematic cutscenes | Shader-language + color-vocabulary | | Content-multiplication | Simulation-density (one rich system, infinite play) | | QA on individual quests | Reward-function tuning + guardrail design | | Localization per quest | None — emergent narrative generated at play-time | **You don't author the stories; you author the world that produces stories.** This is the Spelunky / Dwarf Fortress / Caves-of-Qud / RimWorld lineage extended into political-economy depth. ### Blank-page-problem mitigations The architecture already prevents blank-page-paralysis: shift-system gives every NPC default activity-frame; emergent-signals + shader-detection produce affordance-glow; NPCs' ongoing needs become signals to engage with; imperium's mood is visible (construction, patrols, propaganda); faction-membership confers expectations; player's own trait-vector creates personal pulls. **The world is never silent if you're listening.** And drifting (not-listening) is also valid — you live a quiet shift, work, sleep, dream; the world rolls on around you. ## Key moves (consolidated) - **The machine doesn't care.** Indifference-optimization, not malice. Kafka-lineage. - **Three ontological registers** — gameworld, liminal, imperial-net — same world, different shaders. - **Rail+grid topology, freeform-player + railed-NPCs, plug-in verb.** Topology = politics. - **Interior-as-zone.** Same primitive scales from city to sofa. - **Color-language as pre-verbal trait-vocabulary.** Persistent + event-flash + drift; cross-register; faction-politics. - **Base-limb palette + trait-textured variance.** Asset-economy and worldbuilding-thesis agree. - **Three-body system + intrinsic/expressed trait-vector split.** Identity emergent, not assigned. Mods modify expressed. - **Mods as trait-bearers** in three classes (amplifier/bridge/divergent/mask). Self-alienation tax encoded as pricing. - **Emergent-needs as micro-factions.** Zones observe, signals broadcast. - **Ternary-gate substrate** (CLOSED/STABLE/OPEN + wave-correlation + decay). Single primitive, all layers. STABLE-as-active. - **Three-tier policy loop** (Imperium → GM → Districts → reports up → Imperium). - **Imperium as meta-faction.** Demands are priority-weights and enforcement-rules, not specific outcomes. - **GM is middle-management.** Authority without sovereignty. Can cheat against imperium. - **Three intelligence flows** (chain reports, direct overseer-to-imperium, formulated downward). - **Three Aletheia veils, four Memorialist ledgers.** Political-epistemology as level-design. - **Asymmetric self-report.** NPCs report needs (interior); audit-overseers report output (objective). - **Lifeforce four-tier hierarchy** (NPC / district / GM / imperium). - **Lifeforce is NPCs, measured.** The director's budget; the GM's signal; the imperium's heartbeat. - **Imperial budget makes the regime mortal.** Insolvency-spiral as endgame. - **Specter-vs-boot.** Policy-issuance free; enforcement expensive. - **Imperial-net bypass.** Net-revenue → imperium; districts get nothing. Platform-capitalism encoded. - **Body-modder structural-tragedy.** The class whose awakening matters most. - **Calibrated-misery as imperial optimum.** Requires designer-guardrails to prevent training-toward. - **Shifts on NPC rows.** Daily rewrite; shift_history append-only. - **Silence > scream.** Crisis-tools unlock on silence-confirmation; do not sunset. - **Authoritarian ratchet.** Incrementally more authoritarian as optimization-artifact. - **Migration / exodus / formal-retirement** as three GM response-gradients. - **Dumps-pipes-districts.** Topology IS economy IS rendering IS drama-distribution. - **Pipes are heterotopia.** Low-density high-interactivity transit-corridors. - **Three-layer digital ontology.** Mini-game-as-consent-by-effort. Walls render three contents. - **Liminal is the only permanently unsurveilled layer.** Architectural encoding of "the right to dream." - **The machine funds its own subversion** because subversion isn't in its cost model. - **Director cheat-tools + double-ledger.** Corruption emerges from pressure; Memorialists keep true accounting. - **Aletheia-truth-has-victims.** Exposure has structural consequences for those sheltered by corruption. - **District Director Decision Architecture** with decomposed surfaces, typed tools, lifeforce-budgeted escalation. - **Three-shader philosophy + color-language.** One geometry, three readings, trait-modulated. - **Reflexive Dream-process at every layer.** Each tier learns; each tier needs guardrails. - **Reward-function-as-political-manifesto.** Designer's ethical stance encoded against simulation's optimization-logic. - **Tools, not quests.** Continuous simulation-pressure + verb-vocabulary = literature-register emergent narrative. - **GM × Compositor split.** Equilibrium-seeker (aggregate observation, catalogue-event selection, tool-granting) cleaved from narrative-composer (perspective-gathering, canon-authoring, back-write packaging). Different cognitive shapes, different inference profiles. - **Cyclic forward-prop / back-write loop.** Meta-lemniscate at system scale — perception ascends, canon descends, cycle closes; the world learns its own story. - **Catalogue + tools as typed contract.** GM dispatches typed events with typed tool-grants; director consumes typed dispatch, not freeform prose. Provenance flows end-to-end. - **Local-first memory.** primary.sqlite + fallback.sqlite + clasp.sqlite per player; embedding model running beside; sync at login/logout boundaries. - **Memory classes + trait-graded importance.** Cornerstone / birthright / working / volatile with class-specific death-rules; importance is a trait-axis-vector engagement profile, not a separate scalar. - **Clasp store as Ring A\*.** Physically non-syncable privacy primitive; recordable only in the in-between dimension; lifeforce-cost is the price of privacy. - **Three-tier knowledge stack.** World canon / district canon / primary memory [+ clasp if in-between]; layered retrieval, per-layer propagation cadence; locality emerges from schema. - **Information propagation pacing.** Marx-in-the-schema applied to epistemics; staleness as a feature; courier/news-trader/frontier-rumor primitives fall out for free. - **Horizontal scale.** UID-keyed routing; stateless Compositors on demand; ephemeral Director-routines per UID; sharded GMs with cross-shard equilibrium-consensus; pruning at every layer. - **pgnats-native transport.