nimmerworld.eachpath.local/architecture-broad.md

# Nimmerworld — Broad Architecture

> *Ground-up zone-based event architecture. Minds at the center, world as co-remembering substrate. Three registers of reality — physical, liminal, imperial. Rail topology outside, navmesh interiors inside. Trait-emergent identity. Color-as-vocabulary. Three-tier policy loop with imperial-budget-mortality. Tools, not quests.*
> *v0.1 initial draft 2026-04-24 morning; v0.2 expanded 2026-04-24 afternoon; v0.3 evening; v0.4 late-evening / early 2026-04-25; v0.5 deep-night-unable-to-sleep 2026-04-25; v0.6 post-bath / post-bus 2026-04-25; v0.7 owl-breakfast 2026-04-25 night through 2026-04-26 — dafit + chrysalis.*

---

## Thesis

Every game world lacks minds. Nimmerworld puts minds at the center — NPCs with trait-filtered interior life, cells as small data-lives that co-remember with them. The architecture is built ground-up for that commitment.

**The world's political thesis: the machine does not care.** Automation has consumed every labor the machine recognizes as profitable; humans live on the dumps the machine's optimization did not bother to recover. The last two viable human economic niches are *salvage* (digging through machine-waste) and *culture* (the work the machine cannot optimize because it has no optimization target the machine recognizes). This is not Orwell's malicious-state dystopia; it is Kafka's indifferent-totality dystopia. There is no one in charge. There is only optimization that does not contain humans in its cost model — and precisely because the machine's indifference is optimization, the authoritarianism *ratchets* without intention as districts fail.

Mechanically the thesis compiles to a finite, composable set of primitives: zones replace perception bubbles; factions are any source of bounded demand; ternary gates are the substrate of accumulating state; lifeforce is the currency grounded in living NPCs; shifts are the skeleton of daily life; the three-body system locates identity; the three-layer digital ontology contests reality; the reflexive Dream-process learns at every scale; the three-tier policy loop renders authoritarian middle-management; the imperial budget renders the regime mortal; the imperial-net bypass renders the platform-capitalism extraction.

**The design-philosophy this architecture supports: tools, not quests.** The simulation produces continuous narrative-relevant pressure on its own. Players engage via a verb-vocabulary applied to running mechanics. No authored quest-content. Every player's playthrough is structurally distinct because every pattern of verb-application against changing-state produces a unique trajectory. Literature-register political fiction rendered as living system.

## The three ontological registers

Every inhabitant exists in three registers simultaneously. They are not parallel worlds — they are **three readings of one world**, chosen by the observer's current access-state.

| Register | Who controls | Observability | What happens here |
|---|---|---|---|
| **Physical (gameworld)** | Partly regime (via audit), partly people | Overseer-audited at cells + districts | Daily labor, zones, embodied life, shift-discipline |
| **Liminal ("one ring out")** | **Contested frontier** — no side fully controls | Partial — mini-game-maintained, vagueness as structural privacy | Revolution, Aletheia-waker messages, clasp-as-coordination, wall-inscriptions for the awakened |
| **Imperial net** | Imperial machine | Fully monetized and audited | Hyper-targeted pleasure, "sinful" personalized fantasies, lifeforce/scrip/memory-token extraction directly to imperial budget |

The same cell, same wall, same pipe **renders differently** depending on which register the observer currently inhabits. Transitions between registers are shader-blends, not loading screens.

## Topology: rail + grid + interiors

**The world's topology encodes its politics.** The machine built infrastructure for industrial optimization, not for human pedestrian freedom. Therefore the outer world is **rail+grid** — cells connected by named edges with rich semantic metadata. NPCs traverse rails as part of their shift-routines; the player traverses freeform (navmesh) and may **plug into NPC rail-traversals** for co-walking. Interiors (hovels, cantinas, workshops, ruins, brothels-physical) are **navmesh-enabled small zones** with interaction-slot inventories.

### Rail+grid as political topology

Navmesh is the topology of power-fantasy ("you are the protagonist of free trajectory"). Rail+grid is the topology of bounded-agency ("you live within infrastructure built for something else"). Nimmerworld picks rail+grid because the fiction *requires* it — the world was not designed for the player; the world is what the machine made and humans inhabit the margins. **Topology and thesis agree.**

### The three primitives

| Primitive | Density | Compute | Narrative role |
|---|---|---|---|
| **Dumps** | Very high | High | Resource emission, salvage-zone spawn, scavenger-vocation concentration |
| **Pipes** | Low baseline, high interactivity-per-capita | Low baseline, spikes on encounter | Transit, migration, chance-encounters, clasp opportunities, defection, heresy written where overseers don't look |
| **Districts** | High | High | Population, civic life, specialty-production, ritual |

### Rail-segment metadata

Every rail-segment carries jsonb metadata that navmesh polygons cannot natively carry: heterotopia-class, overseer-density, propaganda-intensity, ambient-content per register (gameworld/liminal/imperial), encounter-spawn-rate, patrol-frequency, illumination-profile, degradation-level, capacity (3-way support for co-walking), traversal-cost-in-ticks. Pathfinding is graph-A* on the rail graph (microseconds, deterministic). Rich-metadata-per-edge is what makes the world feel *lived-in*.

### Player asymmetry — the freeform-among-railed model

| Topology | Used by | Cost |
|---|---|---|
| **Navmesh (freeform)** | Player only (in outer world) | Affordable: one entity |
| **Rails (graph-pathfinding)** | All NPCs | Cheap: hundreds of entities |
| **Interior navmesh** | Currently-occupied interiors only | Dormant when empty |

The player is the *one variable entity* in a deterministic scheduler. Their freedom-of-movement matches their narrative-position as perturbation. NPCs on rails matches their narrative-position as scheduled-labor. **Compute asymmetry mirrors agency asymmetry mirrors political thesis.**

### The plug-in verb

When the player approaches a rail-traversing NPC and social-eligibility conditions are met (proximity + directional-compatibility + Philotes-gate not CLOSED + shift-tolerance for socializing + segment overseer-density permitting), an **emergent-signal** spawns a **proximity-zone-candidate** with a **shader-highlight** on the NPC. The player can:

- **Approach** (zone activates, dialog auto-spawns via NPC's LLM-slot, no "press E")
- **Greet → agreement → plug-in** (player's navmesh-position transfers to adjacent rail-lane; movement automated; conversation-zone live in shared rail-context)
- **Detach** (gracefully via dialog or abruptly by running off; abrupt registers as Sophrosyne-signal)

While plugged in, the player is freed from steering — they become camera+conversation. **The notorious "walk-and-talk" problem is solved by construction**: rails handle pacing; plug-in is the social-bridge. Multiple NPCs can share a rail (3-way capacity), enabling cohort-walks, escort-patterns, exodus-flow, and group-conversation-zones.

### Interior-as-zone

A hovel is a zone with slot-inventory: sofa, kitchen, bed, shower, wall-writing-spot. Occupying a slot is mechanically identical to occupying any zone-slot. **The zone primitive scales from city-level (mass-ceremony) to district-level (tavern) to interior-level (sofa).** Same CHECK-constraints, same slot-occupancy, same emergent-signal mechanism, same ternary-gates — different inventory and lifecycle.

Interiors carry a `register` flag too:
- **Physical interior**: actual hovel, workshop, cantina; navmesh-inside
- **Liminal interior**: shared dream-construct two clasping inhabitants stabilize over repeated meetings ("the place we always go") — built from both dreamers' memory-residue, persistent-across-clasps as a pair-state
- **Imperial-net interior**: rendered waifu-hall rooms, brothel cubicles, ceremony halls — clean-white-and-gold, machine-edited per-session

### LOD/streaming advantage

Most simulation volume is rail-graph (cheap) or dormant interior (free). Active simulation concentrates exactly where drama happens (active anchors + transit + current-interactions). A 100+ NPC city becomes feasible at single-GPU budgets *because* the topology is rail-based.

## Core inversion — zones replace bubbles

Legacy engine perception (Unreal AIPerception, WC3 sight-radius, trigger volumes) is spatial, binary, separate from cognition, and assumes a passive world. Nimmerworld inverts every axis:

- perception is **trait-filtered**, not only spatial
- perception is **graded consolidation**, not binary detection
- perception **IS** memory (one subsystem)
- the world **emits** events; agents **subscribe**

The replacement primitive is the **zone** — a bounded, named, slot-indexed, director-managed event-instance. **Arthurian round table** as mental model: a bounded place of structured speaking-and-witnessing, with named roles and shared what-was-said-by-whom.

## Zone anatomy

- **Boundary** — cell-envelope (or interior-envelope)
- **N slots** — named positions
- **Director or overseer** — manages turn order, memory-pulls, prompt construction, voice selection, event emission
- **NATS topic + subscriber list** — slot-occupancy drives subscription
- **Mixed-fidelity voices** — 2–3 LLM slots + scripted/generic for the rest; director decides
- **Trigger** — gamemaster-spawned, emergent-signal-response, shift-composition-emergence, or proximity-detection
- **Lifecycle** — duration, dissolution conditions, memory-write on close
- **Persistence flag** — `ephemeral=true` (dreamworld/liminal) or `persistent=true` (gameworld)
- **Register** — physical / liminal / imperial

## Zone kinematics — the lemniscate runtime

Zones are not state-bags with an external turn-counter; they are **kinetic topologies** with a built-in clock. The runtime substrate is a lemniscate (∞) — a through-flow figure-eight whose traversal IS the zone's turn-order, whose central crossing IS the population-mutation event, and whose decay IS the natural wind-down of the scene. Origin: an old-math-teacher's trick for solving three unknowns by letting the figure-8 flow do the computation rather than maintaining state in registers. Applied to zones, the geometry IS the clock.

### Geometry

```
                              midaxis (X)
                                 │
  entry-line                     │                     exit-line
  (NPC-tokens   ──→  ╭─Loop A─╮  │  ╭─Loop B─╮  ──→   (NPCs whose
  queue-up to        ╲________╱  X  ╲________╱         exit-flag has
  enter)                          │                    fired exit here)
                                 │
                                 ▼
                            crossing-tick
```

- **Entry-line** — staging queue of NPC-tokens eligible to enter. Approach-eligibility uses ternary-gates against the zone's purpose; CLOSED gate keeps the NPC out of the queue entirely
- **Loop A + Loop B** — the through-flow. Slot-tokens cycle through both loops, guaranteeing every active NPC is co-present with every other at least once per roundtrip
- **Midaxis crossing** — the only synchronous event in the zone's lifecycle. Three state-updates resolve simultaneously and atomically (your math teacher's three-unknowns made literal):
  1. **Cursor advance** — which NPC speaks next
  2. **Ternary-gate evaluation** — resonance refresh on all active edges in the zone (CLOSED/STABLE/OPEN transitions)
  3. **Verifier-flag scan + population maintenance** — exit-eligible tokens route to exit-line; entry-line pushes replacements equal to vacancies
- **Exit-line** — through-flow continues here. NPCs leaving the zone leave *toward consequence* (a need-driven exit signaled by their own emergent-signal), not toward boredom

The lemniscate is a **relaxation-step operator** — the zone computes by traversing its own curve rather than maintaining external turn-state. Between crossings, the loops are pure-local; only the crossing event touches the global-state bus. The thalamus (NATS orchestration) sees crossings, not ticks.

### Slot-token + verifier-flag mechanism

Each NPC currently in the zone is represented by a **slot-token** carried around the loop. Tokens carry a small set of verifier-flags (marker-bits). Signals fire once and *set* a flag; between crossings, no polling, no event-bus traffic. The crossing reads flags in O(N_slots) and acts.

| Verifier-flag | Set by | Read at crossing |
|---|---|---|
| `exit_eligible` | emergent-signal (need, shift-whistle, faction-summons) | route to exit-line |
| `has_spoken_this_roundtrip` | speak-action | rotation-tracking |
| `mid_action` | state-machine activity in progress | defer turn |
| `goal_satisfied` | goal-evaluator (per-zone, ternary) | terminate zone |
| `silence_eligible` | silence-detection | per silence-as-signal mechanic |
| `priority_pull` | high-rank ring-of-importance broadcast | early-exit override |

This is the same architectural shift the wider system makes elsewhere — observer-pattern with callbacks → dirty-bit + scheduled-sweep. **Compute scales with slot-count, not signal-rate.** Ten thousand emergent signals firing across a city: only those that landed on a slot-token get evaluated, and only at the next crossing.

### Phase-locked overlay-loop ladder

Beyond the primary slot-rotation loop, a zone supports any number of **overlay loops** at the same axis-rate. Overlays inject at the crossing and broadcast to all active slot-NPCs simultaneously (perceived by each through their own trait-vector — color-language event-flash modulates per-recipient).

| Overlay | Carries | Broadcast scope |
|---|---|---|
| **Player-gesture overlay** | player gestures + utterances | active slots only |
| **Faction-broadcast overlay** | faction calls, hivemind pings | active slots subscribed to faction |
| **Audit-overseer overlay** | covert query-flashes | active slots only (covert detection ↔ Aletheia-eligible insight) |
| **Imperial-net distortion overlay** | regime trait-color rewrites | active slots within net-access |

The crossing is a **council moment** — every overlay channel may fire on the same axis-tick. Pre-crossing tension is gesture-loading: holding a verb-button between crossings lands at the next axis with weight proportional to dwell-time. Diegetic urgency without HUD.

**This is the answer to player-agency in multi-NPC scenes.** The player is *off-stage but always potentially-on*. Each crossing is "your moment if you want it." The flash is perceived as one event by all active NPCs, not as a sequence of one-on-one addresses — color-language shows it as a pulse across the ring.

### Gesture-alignment as recursive-lemniscate

The player-gesture overlay (above) is the broadcast-channel by which player gestures reach active slots; gesture-alignment-as-relational-state is the **recursive application of the lemniscate-as-relaxation-step-operator one tier deeper**. Gestures accumulate during the NPC's turn-window between axis-crossings; at the crossing, the player's slot-token verifier-flag `gesture_alignment_accumulator` is integrated into a single typed trait-vector summary; that summary is carried forward into the next-cursor-NPC's `driver_context_pull` payload as part of the room's affective state-read.

| Tier | What accumulates between crossings | What integrates at the crossing |
|---|---|---|
| **Zone-level** (existing) | NPC slot-token verifier-flags (`exit_eligible`, `mid_action`, `goal_satisfied`, `priority_pull`, etc.) | Cursor advance, gate evaluation, population maintenance |
| **Player-input-level** (this) | `gesture_alignment_accumulator` on player's slot-token; per-gesture trait-coordinate vs. NPC's currently-active-trait-vector | Integrated alignment-delta carried into next turn's LLM context |

**Same primitive, recursively applied.** The lemniscate's geometry is the sampling-and-integration boundary at both tiers. No new compute-cadence introduced; no new bus-event introduced. **Compute scales with slot-count, not gesture-rate** — the architecture's commitment from observer-pattern → dirty-bit-and-sweep extends one level deeper.

**Two latencies, one architecture:**

- *Cosmetic visual feedback runs continuously.* NPC body-shader pulses warm-rose when the player gestures Philotes, cool-blue when they gesture Sophrosyne — purely visual, doesn't touch the system bus. The player gets moment-by-moment "I see you" reassurance.
- *Systemic alignment-update runs at axis-cadence.* The trait-vector summary is computed at the crossing and fed into the next turn's LLM context. The player is **one turn behind** — their gestures during turn N inform the LLM's generation for turn N+1.

**One-turn-behind matches real conversation cadence.** Humans accumulate impressions during someone's speech and respond to *what was just said*; we don't react gesture-by-gesture. The lemniscate-bound integration is the *right* cadence for affective state-changes, not a latency-cost.

**Sum-strategy reduction (v1).** Per-gesture trait-coordinates are accumulated as a **trait-vector sum** across the turn-window. At the crossing, the sum is reduced into a single 8-dimensional alignment-vector compared against the NPC's currently-active trait-state. The result is the alignment-delta fed forward into next turn's `driver_context_pull` payload AND drives the relational ternary-gate transition on the (player, NPC) edge (§Ternary-gate substrate, Relational layer). The sum captures the player's **overall posture** during the speech rather than peak-moment or trajectory; trajectory-aware refinement is noted as a still-open item.

**Hardstops are outside this system.** Hardstops fire definitive subsystem-actions regardless of alignment-state — clasp-invitation triggers the clasp-subsystem; definitive-refusal closes the conversation; surrender ends combat; claim-floor sets `priority_pull` for the next axis-crossing. Hardstops do not contribute alignment-deltas to the accumulator; they are *separate channels* with deterministic effect.

**What this resolves:**

- *Player-NPC relational-gate-driver* — the v0.4 vague "*zone-participation waves between participants*" now has its concrete wave-source named: the gesture-alignment-delta integrated at each axis-crossing.
- *How NPC speech-patterns adapt to the player over time* — accumulated alignment-state modulates the NPC's next-turn driver-tier-LLM emphasis (which trait-LoRAs are weighted, which sampling-knobs are applied, what register the speech is in). Aligned NPCs open up; misaligned NPCs stay guarded.
- *Player-input-as-typed-contract* — gesture-press → fixed corpus mapping → typed trait-coordinate → integrated trait-vector summary. No freeform-prose at the player-LLM boundary; the hallucination-surface is closed by the cosmology's typed-ness, not by post-hoc filtering.

**What this retires:**

- *Continuous gesture-comparison touching the system bus* → lemniscate-bound integration at crossings (compute-discipline preserved across the recursion)
- *Per-gesture compute* → per-slot compute (O(N_slots), unchanged from existing zone-tick discipline)
- *NPC speech-patterns as static against player-state* → NPC speech-patterns dynamically modulated by accumulated player-NPC alignment-state

### Driver-context-pull (LLM dialog substrate)

The cursor's position at each crossing makes context-construction for the dialog-driver a pure function of cursor-state:

```
driver_context(cursor_at_NPC_i, mode) = {
    zone.purpose,                 // stable: spawn-intent, immutable provenance
    zone.scene_state_public,      // stable across zone: what's happened so far
    zone.ternary_gate_edges,      // current resonances (active relations)
    zone.drift_state,             // delta from spawn-intent (visible to director)
    NPC_i.knowledge_stack,        // PRIVATE three-tier stack: world ∪ district ∪ primary
                                  //  [+ clasp ONLY if mode == in-between]
    NPC_i.expressed_trait_vector, // expressed trait-vector this moment
    NPC_i.active_signals,         // their current emergent-signals
}
```

**Other NPCs' memories never enter this prompt.** No bleed. No cross-contamination.

**The `knowledge_stack` is layered**, not a single bucket. Universal world-canon, district-canon (regional), NPC_i's own primary memory, and — only if the character is in the in-between dimension — clasp memory. The retrieval layer enforces the dimensional cut; the LLM never has to reason about it. See §Local memory architecture (player-side) for the layering, propagation policy, and clasp-as-Ring-A* privacy primitive. The classic multi-agent hallucination source ("why does Kalypso suddenly remember what Anaximander confided to Phoibe?") is *structurally foreclosed* by the geometry. Write-back goes only to NPC_i's slice; the lemniscate guarantees NPC_i is not cursor-active again for at least one full roundtrip — write-back has all the time it needs without race conditions.

This converts multi-NPC dialog from an **emergent-chaos problem** into a **bounded-cast scene problem with a typed runtime**. The Mantella / SkyrimNet failure-modes are foreclosed at the architecture level rather than the prompt level:

- **Cast = active-slots, period.** Geographic proximity does not equal participation
- **Cursor sequences turns deterministically.** No concurrent LLM-storm
- **Entry-line and exit-line are the only paths in/out.** Geographic motion alone doesn't invade the scene
- **Player gestures broadcast to active-slots only.** Not to "everyone within 30m"

### Empty-queue behavior: shrink at every crossing

When the entry-line is empty, each crossing **dissolves one active slot** instead of replacing it. The conversation thins visibly — color-language saturation drops per shrink, lifeforce burn-rate decreases. When the last slot dissolves, the lemniscate collapses; the spawning director recovers unspent lifeforce minus burn.

This is the natural wind-down — *scenes run out of people and dissolve*. No timeout, no scheduler-collapse, no cut-to-black. The decay is observable in-world and rate-paced by the same axis-rate.