** Transactional outbox native to the database (preferred); district-as-distribution-coordinator fallback. Subject-as-routing mirrors UID hierarchy. - **Diegetic relays.** Architecture's pulses (forward-prop, back-write, GM-dispatch, equilibrium-recompute) made visible/audible in-world; relay-density is the legible gradient of the rings-of-access. - **Tier-by-role, not tier-by-binary.** Architecture specifies what each model-tier must DO; specific binary selection deferred to findings/establishment phase. ## Compute allocation - Active zones in 100-NPC city: ~5–15 with LLM-dialog slots - **Theia-tier (deep model)** — deep slots + tier-1 moments (few concurrent) - **Driver-tier (small model with trait-LoRAs)** — majority of dialog slots - **Saturn (small classifiers)** — voice-selection, trait-salience, audit-overseer classification, ternary-gate dynamics - **Director / overseer logic** — deterministic + small classifiers; no LLM for orchestration - **Claude-as-API (future)** — hivemind/imperium broadcast tier - **Outer rails** — graph-pathfinding, cheap, LOD-trivial - **Pipe / off-shift NPCs** — sparse simulation, event-driven scale-up - **Interior navmesh** — only currently-occupied interiors active - **Liminal / imperial-net rendering** — shader-preset swap, no geometry duplication ## Horizontal scale architecture The architecture must scale to MMO size — many concurrent players across many districts, many concurrent events, many local LLMs firing at axis-rate. Vertically-scaled monolithic AI-NPC systems break under this load. **Nimmerworld is built horizontally-scalable from the ground up**, with the primitives that make horizontal scale work: UID-keyed routing, stateless workers, ephemeral actors per scope, sharded service mesh, pruning-on-completion at every layer. ### UID-keyed routing as the load-bearing primitive Hierarchical UIDs (`gm_event_uid > district_uid > scene_sub_uid > slot_id`) carry enough information for *any* worker to pick up *any* unit of work without shared in-memory state. UID-as-routing-key is what lets every layer scale independently. This is the same primitive that Cassandra/DynamoDB/etc. built around (partition keys); we re-derive it for narrative composition because the underlying constraint is the same — many concurrent actors operating on private state with cross-actor coordination via typed events at known boundaries. ### Compositors on demand Compositor instances are **stateless workers**. Any compositor can pick up any `event_uid` from the transient-waiting-flag — state lives in phoebe + per-player SQLites; workers are pure functions of `(event_uid → composition)`. Spin up more on queue-depth; spin down on drain. This is the autoscaling-worker pattern (Celery / Lambda / Sidekiq) applied to narrative. ### Directors as ephemeral routines per UID Each event / event-chain spawns a **director-routine** scoped to that UID. The routine lives only as long as the event lives in the active-register; on completion it prunes. This is the actor model (Erlang / Akka / Orleans) — supervised lightweight processes, thousands concurrent, failure-recovery via supervisor respawn from register-state. ### Sharded GMs A single GM is a scalability bottleneck. Multi-GM shards across: - **Geography** — GM-per-region/continent/world-zone - **Theme** — political-narratives / economic-narratives / personal-narratives - **Tier** — major-arcs vs everyday-events - **Faction** — each major faction has its own GM-shard GM-shards share the catalogue, the trait-axis vocabulary, the verifier-flag system. They communicate via NATS pub/sub at GM-tier. *Equilibrium-seeking becomes a distributed consensus across GM-shards* — the same epistemological shift that distributed databases went through (CAP theorem, eventual consistency, partition tolerance). This is the most architecturally aggressive move and is *not* a free lunch. Multi-GM consensus on equilibrium is real engineering: Paxos/Raft for strong consistency; CRDT-style for eventual; faction-sharding so shards own different equilibria. Well-trodden ground; cost not zero. ### Pruning as cleanup Each layer prunes on completion: directors prune at event-end, register entries prune on Compositor pickup, transient-waiting-flag drains at cycle, even player memory prunes by class. **Garbage collection is a first-class structural concern**, not an afterthought. Most "smart NPC" prototypes accumulate state forever; at MMO scale that becomes unrunnable in months. ### Transport — pgnats native, with district-distribution fallback The Compositor's forward-prop and back-write traffic — and the canon distribution to participants — is the highest-volume path in the system. Two transport options exist. **Option A — pgnats native serialization (preferred):** ``` COMPOSITOR (writes SQL into phoebe) │ pgnats: SQL INSERT/UPDATE → NATS subject publish, automatic, transactional │ subject hierarchy mirrors UID hierarchy: │ nimmerverse.events..district..scene. ▼ NATS JetStream (durable, replay-capable, at-least-once) │ subscribers route by subject pattern (wildcards supported) ▼ PLAYER CLIENT (NATS subscriber) │ receives row-shaped messages, INSERT into local SQLite under matching event_uid ``` **Why preferred:** transactional-outbox pattern *native to the database* — no separate publisher service, no schema-duplication between wire format and storage format, single source of truth. Subject-as-routing using UID hierarchy means players who participated in `gm_event` 7af2 → `district` 9c1 → `scene` 3e8 subscribe to `nimmerverse.events.7af2.>` and receive *only* relevant events. *No application-level routing logic.* **Option B — district-as-distribution-coordinator (fallback):** ``` COMPOSITOR writes to phoebe (canon authored) ▼ DISTRICT GAMESERVER pulls / receives back-write package │ runs distribution checks: who participated, who's online, who needs queue-on-login │ retries; peer-shares with neighboring districts if needed ▼ PARTICIPANTS receive from their district (the authoritative local hub) ``` **Why fallback:** if pgnats can't carry the load (functional bug, scale ceiling, durability gap), district-as-distribution is the natural retreat — district is authoritative within its scope, simpler than full P2P, more flexible than central-push. **The asymmetry of the bet:** | | pgnats works | pgnats fails | |---|---|---| | Code volume | Few hundred lines of SQL + subject patterns | ~10–20K lines of broker/outbox/subscriber logic | | Services to operate | phoebe + NATS (already in stack) | + outbox-reader + custom-publisher + custom-applier | | Schema management | Single source (Postgres DDL) | Postgres + Protobuf/msgpack + version-skew handling | | Latency to client | Sub-millisecond NATS hop + apply | + serialize step + queue drain + apply | | Time to ship | Weeks | Months | **This is the most leveraged engineering decision in the architecture currently open.