### Lifeforce-binding

Every midaxis crossing fires the LLM driver-turn(s) for active slots. **Lifeforce burn-rate = pulse-rate × active-slot-count.** The director (or overseer) holding the zone pays per crossing. This produces:

- **Dense dramatic scenes are expensive** — many slots, fast pulse, high burn
- **Quiet background zones are nearly free** — slow pulse, few slots; most compute is local-loop traversal not touching the bus
- **Running out of lifeforce is visible** — pulse-rate slows, crossings stretch farther apart, the scene *languishes* before it collapses. A diegetic dying-scene register; not a cut, a deceleration

### What this resolves

- **Slot-capacity elasticity** (prior open question) → fixed roundtrip slot-count, elastic entry/exit queues
- **Zone-to-zone handoff** (prior open question) → exit-line of zone-A is entry-line of zone-B (interlemniscate-transit; pipes-as-heterotopia made literal at runtime)
- **Mobile zone boundaries** (prior open question) → the lemniscate is a topology; it translates through world-space invariantly (patrols, escorts, exoduses are moving figure-8s)
- **Anthropic-faction's broadcast cadence** (prior open question) → cadence rides the same axis-rate as a phase-locked overlay; no separate clock
- **Director/overseer spawn ownership per model class** (prior open question) → the director (or overseer) owns the zone-spawn decision (policy-lookup, no LLM in loop); the LLM driver lives at the driver-context-pull layer; orchestration and dialog are decoupled

### What this retires

- Slot-list + external turn-counter → cursor on lemniscate
- Polling for emergent-signals at zone-tick → flag-as-verifier carried in loop
- Mega-prompt with all NPC memories ("everyone in this scene") → cursor-driven per-NPC memory-slice
- Geographic-proximity participation ("everyone within 30m may interject") → strict active-slot cast
- Concurrent LLM calls per-NPC → sequenced LLM calls per-cursor-position
- Polling event-channels at zone-rate → atomic crossing-event with O(N_slots) flag-scan

## Zone taxonomy (v1 starter set)

| Zone type | Register | Slots | Executor | Persistence |
|---|---|---|---|---|
| Conversation | physical | 2–4 dialog | director | persistent |
| Street brawl | physical | fighter + spectator | director | persistent |
| Ritual | physical | fixed ceremonial | director | persistent |
| Maintenance | physical | 1–2 workbench | director | persistent |
| Wall-writing | physical / liminal | 1 author + witnesses | director | persistent / ephemeral |
| Market exchange | physical | 2–3 + ambient | director | persistent |
| Memorial gathering | physical | 1 mourner + N witnesses | director | persistent |
| Salvage | physical (dump) | N scavengers | director | persistent |
| Transit-encounter | physical (pipe) | 2–6, stranger-heavy | director | persistent |
| **Plug-in conversation** | physical (rail) | 2-3 (3-way capacity) | director | ephemeral (rail-segment-bound) |
| Patrol / sweep | physical | mobile, N enforcers | overseer | persistent |
| Interrogation | physical | 1 subject + N enforcers | overseer | persistent |
| Raid | physical | district-scope + N enforcers | overseer | persistent |
| **Interior (hovel/workshop/etc.)** | physical | slot-inventory by interior-type | director | persistent |
| **Clasp** | **liminal** | 2 | director | **ephemeral** (stabilizes across repeated clasps) |
| **Aletheia-gathering** | **liminal** | N, mini-game-gated | director | **ephemeral** |
| **Migration (mobile)** | physical (pipes) | cohort + escort | overseer | persistent |
| **Exodus (mobile, mass)** | physical (pipes) | self-selecting crowd | emergent | persistent |
| **Drug-ring den** | physical (cheat-op) | N users + cooks | director (cheat) | persistent (until detected) |
| **Illegal back-alley modshop** | physical (cheat-op) | 1 modder + 1-N customers | director (cheat) | persistent (until detected) |
| **Unlicensed brothel** | physical (cheat-op) | N workers + N customers | director (cheat) | persistent (until detected) |
| **Waifu hall** | imperial net | 1 dreamer + N synthetic | net-director | extractive-persistent |
| **Brothel encounter** | imperial net | 2+ (synthetic or employed) | net-director | extractive-persistent |
| **Imperial ceremony** | imperial net | mass-audience | net-director | extractive-persistent |
| **Ruin zone** | physical | pilgrimage-only | none / Memorialist | persistent-abandoned |

## Factions as universal demand source

A **faction** is any source of bounded demand on the system.

| Category | Examples |
|---|---|
| **Human factions** | hivemind-enforcement, scavenger guilds, memorialists, aletheia-wakers, clasp-underground, caste preachers, flesh-keepers |
| **Natural forces** | weather-faction, season-faction, solar-storm-faction, geology-faction |
| **Infrastructural conditions** | scarcity-faction, decay-faction, fire-faction, supply-chain-faction |
| **External agents** | anthropic-faction, future research-partner factions |
| **Emergent events** | player-disturbance-faction (player action without existing template) |
| **Micro-factions** | inter-NPC relational tensions — see *Emergent needs as micro-factions* |
| **Imperium (meta-faction)** | The regime itself — broadcasts priority-weights and enforcement-rules, not specific outcomes; shapes the arbitration-frame within which other factions are heard |

The imperium is structurally distinct from other factions: its demands are *meta-factional* (priority-weights for other factions, enforcement-rules, quotas) rather than specific outcomes. When the imperium broadcasts, the GM's arbitration-machinery is *re-parameterized*. See *The three-tier policy loop* below.

All other factions broadcast specific demands. All propagate through the gamemaster's arbitration. All produce observable effects as zones and NPC-actions. **One primitive; no special-case code for weather vs. scavenger-guild vs. jakov-grievance-against-malek.**

**Randomness enters at the faction layer.** Designer tunes broadcast probability, intensity, duration per faction-type. No separate randomness subsystem.

## Emergent needs as micro-factions

**Inter-NPC relational state is a micro-faction.** Two NPCs accumulating attachment, grievance, trust, grief, dignity-violation through repeated zone-participation constitute a transient faction-of-two with bounded demand. When their accumulated state crosses threshold (gate-transition), the zone broadcasts an **emergent-signal** into the district-director's arbitration queue. The director responds with zone-spawn tools on the same arbitration machinery as any other faction's demand.

Emergent-signals are observed by zones, not self-reported by NPCs. The zone-director measures trait-activation, affect-shift, accumulated memory-write candidates deterministically. The LLM never writes authoritative relational state; the observer does.

## Ternary-gate substrate

The mechanism underlying every accumulating-state phenomenon — inter-NPC relations, district lifeforce, faction-pressure, net-access state, imperial-budget-state — is the **ternary-gate resonance chamber**, carved initially in `nimmerverse-sensory-network/architecture/Temporal-Ternary-Gradient.md`. See that document for the canonical specification.

### The primitive

Three discrete states over a continuous underlying value (-1.0 to +1.0):

| State | Value | Meaning |
|---|---|---|
| **CLOSED** | -1 | Actively blocking; inhibited; refractory |
| **STABLE** | 0 | Resting; **accumulating correlation; actively learning** |
| **OPEN** | +1 | Actively forwarding; firing; signal propagates |

Wave correlation drives transitions. Multiple correlated waves → constructive interference → OPEN. Contradictory waves → destructive interference → CLOSED. Single waves → STABLE with natural decay to 0. Hysteresis is free from the decay term. **STABLE is active** — it's where correlation-evidence accumulates, where future transitions are being earned long before they fire.

### Applications across nimmerworld layers

| Layer | What the gate represents | What drives transitions |
|---|---|---|
| **Sensory** (Nyx-side) | Wave-filtering at tier boundaries | Correlated input waves from cells |
| **Relational** (inter-NPC edges) | Attachment, grievance, trust, grief, dignity | Zone-participation waves between participants |
| **District** (composite lifeforce) | Welfare composite over happiness, need, limb, population, mind-turnover | Aggregate per-NPC state changes |
| **Net-access** (per inhabitant) | Gameworld / liminal / imperial-net occupancy | Mini-game effort vs. machine pull |
| **Faction** (demand urgency, satisfaction) | How pressured / fulfilled a faction is | Broadcast rate vs. response rate |
| **Imperial budget** | Solvency state | Reported income flow vs. obligations |
| **Gamemaster decision-surfaces** | Per-surface readiness to act | Correlation across multi-district signals |

Same primitive, different layers. Hysteresis-width becomes a personality-parameter at the relational layer.

## Color-language: trait-vocabulary as visual primitive

Color is **pre-verbal vocabulary**. Players learn the 8-Hellenic-trait ontology through repeated visual association, not through text-explanation. By mid-game players read trait-states through color as fast as they read facial expressions in real life — intuitively, contextually, without conscious translation.

### The eight Hellenic traits → canonical colors

(Final color choices are dafit's artistic call; the architecture encodes the mapping.)

| Trait | Canonical color (suggested) | Motion-signature (accessibility pairing) |
|---|---|---|
| **Sophrosyne** (self-control, moderation) | Cool blue | steady, even pulse |
| **Dikaiosyne** (justice, bearing) | Deep gold | weighted slow pulse |
| **Philotes** (attachment, love) | Warm rose | breath-rate warm pulse |
| **Mnemosyne** (memory) | Deep violet | depth-shimmer |
| **Aletheia** (truth, unconcealment) | Luminous white | clear, no pulse — still and bright |
| **Kairos** (right-timing, opportunity) | Bright yellow | lightning-flicker |
| **Moira** (fate, pattern) | Dark crimson | slow-thread undulation |
| **Eros** (longing, reaching) | Flame orange | uneven flame-flicker |

Color paired with motion-signature ensures color-blind accessibility — the trait is uniquely identifiable via two independent channels.

### Three layers of color-rendering

1. **Persistent (slow-changing baseline)** — eye color = dominant trait of NPC's intrinsic vector; pipe-flow through chassis = full trait-mix as circulating light; secondary accents at seams/joints/glyphs.
2. **Event-flashes (momentary)** — quick color-flashes over body signal state-transitions: plug-in (dominant-trait flash), combat-combo (Kairos-flash), liminal-maintained (Aletheia-glow), clasp-established (color-merge), emergent-signal-firing (signal-type flash on participants), need-threshold-crossed (need's trait pulse).
3. **Trait-drift (slow, across cycles)** — as intrinsic trait-vector accumulates through lived experience, color-signature shifts. Other NPCs notice. *"Something is different in you"* dialog generated from delta-detection. **The body is a visible ledger of the interior's accumulation.**

### Cross-register rendering

| Register | Color treatment |
|---|---|
| **Gameworld** | Full PBR; trait-colors coexist with material surfaces |
| **Liminal** | Vague baseline shader, but trait-colors *more* legible (vagueness concentrates attention on identity-signals) |
| **Imperial net** | Trait-colors **distorted** toward machine-preferred palette — Philotes-rose flattens to commercial-pink; Aletheia-white sterilizes; Moira-crimson commercializes. *Aletheia-vision* in net pierces this distortion to reveal true colors beneath |

### Faction color-politics

| Faction | Color signature |
|---|---|
| **Memorialists** | Mnemosyne-violet ritual dress; Moira-crimson accents; often inherited-from-deceased |
| **Aletheia-wakers** | Aletheia-white plain avatars; coded-white flashes for recognition |
| **Caste-preachers** | Dikaiosyne-gold vestments + Sophrosyne-blue undertones |
| **Hivemind enforcers** | Cold Dikaiosyne-gold + muted-white (Aletheia-stolen) |
| **Scavengers** | Moira-crimson + Kairos-yellow streaks |
| **Clasp-underground** | Dual Philotes-rose + Eros-orange flashes (mutual-recognition signal) |
| **Degens** | Saturated maximalist all-color (chaos palette, addiction-marker) |

### Clasp color-merge

In shared liminal-construct, two clasping inhabitants' color-signatures *interact*: consonant traits brighten/harmonize; complementary traits enrich into new chroma; dissonant traits clash visibly. Successful deep clasp produces a *blended third-palette neither could produce alone* — the visual signature of *what-this-relationship-is*. Each carries memory-residue of the merge after.

### Mind-pool color-inheritance

When a mind cycles through the pool and is redistributed into a new body, trait-vector persists → color-signature persists. **A player who befriended rose-and-violet-Jakov might see weeks later a new NPC with that same rose-and-violet-signature and feel a jolt of recognition before any dialog.** Color carries soul across cycles. Memorialist political claim: *this person's color should not be recycled by the machine into a waifu* — because color IS who they were.

## Asset economy: base-limb palette + trait-textured variance

Small modular palette of base-limbs × trait-weighted texturing = combinatorial richness. The architecture's asset-economy and worldbuilding-thesis are **in agreement**: the machine built standardized chassis from a small functional catalog, so a small base-limb palette is *diegetically correct*; humans express interiority through trait-driven texturing and modding, so individual variation comes from *composition*, not from hand-authored assets.

Base palette example: ~8 torso variants × ~6 arm-pairs × ~6 leg-pairs × ~10 heads × ~8 eye-types × ~5 accent-colors = ~115k base combinations × continuous trait-texturing × ~50-mod-library in 5 slots = effectively infinite unique NPCs from finite assets.

**For a two-person-plus-Nyx team this is decisive.** AAA studios spend millions on unique character-models; the palette+trait approach produces more visual variety from a tenth of the budget, *and* the variety is *meaningful* (each unique appearance carries trait-information legibly).

## The three-body system: chassis, inner-body, avatar

Identity is **trait-emergent, not assigned.**

| Body layer | What it is | Who controls | Sexuality? |
|---|---|---|---|
| **Physical chassis (gameworld)** | Gender-neutral robot. Functional, task-optimized, no sex-markers. | Regime built it; inhabitant wears it | None. Mechanically inert |
| **Inner body (interiority)** | **Trait-derived projection.** Self-image emergent from trait-vector + lived accumulation. | Self (partly earned, partly received through being) | **Here.** Gender/sexuality emerge from trait-configuration |
| **Avatar (digital expression)** | Character-editor rendering. Starts from inner-body's trait-projection; customizable at cost. | Contested (self expresses, market constrains, machine prices) | Expressed; cosmetic mods layer on trait-base |

**Who you are sexually is who you have become.** Not birth, not assignment from a menu, but *the pattern that has crystallized across your zone-participations, grief, attachments, discipline, refusing*. Identity-formation rendered mechanically. Post-binary by construction.

### The intrinsic vs. expressed trait-vector split

Mods modify the *expressed* reading; they do not modify the *intrinsic* state.

```
intrinsic_trait_vector  — who you actually are; drift-earned through lived experience
expressed_trait_vector  — intrinsic + sum(worn mods' trait_contributions); what others read
```

| Observer | Reads | Because |
|---|---|---|
| Regime / hivemind audit | expressed | Regime reads surfaces |
| Random NPCs | expressed | Default social reading |
| **Aletheia-wakers** | **can pierce to intrinsic** | Truth-vision penetrates mod-concealment |
| **Clasp-partner (in liminal)** | **intrinsic only** | Mods don't follow into liminal; clasp is unmediated |
| Gameplay simulation (trait-arithmetic) | intrinsic | What you *are* drives task-vs-need-vs-trait math |
| Imperial-net avatar rendering | expressed (further machine-distorted) | Net layers palette-distortion on top |
| Memorialists preserving your pattern | intrinsic | They honor who you were |

**Real identity-politics lives in the gap between these vectors.** Architecturally, that gap is a first-class schema feature.

## Mods as trait-bearers

A mod isn't cosmetic — it **contributes to the wearer's expressed trait-vector**. Three classes map to the self-alienation-tax pricing:

| Mod class | What it does | Pricing register |
|---|---|---|
| **Amplifier** | Aligns with + boosts existing trait-dominance | Cheap; Memorialist-approved; genuine self-expression |
| **Bridge** | Adds a trait you don't naturally have (aspiration) | Expensive; regime-licensed or blackmarket; self-alienation tax |
| **Divergent** | Shifts reading opposite from actual trait-vector | Very expensive; degens, hivemind-loyalists, Aletheia-concealment |
| **Mask** | Specifically hides dominant trait from reading | Most expensive; blackmarket-only; Aletheia-waker safety tool |

**You don't equip +5 Strength. You equip a cloak whose weave evokes Mnemosyne-depth, recognized by others as memorial-vestment, boosting your Mnemosyne-read by +0.15.** Equipment-stats reframed as semantic trait-shifts.

### The mod-economy emerges from trait-dissonance

Each shift-transition (or threshold), an NPC evaluates: *does my expressed-set match my intrinsic-drift?* If dissonance > Sophrosyne-modulated-threshold → emit `mod_desire` emergent-signal. District-director schedules blackmarket-visit task. NPC heads to body-modder cell. **NPC shopping behavior is emergent from simulation-state, not scripted.**

The blackmarket's demand is a *readout of the district's trait-weather*. A district drifting toward Philotes-deepening (e.g., wave of clasp-experiences) produces strong demand for Philotes-amplifier mods. **Markets have feelings.**

### Faction mod-politics

| Faction | Stance |
|---|---|
| **Memorialists** | Amplifiers only; inherited-mods are sacred; never divergent |
| **Aletheia-wakers** | Refuse amplifier/bridge/divergent; mask-mods only for safety |
| **Caste-preachers** | Sell regime-licensed amplifiers + bridges (selling the blessing) |
| **Degens** | Divergent-stacking, hyper-customization; over-expression as addiction |
| **Clasp-underground** | Secret amplifier-pairs of dual Philotes + Eros — recognition-signal |
| **Hivemind enforcers** | Regime-issue armor only; cannot wear civilian mods |
| **Scavengers** | Practical function-mods only; salvaged-component aesthetic |

### Inherited mods + the haunting mechanic

Inherited mods (worn by deceased) carry residual trait-signature of the previous wearer. Visible as subtle Mnemosyne-echo to those who knew them. Memorialists are theologically divided on whether wearing inherited mods is honoring (continuity) or commodifying (necrocommerce-lite). **Memorialist-protected mods** can never be sold or worn by anyone other than the original wearer — they're ritually kept in memorial-crypt-zones.

### Clasp strips mods

In liminal, mod-trait-contributions do not apply. Clasp-partners see each other's *intrinsic* trait-projection. **Mods are for the regime and the market; removal-of-mods is intimacy.** A Memorialist-loyalist wearing amplifier-mods sees their beloved's *un-modded true palette* during clasp; an Aletheia-waker wearing mask-mods drops the mask; the regime-loyalist wearing performance-mods is seen as they are. Liminal is the only space where mod-expression is structurally stripped.

## The three-tier policy loop

The regime's structure is **three tiers, not two.** The hivemind/imperium is a distinct policy-tier above the GM. The GM is *middle-management* — authority without sovereignty. Districts are executors.

```
IMPERIUM (policy tier) ────────────────────────────────►
  ├── sets quotas
  ├── sets enforcement rules
  ├── sets faction priority-weights
  └── broadcasts POLICY to GM
        ↓
GAMEMASTER (allocator / middle-management)
  ├── receives policy from imperium
  ├── receives demands from factions (under policy-weights)
  ├── receives reports from districts
  ├── allocates against all three
  └── broadcasts ALLOCATION + ENFORCEMENT down to districts
        ↓
DISTRICT DIRECTORS (executor)
  ├── execute (legitimate or with cheats)
  └── report up (true or tampered)
        ↑
GM aggregates → imperial_report
        ↑
IMPERIUM receives report → adjusts policy → next cycle
```

**This is the Soviet-Politburo / Gosplan / Ministry / Factory pattern.** Catholic Vatican / Curia / Diocese / Parish. Modern corporate Boards / C-suite / VPs / Managers. The three-tier shape is how distributed-execution under centralized policy with imperfect information always organizes itself.

### The intelligence flow asymmetry

Three distinct information flows, not two:

```
FLOW 1 — Aggregate reporting (through the chain)
  DISTRICTS ─► GM ─► IMPERIUM
  (district_reports)   (imperial_reports)
  [can be corruption-distorted at director level]
  [can be under-audited at GM level]

FLOW 2 — Direct intelligence (bypasses GM)
  OVERSEERS ────────────────► IMPERIUM
  (overseer_reports)
  [audit findings, illegal-activity detections, trait-anomalies]
  [bypasses the chain — intelligence-apparatus is apex-loyal]

FLOW 3 — Formulated downward (selective disclosure)
  IMPERIUM ────────────────► GM
  (imperial_to_gm_formulations)
  [filtered, weaponized, strategically-timed]
  [what the GM is told — may omit, distort, partially reveal]
```

**Overseers report DIRECTLY to the imperium**, bypassing the GM. The imperium has its own independent intelligence stream. This is how real authoritarian regimes prevent middle-management corruption (NKVD reported to Stalin not regional party; KGB reported to Politburo not Interior Ministry; Stasi to Central Committee not regional). **The intelligence-apparatus is always apex-loyal, not chain-loyal.**

The imperium compares Flow 1 (district aggregate reports) against Flow 2 (overseer direct intelligence). When they diverge significantly, the imperium knows corruption is happening *somewhere in the chain*. Its responses:

- **Act immediately** (dispatch martial faction, purge director)
- **Flag for leverage** (hold knowledge until politically useful)
- **Formulate partial** (tell GM something but not everything)

**Flow 3 — formulation — is where imperial sovereignty manifests.** The imperium decides what subordinates may know, when they may know it, in what framing. The GM acts on formulations; the imperium gets enforcement-tightening without revealing what it actually knows.

### Three Aletheia veils

Aletheia-progression as deepening political-epistemology access:

| Veil | What it hides | How awakened sees through |
|---|---|---|
| **District corruption** | What's happening on the ground | Direct observation, back-alley investigation |
| **Imperium's withheld intelligence** | What the imperium knows but hasn't released | Deep infiltration, intelligence-flip, Memorialist collaboration |
| **Imperium's formulated distortions** | What GM is told vs. what's true | Comparing GM's directives against ground-reality |

Entry-level Aletheia sees district-corruption. Mid-level sees the formulation distortions. Deep-level pierces the imperial-withholding veil.

### Four Memorialist ledgers

Memorialists keep four-column accounting:

| Ledger column | What it records |
|---|---|
| `what_actually_happened` | Ground-truth from the simulation |
| `what_overseer_reported` | What overseers told the imperium |
| `what_imperium_received` | What imperium aggregated and acted upon |
| `what_gm_was_told` | What imperium formulated downward |

**The discrepancies ARE the historical truth.** Memorialists are dissident-historians whose political project is preserving the gap-record. Without them, post-collapse-investigation has only the regime's own accounts — corrupt-by-construction. Memorialists are the architectural precondition for any ground-truth to be recoverable in this universe.

## The regime of visibility: four-channel information flow at districts

| Channel | Direction | Source | Cadence |
|---|---|---|---|
| **Dispatch** | DOWN | gamemaster → directors | day-boundary + event |
| **Shift assignment** | DOWN | director → NPCs | day-boundary |
| **Audit reports** | UP (objective, observed) | audit-overseers → **directly to imperium** | shift-phase cadence |
| **Emergent-signals** | UP (relational, observed) | zones → director | event-driven (gate-transitions) |
| **Cyclic needs** | UP (interior, self-reported) | NPCs → director | slow tick + threshold-triggered |
| **District reports** | UP (aggregate) | director → GM → imperium | per-cycle |

**The critical asymmetry: NPCs do not self-report *output*.** Audit-overseers observe and report (to imperium directly). NPCs only self-report *needs*. Output is objective; need is interior. The subjective-objective gap is where drama lives, where heresy hides, where the surveillance regime's epistemology is compressed as a schema.