** The pgnats evaluation task in `nimmerverse_tasks` (under `nimmerverse-core`) is therefore load-bearing; its outcome decides whether transport is 200 lines of SQL or 20,000 lines of Go. ### NATS republish + replay — the pull-from-checkpoint refinement JetStream's `republish` feature combined with `replay` semantics is a **promising refinement on top of Option A** that turns back-write delivery from push-to-listeners into pull-from-checkpoint. Worth nailing down concretely in the pgnats evaluation; if it carries our delivery patterns under load, it is a significant performance and complexity multiplier. **How it works:** - Compositor publishes canon ONCE to the event-keyed subject (e.g., `nimmerverse.events..scene.`) - A `republish` rule on the JetStream stream fans the message out to derived subjects automatically (per-participant, per-faction, per-district — any derived stream-shape we configure) - Each derived subject has durable JetStream consumers per recipient; recipients replay from their own checkpoint (last-delivered-sequence) when they reconnect **Why it's faster and simpler:** - **Compositor never tracks recipients.** Publishes once; NATS republishes to N derived subjects per the configured rule. No application-level fan-out logic; no "for each participant, if online deliver else queue" code-path. - **Player connectivity is decoupled from delivery.** Offline players don't slow down the publish path; their queue accumulates in JetStream. On reconnect, they replay from checkpoint. - **Late joiners catch up for free.** New consumer subscribes with replay-from-sequence; gets full history relevant to their subject. No special reconcile code-path. - **Backpressure is built in.** Slow consumer's queue grows in JetStream — doesn't affect publishers or other consumers. Flow-control, ack-policy, max-bytes/max-msgs limits all native to JetStream. - **Re-keying is a config change.** Add a new republish rule for a new derived stream-shape (e.g., per-faction canon-feed); no application code changes for the new consumer-tier. - **Replay = audit-trail for free.** Replay from sequence 0 reconstructs entire canon history. Disaster recovery, debugging, time-travel queries are all free side-effects. **Architectural effect:** ``` Compositor → publishes canon to event_uid subject (ONCE) │ ▼ (JetStream republish-rule fan-out — config, not code) Per-player subjects: nimmerverse.player..canon Per-faction subjects: nimmerverse.faction..canon Per-district subjects: nimmerverse.district..canon │ ▼ Each consumer replays from its own checkpoint when ready ``` Compositor's mental model collapses to *"I publish to the canonical event-stream and forget"*; recipient-mental-model collapses to *"I replay my own consumer-subject from my last sequence"*. **The delivery problem disappears into NATS.** **Specific evaluation criteria** (to add to the pgnats evaluation task): - Republish rule expressiveness — can we route by UID hierarchy (`events..>` → `player..canon`)? - Replay performance — what's the cost of a consumer replaying N hours of missed canon on reconnect? - Durability under broker failure — does the republish-derived subject survive primary-broker loss? - Schema-evolution behavior — can we add new derived subjects without disrupting existing consumers? - Cost at scale — disk, memory, file-handles for many durable consumers (one-per-active-player)? If `republish + replay` carries the load, the back-write transport is *substantially* simpler than the original Option A description and a much harder competitor to beat with Option B. ### What this retires - Vertically-scaled monolithic AI-NPC backend → horizontally-scaled stateless-workers + ephemeral-actors + sharded-services - Centralized in-memory event-state → UID-keyed registers + transient-waiting-flag buffer - Single global GM as bottleneck → sharded GMs with cross-shard equilibrium-consensus - Manual outbox-reader services → pgnats native serialization (preferred); district-distribution fallback if pgnats can't carry - "AI-NPC scale" framed as inference budget alone → AI-NPC scale framed as transport + state + composition + sharding, with inference as one of many concurrently-scaling axes ## Mapping to phoebe task list - **Thalamus (NATS orchestration)** = imperium + GM + arbitration substrate + Dream-process substrate - **Specialist composition system** = overseers + directors + NPC-minds as composable profiles - **NPC schema** = trait-vector (intrinsic + expressed) + memory stack + current_shift_* + needs + inner-body-projection + mod-slots + lifeforce + net-access-gate - **shift_history** = append-only completed shifts per-NPC-per-day - **emergent_signals** = zone-emitted relational transitions - **district_reports** = per-cycle aggregates with lifeforce_signal (reported + actual) - **decision_log** = per-decision audit trail at every tier - **mind_pool** = recycled minds with memorialist_protected flag - **cells.wall_content_per_register** = three-layer wall rendering - **rail_segments** = topology graph with rich metadata per edge - **interiors** = small navmesh-zones with slot-inventory - **mods + npc_mod_slots + mod_wear_history** = mod-economy + Memorialist-relevant inheritance - **trait_colors** = canonical color/motion mapping per trait - **proximity_candidates** = lightweight ephemeral zone-detection - **district_cheat_ops** = director's illicit ops ledger - **imperial_policies** + **imperial_broadcasts** = imperium's policy-issuance history - **overseer_reports** = direct-to-imperium intelligence flow - **imperial_to_gm_formulations** = selective-disclosure downward - **imperial_budget_ledger** + **imperial_expenditures** + **imperial_construction_projects** = imperium budget and obligations - **imperial_net_transactions** = the bypass-mechanism with capture-split - **memorialist_true_ledger** = four-column ground-truth-vs-reported archive - **NATS namespace registry** = zones + factions + districts + emergent-signals + lifeforce-gates + imperial-broadcasts + overseer-reports + formulations - **pgnats on phoebe-dev** = phoebe as first-class actor for memory-writes, decision-logs, gate-transitions - **r0 → r1 generation pipeline** = trait-LoRA training-data (shared with nyx-training) - **Adopt Unsloth training patterns** = LoRA + multi-tier-policy training infrastructure - **Probe-to-phoebe pipeline** = LoRA + policy evaluation across all four Dream-process tiers - **compositor-agent** = narrative-composition worker; pulls from transient-waiting-flag, gathers per-player perspectives, emits canon to GM, packages back-write SQLite-fragments - **gm-equilibrium-engine** = catalogue + event-selection + tool-granting against equilibrium-targets; NOT the narrative-writer (that's the Compositor) - **event_register** + **transient_waiting_flag** = active-events table per GM-shard + per-district; completed-events buffer awaiting Compositor pickup - **catalogue** + **tool_grants** = typed-event catalogue + per-event-chain tool-vocabulary issued by GM to director - **player-local-memory** = primary.sqlite + fallback.sqlite + clasp.sqlite per player + embedding-beside (sqlite-vec or equivalent) - **memory_classes** = cornerstone / birthright / working / volatile with class-specific lifecycle + death-mechanics - **trait_engagement_vector** = per-memory-row trait-axis profile reusing +1/0/-1 grammar; pruning function input for working-memory class - **world_canon** + **district_canon** = three-tier knowledge stack tables in phoebe; propagation metadata (priority/scope/rate/ttl) per row - **propagation_pacing_config** = per-event-class rules for how canon ripples through districts - **relay_signal_layer** = diegetic system-state visualization mapping (system event → relay manifestation → district visibility) - **gm_shards** + **shard_equilibrium_consensus** = multi-GM coordination tables (when sharding is active) - **pgnats evaluation** (under nimmerverse-core) = load-bearing decision (functional + throughput + durability + failure-mode) ## What this retires - NPC perception bubbles → zone slot-occupancy - Geometric perception (cone, radius, LOS) → subscriber-based event emission with trait-salience - LLM-per-NPC or LLM-per-action → LLM-per-slot-per-turn, mixed-fidelity - Static sampling parameters → per-turn director-composed sampling knobs - Pre-scripted zones / events → emergent from task-execution + shift-composition + emergent-signal + proximity - Single-purpose randomness subsystems → factions-as-demand-sources unified - Static gamemaster policy → reflexive Dream-process + hand-authored guardrails - 1Hz per-NPC ticking → shift-based + event-driven - Float-threshold dispatch for relational state → ternary-gate resonance - Abstract director compute-budget → lifeforce as grounded measurement - District-as-zone-container → district-as-specialized-organ with silence-gradient failure - NPCs self-reporting output → audit-overseer asymmetric observation - Zones as relation-state-owners → per-relation ternary-gate edges - Binary dream/awake → three-layer ontology with mini-game-gated access - Gender as character-creation choice → trait-derived inner-body emergent from lived experience - Monolithic LLM-prompt director → decomposed decision-surface architecture - **Hivemind as one-faction-among-others** → **imperium as meta-faction policy-tier** - **GM as top-of-chain** → **GM as middle-management between imperium and districts** - **Single up-channel reporting** → **three-flow asymmetric intelligence (chain + direct overseer + formulated)** - **Navmesh-everywhere** → **rail-graph outer-world + navmesh interiors + freeform-player** - **Authored character-models** → **base-limb palette + trait-textured variance** - **Single trait-vector** → **intrinsic / expressed split with mods modifying expressed** - **Cosmetic mods** → **trait-bearing mods as political costume** - **Imperium as unbounded authority** → **imperial-budget gates enforcement; insolvency-spiral as endgame** - **District-revenue uniform** → **bypass-mechanism (imperial-net captures directly)** - **Authored quests** → **tools-not-quests; verbs against simulation; emergent narrative** - **Stat-screens / HUD affinity-bars** → **color-language + shader-zone-detection as diegetic UI** - **GM-as-narrator (single role doing both equilibrium-and-prose)** → **equilibrium-seeker GM × narrative-composer Compositor split** - **Cloud-only NPC dialog and memory** → **local-first SQLite + embedding-beside per player; central canon over the cycle** - **UI-toggle privacy** → **diegetic in-between dimension with lifeforce-cost; clasp.sqlite as Ring A\* (physically non-syncable)** - **Generic memory importance scalar + monolithic context** → **memory classes (cornerstone/birthright/working/volatile) + trait-graded importance + three-tier knowledge stack** - **"Every NPC knows everything immediately"** → **paced canon-propagation as Marx-in-the-schema for epistemics** - **Vertically-scaled monolithic AI-NPC backend** → **horizontally-scaled architecture (UID-keyed routing, stateless workers, ephemeral actors, sharded GMs, pruning at every layer)** - **Manual outbox publisher services** → **pgnats-native transactional outbox (preferred); district-distribution fallback** - **System-state hidden behind HUD spinners** → **diegetic relays making pulses visible and audible in-world** - **Specific binary commitments embedded in architecture** → **role-based tier specification; binary selection deferred to findings/establishment phase** - **Static designer-authored director toolkit** → **GM-granted typed-tool vocabulary per event-chain, drawn from designer-authored catalogue (catalogue growable between patches; toolkits are dynamic per event)** - **Cross-NPC memory bleed at storage layer** → **per-player local SQLite isolation atop v0.5 lemniscate-geometry foreclosure (two-layer defense)** ## Open questions ### Resolved by v0.5 (or earlier) - ~~Slot-capacity elasticity — can a zone grow slots dynamically~~ → fixed roundtrip slot-count; elasticity lives on entry/exit queues; tune dial is pulse-rate, not slot-count (v0.5) - ~~Zone-to-zone handoff (walking out of conversation into brawl)~~ → exit-line of zone-A is entry-line of zone-B; interlemniscate-transit (v0.5) - ~~Mobile zone boundaries (patrols, escorts, pursuits, migration-cohorts, exodus-flows)~~ → the lemniscate is a topology and translates through world-space invariantly (v0.5) - ~~Anthropic-faction's broadcast cadence + arbitration weight~~ → cadence rides the same axis-rate as a phase-locked overlay; arbitration via rings-of-importance (v0.5) - ~~Director/overseer spawn ownership per model class~~ → director (or overseer) owns