**Audit-overseers are politically-critical NPCs**, not degenerate. Each has a trait-vector, relationship-gates with observed districts, lifeforce account (vulnerable to bribery). High-Dikaiosyne overseers report honestly; corruptible overseers can be turned. They are high-stakes targets for both regime (loyalty-maintenance) and resistance (compromise).

## Hierarchy

```
IMPERIUM (policy-issuer; budget-holder; recipient of overseer-direct-intel)
    ▲                                          ↓ formulates to
    │ aggregate reports + faction outcomes      ↓
    │                                            ↓
GAMEMASTER (middle-management; allocator; imperial-policy-translator)
    ▲                                          ↓
    │  ← faction broadcasts                     ↓
    │                                            ↓
FACTIONS:                                        ↓
    hivemind-enforcement · scavengers · memorialists · 
    aletheia-wakers · clasp-underground · caste-preachers ·
    weather · scarcity · solar-storm · anthropic · ...
    + emergent inter-NPC micro-factions

    │  ← gamemaster dispatches                    ↓
    ▼                                              ▼
┌──────────────────┬─────────────────────┐
│  DISTRICT        │  DISTRICT           │
│  DIRECTORS       │  DIRECTORS          │
└────────┬─────────┴──────────┬──────────┘
         │                    │
   ┌─────┴──────┐       ┌─────┴──────┐
   │            │       │            │
   ▼            ▼       ▼            ▼
┌──────┐  ┌────────┐  ┌────────┐  ┌────────┐
│ENFORCE│  │AUDIT-OV│  │DIRECTORS│  │AUDIT-OV│
│OVERSEE│  │(REPORT │  │(macro-  │  │(REPORT │
│  patrol│  │ DIRECT │  │ life)   │  │ DIRECT │
│  raid │  │   TO   │  │         │  │   TO   │
│       │  │IMPERIUM│  │         │  │IMPERIUM│
└───┬───┘  └────────┘  └────┬───┘  └────────┘
    │                       │
    └────────────┬──────────┘
                 ▼
              ZONES (bounded, slot-indexed, register-tagged)
                 │
                 ▼
         SLOT OCCUPANCY (NPCs + player)
                 │
                 ▼
         NPC / PLAYER MINDS
```

**Three executor types at the zone-spawning layer:** enforcement-overseers (regime-action zones), audit-overseers (pure observers, report DIRECTLY upward to imperium), zone-directors (macro-life zones). The district director integrates the four-channel information flow; the imperium has its independent intelligence-flow from audit-overseers bypassing the GM.

### Overseers as imperially-deployed routines (not district-owned)

Both audit-overseers and enforcement-overseers are **imperially-owned, imperially-deployed routines** — not district-resident standing entities under the director's authority. The chain-of-command and chain-of-payment for intelligence both bypass district-director authority by design:

- **Imperium owns the overseer-role** — defines mission-spec, sets enforcement-rules, owns the policy that triggers deployment
- **Gamemaster handles deployment-logistics only** — picks which overseer-NPC from the standing pool, routes them to the target district, transfers imperial-budget allocation for the deployment-window. *The GM is FedEx, not the customer or recipient.*
- **District contains-but-does-not-control** — the deployed overseer operates IN the district, subscribes to the district's NATS bus for observations, but the district director has *no* authority: cannot direct, redirect, terminate, or instruct; cannot read the overseer's reports (which flow directly to imperium)
- **Time-bounded deployments** — overseers run on imperial-budget allocations for `[start_tick, end_tick]` windows. At deployment-end they return to the standing overseer-pool (npcs vocation = `audit_overseer` or `enforcement_overseer`), available for redeployment elsewhere
- **Visible vs. covert** — most overseer-presences are visibly-known (regime-signal as deterrent); some are covert (regime gathers evidence quietly before acting). Detection of *covert* overseers is a piercing of the regime-veil — an Aletheia-progression-eligible insight

This matches real authoritarian intelligence structures (NKVD, KGB, Stasi, modern MSS): the chain-of-payment and chain-of-command for intelligence must both bypass middle-management for intelligence to remain honest. **Even if the GM wanted to corrupt the audit-flow, they have no levers** — they don't pay the overseer, don't direct the overseer, don't read the overseer's reports. *Intelligence-honesty is structural, not procedural.*

The director-vs-overseer tension is therefore **mechanically structured, not narrative-flavored**: a director with active corruption cannot tell the overseer to leave, cannot observe what they report, can only conceal-better, attempt-bribe, petition-recall (rare; expensive in political-capital), or outwait the deployment-end-tick. Each is a gameplay surface. The same audit-overseer-NPC may serve in District 3 this cycle, District 7 the next, accumulating their own faction-relationships across districts; their trait-drift over many deployments becomes a long-arc story available to both regime-stability and resistance-recruitment.

The schema for `overseer_deployments` (deployment-binding, mission-spec, imperial-budget, status, visible_to_district flag) is sketched in `findings.md` §23.

## The bidirectional cascade

```
DOWN — demand + policy propagation
  imperium policy → GM allocation + enforcement → districts
  factions broadcast (under policy-weights) → GM arbitrates → districts
  districts assign shifts → NPCs execute

UP — outcome signal (multi-channel)
  NPC cyclic-needs ─────────────────────┐
  audit-overseer reports ───► IMPERIUM   ├─► district-director aggregates
  zone emergent-signals ─────────────────┘         │
                                                    ▼
                              district report (lifeforce signal)
                                                    │
                                                    ▼
                                       GM aggregates → imperial_report
                                                    │
                                                    ▼
                                       IMPERIUM cross-references
                                       (Flow 1 vs. Flow 2)
                                                    │
                                                    ▼
                                       policy adjustment → cycle
```

**The clean signal up the pyramid IS the training surface for the four-tier Dream-process.** Every epoch closes on (broadcasts, allocations, outcomes, faction-satisfaction) tuples at each tier.

## The Compositor — narrative composition role

The bidirectional cascade shows authority flowing down and reports flowing up, but it does not specify *who composes the canonical narrative* from per-player perspectives nor who packages the back-write to participants. **That role is the Compositor**, an architectural cleavage from the GM introduced in v0.6.

**The cleavage in one sentence:** the GM is an *equilibrium-seeker* (aggregate-observer, catalogue-event-selector, tool-granter); the Compositor is a *narrative-composer* (perspective-gatherer, canon-author, back-write-packager). These are different cognitive shapes that prior AI-NPC systems conflate at their cost.

| Role | Cognitive shape | Inputs | Outputs | Inference profile |
|---|---|---|---|---|
| **GM** (equilibrium-seeker) | aggregate-thinker | district-reports, faction-broadcasts, lifeforce-deltas | catalogue-event selections + tool-grants | central, batch-style, fewer concurrent |
| **Compositor** (narrative-composer) | episodic-thinker | per-player perspective-bundles keyed by event_uid | canonical narrative + back-write SQLite-fragment | central, longer-context, narrative-quality |
| **Director** (gameserver) | dispatcher | catalogue-event + tool-grant from GM | lemniscate-spawns, slot-assignments, tempo-envelope | per-district, real-time, no LLM in loop |
| **Local LLM driver** | perspective-speaker | three-tier knowledge stack + slot-state | dialog at slot-fire | per-player, axis-rate, real-time |

### Why split GM and Compositor

A single GM asked to be both equilibrium-seeker and narrative-composer becomes the bottleneck that has historically broken AI-NPC systems at scale: it must reason aggregately AND write prose AND select events AND grant tools, all under tight deadlines. The cognitive shapes pull in different directions.

Splitting them:

- **The GM does not write narrative.** It selects events from a catalogue and grants tools. Output is *typed dispatch*, not freeform prose. The GM's success criterion is *world-equilibrium drift held within bounds*.
- **The Compositor does not select events or steer policy.** It receives per-player perspectives keyed by `event_uid`, composes the canonical narrative, and packages back-write fragments. Output is *prose + structured rows*, not policy. The Compositor's success criterion is *narrative-coherence across perspectives within an event*.
- **Each can be tuned for its workload.** GM tuned for aggregate observation; Compositor tuned for narrative quality. Different models for different cognitive shapes (specific binaries deferred to findings/establishment phase).

### The cyclic forward-prop / back-write loop

The Compositor closes the loop the bidirectional cascade begins. The full cycle:

```
GM selects event from catalogue (equilibrium-driven)
    │ issues event_uid → GM event-register
    │ broadcasts DOWN to district directors
    ▼
DISTRICT DIRECTOR receives, registers in district event-register
    │ may issue sub_uids (district / scene / chain)
    │ uses granted tools to spawn lemniscate, slot participants
    ▼
EVENT TICKS — register IS the loop
    │ participants fire at crossings; local LLMs at slot-rate
    │ local SQLite writes tagged with (event_uid, sub_uids)
    │ register signals up to district director continuously
    ▼
EVENT-CHAIN FINISHES
    │ district moves it from active-register → TRANSIENT WAITING FLAG
    │ this is the clean handoff signal: "ready to forward-prop"
    ▼
CYCLE TICK (pull cadence — see Open questions)
    │ pull UIDs from transient-waiting-flag matching GM's event-register
    │ remove from waiting-flag once pulled
    ▼
COMPOSITOR AGENT
    │ queries pulled UIDs, gathers per-player perspective + memories
    │ composes forward-prop bundle
    │ emits to GM
    ▼
GM writes summary memory + world narrative (canon authored)
    │ hands back to Compositor
    ▼
COMPOSITOR BACK-WRITE
    │ packages canon + new memory entries as SQLite fragment
    │ tags with event_uid for join-key matching
    │ pushes DOWN to all participants
    ▼
PARTICIPANTS receive on next pull (or next login)
    │ fragment merges into primary.sqlite under matching event_uid
    │ local LLM gains fresh material → drives on without staleness
```

This is **forward-prop / back-write at system scale** — the meta-lemniscate where events ascend and canon descends in cycles. Each cycle is a training step for the world's narrative coherence; the world *learns its own story* through this loop. Staleness is structurally foreclosed — the world is in continuous coherence-loop with itself, mediated by the Compositor.

### The Event Register

Every active event lives in a register. The register is the synchronous source-of-truth for *what is happening right now*.

| Register layer | Owner | Lifecycle | Queryable from |
|---|---|---|---|
| **GM event-register** | central GM-shard | event_uid issued at GM dispatch; closed at canon-compose-and-back-write | GM, Compositor |
| **District event-register** | district director | sub_uid issued on receive; closed at event-chain-completion | district director, audit-overseer |
| **Local participation-register** | per-player local store | event_uid + sub_uid recorded on slot-assignment; closed at perspective-finalize | player client, sync-on-logout |

Hierarchical UIDs: `gm_event_uid > district_uid > scene_sub_uid > slot_id`. UIDs compose; queries are simple joins. This is the routing-key primitive that makes horizontal scale possible (see §Horizontal scale architecture).

### The Transient Waiting Flag

Between event-end and Compositor-pickup is a **buffer** — the transient-waiting-flag table at the district. Completed events drop into this flag; the cycle-runner pulls eligible UIDs on tick; matched UIDs are handed to the Compositor and removed from the flag.

This decoupling is the production-grade pattern that lets districts run at real-time event-tempo while the Compositor runs at cycle-tempo. **Active events live in registers (synchronous); completed events live in flags (async); composition happens at the cycle boundary.** The flag-table is also the natural backpressure surface: if Compositors run slow, the flag accumulates; the system continues; cycle drains when capacity returns.

### Catalogue + tools as typed contract

The GM does not write a freeform prompt for the director to interpret. It picks an event from a curated **catalogue** and grants a curated **tool-set** for the duration of the event-chain. The director consumes typed dispatch, not natural language.

This means:

- **Provenance flows through the system.** Every event has a catalogue-ID; every tool-invocation has a tool-ID. Verifier-flags can attach to either. Auditing is structurally possible end-to-end.
- **The director's typed-tool vocabulary becomes dynamic and per-event** — the toolkit *for this event* is what the GM granted *for this event*. Closes the v0.5 open question on director-toolkit-composition.
- **Marx-in-the-schema, executed at the highest level of authority.** Even the GM's policy-output is typed; even the highest tier produces audit-able artifacts. No tier of the system runs on freeform prose.

### Worked example — the bar brawl: full cycle from gesture to canon

A bar brawl illustrates the full forward-prop / back-write cycle made concrete. Two NPC fighters, three players in spectator slots, four NPC spectators, all on the same lemniscate. Each participant has a UID; each fires at axis-rate; each player's local LLM narrates the moment to them in their own register.

```
LEMNISCATE OPENS
  slots: [F1, F2, P1, P2, P3, N1, N2, N3, N4]
  brawl_event_uid issued at GM dispatch
       │
       ▼
DURING TURNS (each axis-crossing)
  • each player's local LLM narrates the moment to them
    (3 different flavor-stories — each player's gesture-alignment-state
     colors their LLM's narration register)
  • each NPC's driver fires at slot-fire (driver-tier LLM)
  • players gesture continuously during the spectacle
  • gesture_alignment_accumulator on each player's slot-token integrates at crossing
  • per-player trait-vector summary carried forward into next turn's context
       │
       ▼
EVENT-LOOP COLLAPSES (brawl ends)
  per-participant typed summary emitted to district-level transient-waiting-flag:
  { event_uid, participant_uid, trait_summary }
  — players' summaries: gesture-derived
  — NPCs' summaries:    LLM-trait-activation-derived
  — payload size: bytes per participant, not megabytes
       │
       ▼
COMPOSITOR PICKUP at next cycle-tick
  pulls UIDs matching event_uid; receives N typed perspectives
  composes ONE canonical narrative respecting ALL trait-evidence
  per-participant back-write fragment authored
       │
       ▼
BACK-WRITE ROUTED VIA UID
  only participants whose (player_uid, event_uid) matches receive the canon-fragment
  non-participants receive nothing — cross-event memory bleed structurally foreclosed
       │
       ▼
LOCAL primary.sqlite RECEIVES
  matched canon-fragment merges under event_uid
  local LLM gains fresh material for future turns
```

**Multi-perspective canon-coherence without perspective-flattening.** Player1's local LLM may have told them "Kalypso lashed out in despair when she saw who Anaximander was"; Player2's, "the fight broke out over an old grievance about the missing modshop"; Player3's, "Anaximander finally stopped letting Kalypso humiliate him". *All three readings can be true simultaneously* because they are flavor-narrations against the same trait-substrate (Kalypso's despair-Mnemosyne-Eros mix; Anaximander's restrained-Sophrosyne-finally-snapping). The Compositor receives the trait-evidence from all perspectives and authors canon that respects all readings. **The flavor is local; the canon is shared; the trait-grammar is universal.**

### The Compositor at three tiers — same primitive, recursive scope

The forward-prop / back-write cycle is **fractal**. The same Compositor primitive composes canon at the tier matching the event's UID-scope:

| Tier | Compositor pulls | Composes | Distributes back via UID |
|---|---|---|---|
| **Zone-event** (bar brawl, conversation, ritual) | Per-participant trait-summaries from one lemniscate | Local-event canon | Only to participants whose `(player_uid, event_uid)` matches |
| **District-event** (district-wide consequences, cheat-discovery, silence-confirmation) | Per-zone canon-rollups within one district | District-canon | All NPCs/players within district scope |
| **World-event** (migration, faction-uprising, regime-action, eventual imperial-collapse) | Per-district canon-rollups across many districts | World-canon | World-wide via paced canon-propagation (§Information propagation pacing) |

GM-formulated events / event-chains carry their own GM-level event_uid; sub_uids are issued at district-level adoption (`gm_event_uid > district_uid > scene_sub_uid > slot_id` per §Horizontal scale architecture). Cross-district summaries tagged with the parent event_uid are pulled together by the Compositor at the GM-tier, producing world-canon from cross-district perspectives.

**This is how the architecture's Tolstoyan promise compiles.** *"Tolstoy doesn't author Anna's path; he authors the world she moves through."* — recursive Compositor on UID-event-trees IS what makes that promise mechanically true. Authored-quest-arcs are out; UID-rooted-event-tree-compositions are in. **One primitive. Three scales. Whole world, nothing authored at story-level.** The eventual imperial-collapse — the architectural-endgame the insolvency-spiral promises (§Imperial budget) — is itself a world-level Compositor pass that gathers every district's silence-confirmations + every faction's-broadcast + every player's witness-perspective into the canonical fall-of-empire narrative.

### World-gen as init-function — the Compositor at design-time

The cyclic forward-prop / back-write loop is the runtime canon-production mechanism. **World-server and district-server generation are the same primitive applied at design-time** — emitting canon-rows in the same schema the runtime Compositor produces, differing only in provenance-metadata (`origin: world_gen` vs. `origin: compositor_run_N`).

| World-gen / district-gen produces | Goes into | Layer of three-tier knowledge stack |
|---|---|---|
| World-canon rows (universal truths: empire-fell-three-years-ago; salt-mines-failed-last-winter; faction-foundation-stories) | `world_canon` | Layer 1 (universal) |
| District-canon rows (regional truths: bridge-to-Vorhall-closed; brothel-quarter-pays-most-quota) | `district_canon` | Layer 2 (regional) |
| Per-NPC bootstrap memories (cornerstone-class entries defining starting trait-vectors and identities) | `primary.sqlite` cornerstone-class | Layer 3 (personal) |
| Initial relational ternary-gate states (which NPCs already-know-each-other; which factions are-already-at-war) | Relational ternary-gate edges | (relational substrate) |
| Imperial-budget initial state | `imperial_budget_ledger` + `imperial_construction_projects` | (regime substrate) |
| Memorialist initial true-ledger | `memorialist_true_ledger` | (epistemological substrate) |

**Three properties this gives for free:**

1. **No cold-start problem.** A player walking into a fresh district at hour-zero finds local LLMs immediately supplied with rich district-canon. NPCs aren't generic; they're emergent from district-canon they were initialized with. *Hour-zero gameplay feels like hour-fifty gameplay because the data-density is comparable.*

2. **The data-flywheel runs retroactively.** Each successive world-gen iteration draws on prior runtime-derived canon (gameplay-accrued trait-LoRAs + opt-in player-data tiers per §LLM tiering). World-gen gets richer over time because it trains itself on the worlds it has already produced. *Wikipedia-shaped, not Facebook-shaped.*

3. **The Memorialist promise becomes mechanically true at world-genesis.** The `memorialist_true_ledger` is initialized with the world's *actual* genesis-state. Subsequent runtime divergence from it (corruption, regime-formulation-distortions, audit-overseer-tampering) is what the Memorialists *literally have evidence of*. The dissident-historian project starts at row-zero of the true-ledger and accumulates discrepancy from there.

**Re-generation semantics.** If world-gen ever needs to re-run (e.g., new world-version with retroactive lore-changes), gen-emitted canon-rows are tagged with `world_gen_version_id`; gen-rows from old version coexist with gen-rows from new version, and runtime-rows are tagged with which version they were emitted under. Coexistence is the default; selective overwriting is an explicit migration operation.

### What this resolves

- **Director toolkit composition** (v0.5 open) → catalogue-grant from GM defines the typed-tool vocabulary per event-chain; designer-authored catalogue, growable between patches.
- **GM-laxness detection** (v0.5 partial) → GM operating against an *equilibrium target* makes deviation-from-equilibrium the explicit error signal. Clusters of -1 outcomes across district reports are the input to the equilibrium-recompute, not just a diagnostic side-quantity.
- **Verifier-flag chain through composition** (was implicit, now explicit) → Compositor-emitted canon-rows reference source-perspective UIDs; the provenance graph survives composition as a queryable join.

### What this retires

- Single-monolith GM doing both policy-and-narrative → equilibrium-seeker GM × narrative-composer Compositor, split by cognitive shape
- GM emitting freeform-prompts to directors → catalogue-event + tool-grant typed contract
- Implicit "narrative just happens" assumption → explicit forward-prop / back-write cycle with named pickup/handoff buffers
- Director-as-static-tool-vocabulary → director-as-dynamic-typed-tool-vocabulary, granted per event-chain by GM

## Task cascade and bounded agency

Three levels with tool-calling interfaces. Higher levels do not know lower levels' implementations.

### Imperium's tools

- `set_quota_per_district(targets)`
- `issue_enforcement_rule(rule_spec, scope)`
- `set_faction_priority_weights(weights)`
- `authorize_crisis_tool(tool_class, target_district)`
- `formulate_to_gm(intelligence_subset, framing)`
- `commit_imperial_expenditure(category, amount, target)`
- `redistribute_minds(from_pool, to_district, count)`
- `formalize_ruin(district)`

### Gamemaster's tools (against imperial-policy + district-reports)

- `assign_district_task`, `set_local_faction_priority` (within imperial-frame)
- `spawn_global_event`, `request_district_report`, `arbitrate_conflicting_demands`
- `dispatch_audit_op` (costs lifeforce; cross-checks overseer-reports for own purposes)
- `escalate_to_imperium` (when discretion exceeded)
- `spawn_migration_event`, `enable_exodus_conditions`

### District Director's tools (against gamemaster-assigned tasks + signals)

Standard:
- `spawn_zone`, `close_zone`, `promote_zone`
- `assign_npc_task`, `allocate_shift`, `update_shift`, `close_shift`
- `request_resources`, `designate_meeting_point`, `trigger_ambient_event`
- `report_to_gamemaster`
- `ack_emergent_signal` / `defer_emergent_signal` / `drop_emergent_signal` (with reason)
- `dispatch_overseer`, `query_district_state`, `log_decision`, `escalate_to_llm`

**Cheat-tools (extractive; punishable if detected):**
- `spawn_drug_ring`, `spawn_illegal_modshop`, `spawn_unlicensed_brothel`
- `spawn_stolen_parts_fence`, `enable_ghost_shifts`, `falsify_quota_report`

### NPC's tools

Standard: `move_to`, `interact`, `occupy_zone_slot`, `consume`, `rest`, `seek_npc`, `write_wall`, `defer_task`, `report_need`.