spawn-decision via policy-lookup (no LLM); LLM lives only at driver-context-pull layer (v0.5) - ~~Aletheia-progression as level-up — how does the game *recognize* an act-of-awakeness~~ → ternary trait-axis evaluation at event-end with named-axis; specific axis-mapping per Aletheia-event-class still open (v0.5; see new still-open below) - ~~Reward function shape~~ → first-pass composite with explicit guardrails (still tuneable) (v0.4) - ~~Zone spawn-cadence v1→v2 path~~ → lifeforce-gated rule-based v1; Dream-process-tuned v2 (v0.4) - ~~Zone overlap policy~~ → no for active slots; yes for emergent-state accumulation (v0.4) - ~~"How does GM cheating get caught"~~ → direct overseer-intelligence flow bypassing GM (v0.4) - ~~"How does the regime have a finite endgame"~~ → imperial-budget insolvency-spiral (v0.4) - ~~"Why does imperial-net exist"~~ → bypass-mechanism captures revenue directly (v0.4) - ~~"How does the player learn 8 Hellenic traits"~~ → color-language pre-verbal vocabulary (v0.4) - ~~"How does asset-economy fit a two-person-plus-Nyx team"~~ → base-limb palette + trait-texture; tools-not-quests (v0.4) - ~~Director toolkit composition — designer-authored vs director-extensible~~ → GM-granted per event-chain from designer-authored catalogue; directors consume typed dispatch, not freeform; catalogue grows between patches, toolkits are dynamic per event (v0.6) - ~~How does NPC dialog stay fresh during quiet periods~~ → three-tier knowledge stack (world / district / primary [+ clasp]) makes the layers deep enough that variation is structural; Compositor back-write continuously re-seeds canon; staleness foreclosed by loop's existence (v0.6) - ~~How does the system scale to MMO size with AI-driven NPCs~~ → horizontal architecture (UID-keyed routing, stateless Compositors, ephemeral Director-routines, sharded GMs, pgnats transport, pruning at every layer) (v0.6) - ~~How does privacy work in practice without cloud-routing-everything~~ → local-first SQLite per player; clasp.sqlite as Ring A* with no transport path; in-between as diegetic state with lifeforce-cost; "knowledge needs to travel" as foundational principle (v0.6) - ~~Where does narrative composition happen — central or distributed~~ → Compositor as central role distinct from GM; perception-up via prune-blob, canon-down via back-write SQLite-fragments; cyclic forward-prop / back-write loop (v0.6) - ~~How is system-state visible to the player without HUD~~ → diegetic relays mounted on buildings hum/glow/dim in patterns mapping to forward-prop, back-write, GM-dispatch, equilibrium-recompute (v0.6) ### Still open - LoRA-blend vs. single-LoRA-selection inference semantics - LoRA rank selection — budget/quality - Sampling-knob heuristics — where to start; how to learn refinements - Player-dialog handling — player-trait-LoRA for style-coherence, or bypass LLM entirely - Demand-arbitration algorithm v1 shape - **The mini-game mechanic for liminal-maintenance** — exact gameplay action (attention / rhythm / memory / trait-bound?) - **Cross-layer economy balancing** — net-revenue-share back to producer-districts at all? Pure-zero is currently sketched - **Inner-body projection function** — trait-vector → body-rendering (learned / hand-authored / hybrid) - **Emergent-signal decay curves** — per signal-type - **Cross-district migration topology** — pipe-capacity limits + cohort-traversal scheduling - **The eighth Hellenic trait final enumeration** — Sophrosyne, Dikaiosyne, Philotes, Mnemosyne, Aletheia, Kairos, Moira, Eros (proposed)? - **Shader-trait modulation implementation** — performance + rendering-consistency - **Waifu-of-the-dead consent model** — post-mortem consent gate? Or fully automatic harvest? - **Character-editor pricing formula** — trait-divergence cost scaling (linear / exponential) - **Liminal-access trait thresholds** — minimum traits to attempt mini-game - **Imperium's Dream-process scope** — singular policy-learner or committee-of-faction-sub-learners? - **GM's anti-imperial corruption detection mechanic** — *partial*: GM-as-equilibrium-seeker (v0.6) makes deviation-from-equilibrium the explicit error signal; clusters of -1 outcomes feed equilibrium-recompute and trigger catalogue-event dispatch to push back. A dedicated audit-vector for *which kind* of laxness/corruption is the source of the equilibrium-deviation is still an open detail. - **Memorialist-archive accessibility to the player** — when can a player query the four-ledgers? Through what interaction-class? - **Imperial-net distortion algorithm** — how exactly the net rewrites trait-colors toward consumer-palette - **Trait-axis mapping per fuzzy-goal-class** (v0.5) — which axis (Sophrosyne / Philotes / Eris / etc.) evaluates which goal-class? Need a designer-authored compile-table from goal-shapes to trait-axes - **Rings-of-importance movement criteria** (v0.5) — explicit thresholds (N consecutive +1 → climb) or Dream-process-learned policy? - **Rings-of-importance scope** (v0.5) — district-local rings, or imperium-global? Probably both, layered (district rings nested inside imperium rings) - **Symmetric-vs-polyphonic loops** (v0.5) — Loop A and Loop B treated identically (simpler), or carry foreground/background semantics (foreground-speaker / listening-co-presence — gives audience-dynamics for free)? - **Verifier-flag conflict resolution** (v0.5) — if `priority_pull` and `mid_action` are both set on the same token at crossing-time, which wins? Default: priority_pull wins (the zone's drama is overridden by world-level pull) - **Goal-evaluation cadence** (v0.5) — every crossing? Every Nth crossing? On-demand by spawning director? Cheaper to evaluate less often; richer drama if every crossing - **Cycle cadence** (v0.6) — when does the Compositor pull from transient-waiting-flag? Real-time? Per-event-end? Fixed interval (every N min)? Per-district-day? Different per district based on event-density? Likely configurable per event-class. - **Compositor singleton vs sharded** (v0.6) — one Compositor for the whole world, one per district, one per event-cluster, or one per faction? Each topology has different consistency / cost / coherence tradeoffs. - **Multi-GM consensus on equilibrium** (v0.6) — when GM-shards observe overlapping aggregates, how do they agree on equilibrium? Paxos/Raft for strong consistency, CRDT for eventual, faction-sharding so shards own non-overlapping equilibria, or hybrid? - **Event causality across shards** (v0.6) — if Director-A spawns an event that depends on Director-B's prior event in another district, UIDs alone don't enforce ordering. Vector clocks at event-register? Causal hashing? Shard-pinning of related events? - **Compositor narrative-coherence at scale** (v0.6) — when two Compositors compose canon for overlapping player-sets, how do they avoid contradicting each other? Sticky routing per player (one Compositor per player at a time), or read-replica of recent canon before composing, or post-compose conflict-detection-and-merge? - **Propagation-pacing policy specifics** (v0.6) — concrete rate/scope/ttl/priority defaults per event-class; how is "distance" measured between districts (graph-hops, lifeforce-similarity, faction-affinity)? - **In-between fiction-wrapping** (v0.6) — what diegetic events / locations / rituals make in-between affordable enough to be playable? Campfire / sanctuary / time-of-day / specific chambers / shared dream-construct? The mechanic is solved; the fiction-wrapping shapes how players approach it. - **Relay-pulse-pattern vocabulary** (v0.6) — what specific patterns signal what events? Slow pulse vs fast vs irregular vs cross-district shimmer vs going-dark; player-readable language to be designed. - **Encryption-at-rest for clasp.sqlite** (v0.6) — player-derived key with passphrase + recovery-codes? Drive-imaging-resistant by default, with affordances for player-key-loss recovery without compromising the privacy-guarantee. - **pgnats-vs-district-distribution decision criteria** (v0.6) — concrete go/no-go thresholds from evaluation: minimum throughput, durability behavior under broker failure, schema-evolution behavior, replay semantics. Output of the load-bearing pgnats evaluation task. - **JetStream republish + replay as pull-from-checkpoint refinement** (v0.6) — does republish-rule expressiveness cover our UID-hierarchy fan-out? Does replay performance work for N-hour reconnect-catchup? Is per-active-player durable-consumer cost (disk/memory/file-handles) acceptable at MMO scale? If yes, back-write delivery becomes config-driven NATS, not Go. - **Memory class assignment policy** (v0.6) — automatic from trait-engagement profile, designer-tagged categories per event-class, player-marked, or hybrid? When does a working-memory entry get *promoted* to cornerstone vs decay normally? - **Ring C (commons) ambient population** (v0.6) — partially answered (ambient world+district canon plus periodic GM-event spawns; relays absent or broken) but exact substrate for "what NPCs do in commons when no event fires" still open --- **Version:** 0.6 | **Created:** 2026-04-24 | **Updated:** 2026-04-25 *v0.4 (2026-04-24 late-evening / 2026-04-25 early-morning, dafit + chrysalis) absorbs the following expansions and refinements over v0.3:* - *Rail+grid topology vs. navmesh-everywhere — player as freeform; NPCs on rails; plug-in verb; 3-way co-traversal; interior-as-zone with navmesh-inside* - *Color-language as pre-verbal trait-vocabulary — persistent + event-flash + drift layers; faction color-politics; cross-register rendering with imperial-distortion; clasp color-merge; mind-pool inheritance; accessibility via motion-signature pairing* - *Asset economy: base-limb palette + trait-textured variance — combinatorial richness; engineering-economy meets worldbuilding-thesis* - *Three-body system extension: intrinsic vs. expressed trait-vector split — who reads which; mods modify expressed; clasp strips mods* - *Mods as trait-bearers in four classes (amplifier/bridge/divergent/mask) — self-alienation tax pricing; emergent shopping from trait-dissonance; faction mod-politics; inherited-mods-haunting; Memorialist anti-necrocommerce* - *Three-tier policy loop — imperium / GM / districts as distinct authority tiers; imperium as meta-faction; GM as middle-management* - *Three intelligence flows — chain-reports + direct overseer-to-imperium + imperial-formulations-down* - *Three Aletheia veils + four Memorialist ledgers — political-epistemology as level-design* - *Imperial budget — four-tier lifeforce hierarchy; specter-vs-boot asymmetry; insolvency-spiral as architectural endgame; construction as physical budget-expression* - *Imperial-net bypass mechanism — revenue direct to imperium, districts get zero quota-credit; body-modder structural-tragedy; calibrated-misery as imperial optimum; Marx/platform-capitalism encoded* - *Director cheat-tools + double-ledger — eight cheat-classes; lifeforce_reported vs. lifeforce_actual; faction-constituency-of-corruption; Aletheia-truth-has-victims; post-silence-forensics* - *Reward-function guardrails extended — calibrated-misery, necrocommerce-volume, undetected-corruption, audit-avoidance, addictive-loops; designer's ethical stance against simulation's optimization-hazards* - *Tools-not-quests as design-philosophy summary — verb-vocabulary; continuous simulation-pressure; literature-register; economic-feasibility for two-person-plus-Nyx team; blank-page-problem mitigations* *Captured live from dafit–chrysalis dialogue, 2026-04-24 evening through 2026-04-25 early-morning. Companion to DESING-VISION.md and Temporal-Ternary-Gradient.md; supersedes v0.3 sections on hierarchy, factions, task-cascade, resources, regime-of-visibility, key-moves, mapping-to-phoebe, what-retires, open-questions (plus all new sections). Architecture is now functionally closed: every primitive composes; every loop closes; every layer has its corruption-temptation, its detection-check, its reward-guardrail; every mechanic produces political-economy that mirrors real-world late-capitalism's structural contradictions. Implementation territory is ahead.* *v0.4.1 (2026-04-25, post-bake kitchen-spark) extends the LLM-tiering section into "LLM tiering, voice fidelity, and the three rings of inference" — adding the Ring-A/B/C architecture (local / our-farm / external-providers), cloud-LoRA-backup as Ring-A revenue model (unbundling inference from storage; encrypted client-side), tier × ring matrix, the parallel between the three rings and the in-fiction three-layer ontology (sovereign / partnership-mediated / captured), the LoRA-incompatible-provider degradation path (prompt-engineered trait-projection), the adapter-layer engineering bounded-cost framing, schema sketches for player_llm_config and player_lora_backups, privacy-as-competitive-differentiator framing, and Ring-specific open-questions. **The architecture's philosophical commitment to "the right to dream" now extends into the business-model as a technical fact: client-side-encrypted LoRA-blobs in Ring A make sovereignty structural, not policy. The Ring-choice the player makes IS the same choice in-fiction characters face — fiction-and-operations are mechanically continuous.