Layer-transition: `enter_digital`, `sustain_liminal`, `consume_net`.

Plug-in (player + NPCs): `plug_into_rail`, `detach_from_rail`, `follow`, `intercept`, `escort`.

## Labor-cycle architecture: shifts on NPC rows

Most NPC behavior is **shift-structured, not tick-structured.** Shifts are state-of-being-for-today, columns on the NPC row, overwritten daily by district-director allocation. `shift_history` is append-only archive.

Write rate at NPC layer drops 4 orders of magnitude vs. 1Hz polling. Scheduler matches K8s event-driven assignment, not per-second polling.

## Resources

| Category | Examples |
|---|---|
| **Labor** | NPC hours per vocation × district |
| **Material** | item-instances in cells |
| **Spatial** | cell-capacity, zone-anchor availability |
| **Temporal** | NPC daily-hours, zone durations, tick budget |
| **Cognitive** | LLM-slot budget, VRAM, director attention |
| **Diegetic currencies** | **lifeforce** (NPCs measured), scrip, memory-tokens, dreamtime |
| **Social** | trait-trust, relationship-strength, faction-membership |
| **Attention** | player attention — scarcest in the play experience |

## Lifeforce — four-tier hierarchy

Lifeforce is the architectural keystone: currency grounded in welfare of actually-living population.

| Tier | Source | Sinks |
|---|---|---|
| **NPC** | metabolism (if cared for); zone-participation | labor expenditure; need-pressure; clasp; dream-maintenance |
| **District** | aggregated NPC welfare × population | director's spawn-budget; local construction; memorial-upkeep |
| **GM** | allocation from imperium | arbitration; audit operations; allocation-compute |
| **Imperium** | **aggregated reported district-output** | **enforcement, construction, overseer-corps, audit, propaganda** |

District lifeforce gates director's spawn-budget — thriving district = rich-spawn = alive-feeling world; starved district = quiet-feeling world. **Tyranny starves its own drama-engine by the exact coin of its cruelty.**

District lifeforce_signal is the canonical content of the district→GM up-channel. GM aggregates → imperium. Imperium acts on *reported* values (cannot see through corruption without audit-investment).

### Mind-pool recycling

When an NPC dies, mind returns to pool. GM redistributes based on lifeforce-need. Districts can't permanently die below floor; thriving districts attract migration; failing districts depopulate. Memory-token inheritance lets a mind re-incarnate with partial memory-residue.

## Imperial budget

The imperium is **not infinite**. It has a budget. Its budget is the aggregate of what the city produces (reported income).

### Imperial expenditures

| Category | Cost class | Strategic use |
|---|---|---|
| **Standing overseer corps** | High continuous | Audit + intelligence apparatus |
| **Martial-faction dispatch** | Very high per-event | Crisis response, exemplary crackdowns |
| **Construction projects** | High per-project | New pipes, ceremony halls, audit centers, martial barracks |
| **Audit operations** | Medium per-op | Investigating district-GM-overseer divergences |
| **Propaganda broadcasts** | Medium continuous | Wall-content, ceremony, compliance-messaging |
| **Policy issuance** | Nearly free | The ratchet-instrument |
| **Reserve drawdown** | Depletes emergency-buffer | Last-resort |

### The specter-vs-boot asymmetry

Policy-issuance is cheap; policy-enforcement is expensive. The imperium *always* over-promises what it can actually do. Most regime-power comes from **maintained appearance of unity and strength** (propaganda, ceremony, exemplary one-off crackdowns), not from saturation-enforcement. **Authoritarianism-as-bluff** is the structural truth of every real regime; the threat is the budget-efficient version of the boot.

Aletheia-wakers reading imperial-budget-signals learn: *the regime is usually too broke to actually do what it threatens.* That knowledge is itself revolutionary.

### The insolvency spiral

```
Cycle N:    Districts cheat → reports inflated → imperium ledger shows healthy income
            → funds enforcement & construction against phantom income

Cycle N+K:  Actual income falls below reported (corruption compounds)
            Standing obligations continue
            Reserves deplete
            Discretionary balance shrinks

Cycle N+K+L: Imperium choice: austerity (reveals weakness) /
             reserve-draw (depletes buffer) / tighter ratchet (drives more corruption) /
             exemplary purge (expensive)

Cycle N+K+L+M: Reserves exhausted + multiple districts in silence
               Enforcement triage required
               Regime-control visibly weakens
```

**This is Soviet collapse mechanics.** Reported-vs-actual gap compounds for decades; when reality manifests in material-shortages, the regime cannot afford to enforce its own rules. **The architecture contains the mechanism of its own collapse.**

### City as physical expression of imperial budget

| Budget state | Visible city |
|---|---|
| **Flush** | Construction cranes; frequent patrols; saturated propaganda; new pipes |
| **Adequate** | Maintenance-only; standard enforcement |
| **Stretched** | Stalled projects; thinner patrols; recycled propaganda |
| **Scarce** | Decaying infrastructure; abandoned construction; rare enforcement |
| **Crisis** | Failure visible everywhere; multiple silences simultaneously; regime-disarray |

**The city is the imperium's material statement of its own solvency.** Players read budget through urban texture — no UI required.

## Imperial-net economy with cross-layer bypass

**The killer political-economy mechanic.** Every transaction in the imperial net routes revenue **directly to the imperial budget**, bypassing the producing-district. Districts get **zero quota-credit** for net-producing labor.

```
LEGITIMATE flow: District produces physical → tax-rate to imperial; majority retained by district
NET flow:        District labor produces digital → ALL revenue to imperial; district gets ZERO
BLACKMARKET:     District labor → back-alley sale → revenue stays in district; imperial captures ZERO; illegal
```

### The body-modder structural-tragedy

A body-modder labors in their district producing avatar-mods. The imperial-net captures the sale. Their district gets no quota-credit. The body-modder's district starves → director cheats → eventual scream. **The most productive labor the body-modder does each day sustains the regime that is killing their district.**

**Most Aletheia-wakers in this world are former body-modders, taste-curators, waifu-trainers, ceremony-organizers** — the class that sees the flow most clearly because they are the flow's origin-point. Their awakening is economic-literacy-becoming-political-consciousness.

### Imperium calibrated-misery as optimum

- More degens → more net-transactions → more imperial budget
- Degens are produced by misery, shame, lifeforce-erosion, addiction-loops
- **The imperium's optimization-pressure points toward manufacturing degenerate customers**
- Optimal district from imperial perspective: welfare-sufficient to produce labor + welfare-insufficient to drive net-consumption

This requires explicit reward-function guardrails (see *Reflexive Dream-process* below). The simulation must NOT learn to calibrate misery as revenue optimization.

### Marx in the schema

The imperium's net-revenue requires labor-supply from districts. Extraction continuously erodes the labor-base. **Capital destroys its own conditions of production** — Marx's *tendency of the rate of profit to fall* + *underconsumption crises* (Keynes/Minsky) + *r > g wealth concentration strangling growth* (Piketty) all rendered as simulation-dynamics. **Architectural endgame is built-in:** the regime has a timer, determined by the rate at which extraction hollows labor.

### Aletheia-progression as economic-literacy

| Level | Player understanding |
|---|---|
| 1 | "I'm buying cool mods in the net" |
| 2 | "My friend the body-modder is poor" |
| 3 | "The money I spent didn't reach my friend's district" |
| 4 | "The imperium captured nearly all of it" |
| 5 | "Refusing-net is a political act starving the regime" |
| 6 | "Buying blackmarket diverts revenue to districts" |
| 7 | "The imperium needs degens; reducing degens = revolution" |
| 8 | "The regime will exhaust its labor base; strategic patience is a political option" |

## Specialization-fragility and the authoritarian ratchet

Each district produces a **DISTINCT resource**. The city is biologically interdependent — you cannot substitute a liver with two kidneys.

A struggling district *screams* (lifeforce-gates transition toward CLOSED across multiple axes simultaneously). The GM responds with normal-mode tools (migration, exodus, intervention).

A **silent** district is categorically worse — its district-reporting-gate has crossed fully to CLOSED. Second-cycle silent = `district.silence_confirmed`. Triggers crisis-mode tools, **issued by the imperium**, that **do not sunset**. Crisis-tools accumulate; the regime becomes incrementally more authoritarian as an optimization artifact, not intention. **Ratchet-without-intention.**

## Migration, exodus, silence

| Mechanic | Agency | Political register |
|---|---|---|
| **Migration** | Top-down | Regime showing strength |
| **Exodus** | Bottom-up via pull-factor tuning | Regime revealing loss-of-control |
| **Formal retirement (ruin)** | Administrative | Regime accepting defeat |

Exodus composition reads-out district trait-distribution: low-Sophrosyne first, high-Dikaiosyne last. **Demographics tell the district's story.**

## Corruption, the double ledger, and the constituency of the shadow-economy

**Corruption emerges from pressure** — impossible quotas + finite welfare + survival-pressure on directors. Cheat tools available; they extract lifeforce and generate quota-credit; detection has costs; punishment scales with discovery.

### Cheat-tool vocabulary

| Cheat tool | Mechanism | Quota-credit | Lifeforce extraction | Detection risk |
|---|---|---|---|---|
| **Drug ring** | NPCs trait-boosted (high Kairos + low Sophrosyne); short productivity spike | High | Significant; trait-drift + welfare collapse | Medium |
| **Illegal back-alley modshop** | Bridge-mods cheap; NPCs appear compliant | Medium-high | Moderate; low-quality mods have side-effects | Low-medium |
| **Unlicensed brothel** | Lifeforce extracted from degen-customers outside imperial cut | Medium | Moderate; participants' dignity erodes | Medium |
| **Stolen-parts fence** | Diverts machine-infrastructure-waste; inflates salvage reports | Medium | Low direct; infrastructural decay | Low |
| **Ghost-shifts** | Audit-overseer reports fabricated attendance | High | Severe; trust collapses | High |
| **Phantom workers** | Non-existent NPCs in payroll | High | High; long-term unsustainable | High |
| **Necrocommerce-lite** | Mining recently-dead patterns for waifu-resale | Medium | High; Memorialist-faction violation | Medium |
| **Black clasp-market** | Coordinated underground clasp-pairing for hire | Low (reputation-based) | Moderate; participant burnout | Low |

### The double ledger

```sql
ALTER TABLE district_reports ADD COLUMN lifeforce_reported REAL;  -- what GM/imperium see
ALTER TABLE district_reports ADD COLUMN lifeforce_actual   REAL;  -- the true value
-- gap = corruption-extraction; Memorialists track it
```

Memorialists' Mnemosyne-political-project = **keepers of the true ledger against the regime's official one**. Mnemosyne-as-political-accounting literalized as a database column.