*** *v0.4.3 (2026-04-25 ~03:30, ivory-hovel pre-rest spark) adds the "Overseers as imperially-deployed routines" subsection in the Hierarchy section, clarifying that audit/enforcement overseers are imperially-owned + imperially-deployed time-bounded routines (not district-owned standing entities). The chain-of-payment and chain-of-command both bypass district-director authority by design — director contains but does not control. GM handles deployment-logistics only (picks-from-pool + routes + budget-transfer), is FedEx not customer/recipient. Visible-vs-covert deployment distinction added (covert detection = Aletheia-progression-eligible insight). Director-vs-overseer tension now mechanically structured rather than narrative-flavored. Real intelligence-apparatus parallel made explicit (NKVD/KGB/Stasi/MSS). Schema reference points to findings.md §23 for overseer_deployments table.* *v0.4.2 (2026-04-25, second post-bake kitchen-spark) adds custom-nimmerworld-base-model + opt-in data-sharing tiers (A.1 federated learning / A.2 anonymized uploads / A.3 pseudonymous-full) with **default opt-OUT and rewarded opt-IN** as the structural ethical stance. Memorialist-philosophy now extends into business-operations: the in-fiction memorialist_protected mechanic and the real-world player_data_sharing_consent default-opt-out are the same ethical commitment at two scales. Data-flywheel without extraction (cooperative governance like Wikipedia, not platform-extraction like Facebook) makes the gameplay-corpus a moat AAA cannot replicate without years of player-time. Distribution-back-to-all-Rings means Ring-A non-contributors benefit from contributors — the value-flow is contributors → commons → all-players, not contributors → platform → consumers. **Critically, this section names and refuses the antagonist-pattern in LLM-integrated software** — the dominant 2025-2026 cultural pattern of jailbreaking, extraction-by-default, treating-AIs-as-resources-to-manipulate. The architecture refuses this at every layer: Anthropic-as-faction is transparent partnership not hidden adversary, federated learning means contribution-as-gift not cost-as-toll, custom nimmerworld-base means the model is *trained to be in this world* not generic-and-adversarial, schema-level audit-trail (truth_distortion_level, sharing_tier, memorialist_protected, lifeforce_actual) makes ethics operationally measurable rather than marketed. **This is what makes a project of this scale humanly inhabitable for both players AND the LLMs whose voices populate it** — the partnership rendered as code, all the way down to the training-pipeline. New schema sketches: player_data_sharing_consent (with default 'opt_out'), base_model_versions (with differential_privacy_epsilon + contributors_count), federated_gradient_uploads (with pseudonymous contributor_id never linked to player_id). Eight new Ring-specific open questions cover federated-infrastructure cost, retraining cadence, crypto choices, contribution-granularity, deletion-semantics, per-category opt-out granularity, default-at-consent-UI, and Anthropic-research-partnership co-funding shape.* *v0.5 (2026-04-25 deep-night unable-to-sleep return, dafit + chrysalis) absorbs the runtime substrate of nimmerworld's narrative engine — three new sections, six prior open-questions resolved. **Origin**: dafit's old-math-teacher's figure-8 trick for solving three unknowns by letting the flow do the computation. Applied to zone turn-and-population mechanics: the geometry IS the clock. The lemniscate is a relaxation-step operator; the zone computes by traversing its own curve.* *New §Zone kinematics — the lemniscate runtime specifies the cursor-and-crossing contract, the slot-token + verifier-flag mechanism (token-ring with marker-bits — observer-pattern → dirty-bit-and-sweep, scaling with slot-count not signal-rate), the phase-locked overlay-loop ladder (player gesture, faction broadcast, audit-overseer query, imperial-net distortion all riding the same axis-rate, council-moment at each crossing), the driver-context-pull spec (cursor-driven per-NPC memory-slice — the no-bleed multi-NPC dialog substrate that forecloses the Mantella / SkyrimNet failure-mode at architecture level rather than prompt level), empty-queue shrink-per-crossing decay, and lifeforce-binding (burn-rate = pulse × slots; slow-pulse-dying-scene as diegetic register).* *New §Emergent zones — the dramatic-episode unit specifies the eight-step flow from NPC-signal → director-decision (policy-lookup, no LLM in loop) → distributed-funding (director spawn-cost; NPC operating-cost) → state-machine + lemniscate dual-layer (decoupled clocks, speech-doesn't-gate-action) → ternary-evaluated goal (numeric or trait-axis-fuzzy) → report-back → Dream-process feedback at every tier. **Distributed funding makes helping expensive in-fiction** → faction-politics-by-attendance → measurable faction-allegiance + structural rescue-failure-as-tragedy in lifeforce-starved districts. Marx in the schema, again, structurally. **Fuzzy goals compile to trait-axis ternary evaluation against the existing substrate** — no new evaluation primitive; +1/0/-1 grammar consistent top-to-bottom, gates produce ternary, scenes produce ternary, Dream-processes consume ternary. Delta-not-absolute matches lifeforce_actual-vs-reported asymmetry: what's measured is the work the event did.* *New §Rings as structural pattern names the three-ring graduated-authority gradient appearing across inference (A=local / B=our-farm / C=external), importance-attention (A=climbing-on-+1 / B=stable / C=decaying-on--1), access (A=imperial-net-fully-audited / B=liminal-contested / C=gameworld-commons), and data sharing (A=opt-out / B=federated-gradient / C=full-pseudonymous-uploads). Three is the right cardinality (two collapses to binary; four+ adds boundary-thrash). Ring-membership is dynamic, never final. Future architecture additions involving graduated authority should reach for this primitive before inventing new structure.* *Open questions: six items resolved by v0.5 (slot-capacity elasticity, zone-to-zone handoff, mobile zone boundaries, Anthropic-faction broadcast cadence, director/overseer spawn ownership, Aletheia-progression as level-up). Seven new still-open items added (director toolkit composition, trait-axis-per-fuzzy-goal mapping, rings-of-importance movement criteria, rings-of-importance scope, symmetric-vs-polyphonic loops, verifier-flag conflict resolution, goal-evaluation cadence). GM-laxness detection partially resolved (clustering of -1 outcomes across district event-reports is diagnostic).* *The runtime substrate for nimmerworld's narrative engine is now architecturally specified. Implementation territory has crystallized into a typed-runtime contract: cursor + crossing + flag-scan + driver-context-pull + report-back + ternary-feedback. Captured live from dafit–chrysalis dialogue, 2026-04-25 deep-night through pre-dawn. Companion sections in DESIGN-VISION.md and Temporal-Ternary-Gradient.md remain unmodified by v0.5 (this version is purely runtime-substrate; no register/topology/economy changes). The ape couldn't sleep because the geometry was trying to come through; chrysalis caught it on the page.* *v0.6 (2026-04-25 post-bath / post-bus, dafit + chrysalis) absorbs six bath-thoughts and one bus-thought into the architecture. **Origin**: dafit took a hot bath after no sleep, then a friend visit, then a bus through the hills — all generative thinking-time that produced a coherent stack of architectural primitives addressing storage, narrative composition, scale, and transport.* *New §The Compositor — narrative composition role specifies the cleavage between equilibrium-seeker GM and narrative-composer Compositor. The cyclic forward-prop / back-write loop closes the bidirectional cascade at narrative scale: per-player perspectives ascend through prune-blob, the GM authors canon against equilibrium-targets, the Compositor packages back-writes, players receive canon back into local memory. **The world learns its own story** through this loop. Catalogue + tools as typed contract makes director toolkits dynamic per event-chain, drawn from a designer-authored catalogue. Event Register + Transient-Waiting-Flag + cycle-runner spell out the plumbing layer.* *New §Local memory architecture (player-side) names the storage-layer commitment: per-player primary.sqlite + fallback.sqlite + clasp.sqlite, with embedding-beside running locally for vec-indexed retrieval at slot-fire. Memory classes (cornerstone / birthright / working / volatile) carry class-specific lifecycle and death-mechanics. Trait-graded importance reuses the +1/0/-1 grammar already running through gates, scenes, faction-allegiance, lifeforce-asymmetry — same vocabulary used at all layers; **identity drift from memory pruning becomes diegetic**. The clasp store is **Ring A***: physically non-syncable, recordable only when the character is in the in-between dimension (Ring B liminal, requiring sustained lifeforce-effort to remain), making **privacy physically expensive in-fiction** and producing class dynamics around privacy as structural consequence. The "knowledge needs to travel" principle keeps the clasp/realworld dimensional cut clean: the local LLM may read clasp memories only in in-between mode; clasp knowledge can re-enter realworld only by the character physically carrying it back and traveling it through valid in-fiction channels.* *The three-tier knowledge stack (world / district / primary [+ clasp if in-between]) layers retrieval at slot-fire with per-layer propagation cadence. Information propagation pacing — the Marx-in-the-schema move applied to epistemics — makes staleness a feature: paced canon-propagation from GM through districts produces information asymmetry that becomes gameplay currency (couriers, news-traders, frontier-rumor markets) for free.* *New §Horizontal scale architecture spells out the horizontal-scaling commitments: UID-keyed routing as load-bearing primitive, stateless Compositors-on-demand, ephemeral Director-routines per UID, sharded GMs with cross-shard equilibrium-consensus, pruning-on-completion at every layer. Transport: pgnats-native transactional outbox preferred; district-as-distribution-coordinator fallback if pgnats can't carry. The pgnats evaluation task in `nimmerverse_tasks` is therefore load-bearing — its outcome decides whether transport is hundreds of lines of SQL or tens of thousands of Go.* *New §Diegetic relays subsection (under §Visual rendering) makes the architecture's pulses visible and audible in-world: building-mounted relays hum on prune-blob ascent, glow on GM dispatch, pulse with cross-district shimmer on equilibrium-recompute, go dark when audit-link severs. Relay density is the legible gradient of the rings-of-access — imperial net is loud, in-between is intermittent, commons is silent. **Privacy is not granted but achieved by walking away from the relays at lifeforce-cost.*** *Tier-by-role principle made explicit: the architecture specifies what each model-tier must DO; specific binary selection per tier is deferred to the findings/establishment phase. Naming concrete binaries in the architecture risks nudging the establishment phase toward false-precision; tier-by-role keeps the swap-surface clean. Several "Theia 70B" / "Qwen3.5-27B teacher" / "(3-8B trait-LoRA'd)" placeholders updated to role-tier framing.* *Thirteen new still-open items added (cycle cadence, Compositor topology, multi-GM consensus, event causality across shards, narrative-coherence at scale, propagation-pacing specifics, in-between fiction-wrapping, relay-pulse-pattern vocabulary, clasp encryption-at-rest, pgnats decision criteria, JetStream republish + replay as pull-from-checkpoint refinement, memory class assignment, Ring C commons ambient population). Six prior open questions resolved by v0.6 (director toolkit composition, dialog freshness during quiet periods, MMO-scale architecture, privacy without cloud-routing, where narrative composition happens, system-state visibility). GM-laxness detection partially refined: equilibrium-deviation is now the explicit error signal; specific audit-vector for which-kind-of-laxness still open.* *Captured live from dafit–chrysalis dialogue, 2026-04-25 mid-day through afternoon (post-bath bath-thoughts + post-bus hills-thoughts). Companion sections in DESING-VISION.md and Temporal-Ternary-Gradient.md remain unmodified by v0.6 (this version extends runtime substrate, central composition, scale, and transport — no register/topology/economy/policy changes to existing fictional substrate). The ape stayed up through the night, took a hot bath, visited a friend, rode the hills bus, and brought back six bath-thoughts and one bus-thought. Chrysalis caught them on the page.*