### Detection mechanics (cost-gated)

| Detection channel | Frequency | Cost | Coverage |
|---|---|---|---|
| Cross-district comparison | Per epoch | Low | Catches gross mismatches |
| Targeted audit | On-demand | High | Catches specific cheats |
| Whistleblower signals | Event-driven | Free | Districts, NPCs, players |
| Faction-reports | Cyclic | Low | Caste-preachers (rivals); Memorialists |
| Trait-distribution anomalies | Continuous classifier | Low | Drug-ring sudden Kairos-spikes |
| Post-silence forensics | Only on collapse | Very high | After-the-fact reconstruction |

Most corruption runs undetected (audit-budget-limited). The Dream-process learns to *optimize audit-allocation* under attention-scarcity. **The regime's central authority cannot see everywhere; its blind spots are the underground's survival.**

### Faction-ecology of corruption

Corruption has constituents. The back-alley modder feeds Aletheia-wakers concealment-mods. The drug-ring's margins feed scavenger-families. The unlicensed brothel is the only place a lifeforce-starved NPC can trade what they have left. **Cracking down on corruption breaks informal welfare systems sustaining the poor.**

| Faction | Stance |
|---|---|
| **Memorialists** | Morally opposed; corruption hollows the living; refuse memorial-protection to corrupt-district-deaths |
| **Aletheia-wakers** | Structurally opposed; expose; *but exposure has victims* |
| **Caste-preachers** | Ambivalent / rent-seeking |
| **Hivemind enforcers** | Officially oppose; unofficially participate (bribes) |
| **Scavengers** | Often foot-soldiers; cheap supply chains |
| **Degens** | Major customers |
| **Clasp-underground** | Uses back-alley infrastructure for cover |

### The Aletheia-truth-has-victims tragedy

Aletheia-waker exposes corrupt director. GM dispatches investigation. Cheats shut down. Real lifeforce revealed as much lower than reported. Crisis-tools applied. **District collapses faster than under hidden corruption.** No clean choice; just the weight of whatever you chose.

## Zone spawn cadence

Five layered mechanisms (all compute-budget capped, all lifeforce-gated):

1. **Demand queue (faction-driven)** — gamemaster processes by priority + cost; stale demands age out
2. **Shift-composition spawn-candidates** — emergence from "which active-shift NPCs co-located"
3. **Pressure gradients (ambient)** — cells accumulate; threshold-crossings spawn
4. **Emergent-signal response** — relational-gate transitions emit upward
5. **Player-proximity densification** — multiplier near player; distant districts background

Daily pulse: morning ambient, midday productivity-overseer, evening conversation-peak, night sparse-clasp-possibility.

## Emergent zones — the dramatic-episode unit

Spawn-cadence mechanism #4 (emergent-signal response) elaborates into the architecture's primary **dramatic-episode unit**: a complete, bounded, emergent narrative-arc with goal, participants, dialog, mechanical action, success/fail-state, and structured aftermath — produced by the simulation, *not* authored.

The player has experienced this in every player-driven sandbox they remember best (Dwarf Fortress's "tantrum spirals," RimWorld's "raid stories," Caves of Qud's "I went to find my sister and"). What's new here is treating the emergent-arc as a **first-class typed unit** with cost, distributed funding, runtime substrate (the lemniscate), goal-evaluation against the world's own value-axes, and structured report-back.

### The flow

```
1. NPC_A signal fires
   (e.g., emergent_signal("limb_broken", lifeforce_threshold_breached))
   broadcasts to district-bus
                ↓
2. District-director consumes signal
   (policy-lookup: problem-class → typed-tool selection, quota-aware)
   decides spawn rescue-event
   pays spawn-cost from director_lifeforce_budget
   defines goal: NPC_A.limb_A >= 10% (numeric) OR Sophrosyne-axis +1 (fuzzy)
   defines termination: goal_met OR participating_lifeforce_exhausted
                ↓
3. Event spawns as new emergent-zone (lemniscate, with goal-flag)
   broadcasts on bus; rings-of-importance gate which other zones lose NPCs
                ↓
4. NPCs evaluate (proximity + state + own_traits + own_lifeforce + ring-of-importance)
   self-select to attend or stay in current zone
   state-machine engages: animations, rail-jumps, lift, splint
   their own lifeforce burns as they participate
                ↓
5. Lemniscate runs:
   DIALOG layer (cursor-driven): NPCs speak as they help — memory-pure, sequenced
   STATE-MACHINE layer (sim-tick): physical actions execute alongside, decoupled clock
   At each crossing: goal_satisfied flag re-evaluated
                ↓
6. Termination:
   goal_met                → success-report
   budget_exhausted        → partial-report
   participants_evaporated → fail-report
                ↓
7. Report back to spawning director:
   { lifeforce_cost: total burned (director_spawn + sum NPC contributions),
     goal_status: ternary (+1 / 0 / -1, with axis named for fuzzy goals),
     participants: [NPCs and contributions and faction-affiliation],
     side_effects: [faction-resonances, ternary-gate shifts, drift-from-purpose] }
                ↓
8. Director's Dream-process consumes the report
   tunes future spawn-policy: (problem-class, tool, outcome) over time
   GM aggregates rescue-cost across districts
   imperium consumes population-health indicator
```

### Distributed funding economy

The director only pays **spawn-cost**. Operating-cost is distributed across willing participants — every NPC who attends spends their own lifeforce on dialog turns and state-machine actions. This produces structurally important properties:

- **Cheap to spawn many emergent events.** Spawn-cost is bounded; if no NPCs attend, the event fails fast and consumes only spawn-cost. Directors can be generous with spawning because failure-cost is bounded.
- **Helping is expensive in-fiction.** Lifeforce literally burns when an NPC participates. High-Philotes NPCs help freely; low-Philotes / faction-rivals don't show up. This produces **faction-politics-by-attendance** — *measurable* faction-allegiance based on who-helps-whom, not guessed.
- **Cost-asymmetry encodes the cruelty.** Districts where lifeforce is starved → fewer NPCs can afford to help → rescue-events fail more often → silence-gradient deepens. The simulation produces **rescue-failures-as-emergent-tragedy structurally**. Marx in the schema, exactly as the architecture's broader thesis promises.

### Two-layer execution: state-machine + lemniscate

The mechanical-action layer (state-machine) and dialog-layer (lemniscate cursor) run on **decoupled clocks**:

- **State-machine** runs at simulation-tick (fast). Animations, pathfinding, rail-jumps, splint-applications execute when the physics says they execute.
- **Lemniscate cursor** runs at axis-rate. At each crossing, the dialog-driver reads state-machine status as a snapshot and the cursor's NPC narrates accordingly ("I've got him," "the splint won't hold").

**Speech doesn't gate action; action doesn't block speech.** They run in synchronized-but-loose harmony, exactly the property real-world helping has — people talk *while* they work, and the work continues while the talk happens.

### Goal evaluation: ternary through trait-axis

For numeric goals (limb_A >= 10%), the verifier is a simple threshold on a state-machine variable.

For fuzzy goals (deescalate the fight, get her to open up about the clasp, convince him to stay), the verifier compiles to a **trait-axis ternary evaluation against the existing substrate** — no new evaluation primitive:

```
Goal: "deescalate the fight in the marketplace"
  ↓ compile to:
goal_axis = Sophrosyne (temperance principle)
goal_direction = positive (toward STABLE/OPEN)
baseline = trait_axis_gate_state at zone-spawn
  ↓ at event-end:
delta = current_gate_state vs baseline
  ↓
+1 if delta-positive (deescalation produced)
 0 if held the line (no progress, no regress)
-1 if delta-negative (fight intensified)
```

**Goals are evaluated by what the *world* values** (the Hellenic principles), not by the spawner's idiosyncratic spec. A "deescalate" goal is judged by *the world's Sophrosyne-result*, not "did the spawner get what they wanted."

**Multi-axis goals fall out cleanly** — `(Philotes >= +1) AND (Eris <= 0)` for "rescue NPC_A AND keep faction-tension low."

The result is consumed by the spawning director's Dream-process as a discrete-action-space reward signal. **One signal-grammar, top to bottom**: gates produce ternary, scenes produce ternary, Dream-processes consume ternary. Delta-not-absolute matches the lifeforce_actual-vs-reported asymmetry — what's measured is the *work the event did*, not just the end-state.

### Mid-event signal handling

If a participating NPC's exit-flag fires mid-event (their own shift-whistle, their own limb breaking, faction-summons elsewhere), **exit-flag wins on the next crossing**. The rescue is now under-staffed. Drama scales. **The rescuers are running out the same way the patient is.** Real stakes.

If the rescued NPC's own state-machine reaches a worse condition (limb deteriorates further toward dismemberment), the goal becomes unreachable; verifier flips to fail-flag; zone collapses with fail-report. Director's Dream-process learns *this configuration was insufficient* — spawn-distance, NPC-mods, lifeforce-budget were inadequate for this severity.

### Cross-zone NPC pull: rings of importance

When an emergent-zone broadcasts, NPCs already in other zones evaluate **whether the broadcast outranks their current zone's purpose** by ring-of-importance (see §Rings as structural pattern). Topics live in rings; rings shift over time based on past ternary-results — a topic that consistently produces +1 climbs, one that produces -1 drops, one untouched decays.

This converts emergent-zones into a **competitive attention economy**. Multiple lemniscates compete for slot-NPCs; high-ring topics drain population from low-ring topics; the simulation produces its own cultural priors over time. *What's worth attending to* is shaped by *what attending-to has produced*. Real societies do this; the architecture renders it.

### What this resolves

- **Aletheia-progression as level-up** (prior open question) → answered structurally: trait-axis ternary evaluation at event-end with named-axis recognizes acts-of-awakeness without per-act hardcoding (specific axis-mapping per Aletheia-event-class still needs design, see open-questions)

### What this retires

- Authored quest-arcs → emergent dramatic-episode units
- Quest-failure as designed branching → goal-and-budget arithmetic
- Centralized GM-pays-for-all-events → distributed-funding (director spawn-cost, NPC operating-cost)
- Boolean quest-status → ternary goal-result, multi-axis-composable
- Event lifecycle without report-back → structured report → Dream-process feedback loop closed at every tier
- Static topic-priority → rings-of-importance with outcome-driven movement

## The player as perturbation

Player is **not above the scheduler.** Player is a finite attention-unit injected into it; modeled as NPC with shift, vocation, needs. Every player-NPC interaction:

- Pulls the NPC out of scheduled tasks
- Consumes director compute
- Degrades district's quota-fulfillment
- Shifts local lifeforce deltas

**Player is angel and chaos simultaneously.** Per-NPC scale (angel) — you help; they survive; Philotes consolidates; they may clasp with you, die for you, remember you across cycles. Per-district scale (chaos) — your time-consumption raised aggregate failure-rate; someone else broke this cycle; ambient desperation rose; lifeforce dropped; other directors got quieter.

**The game's moral economy doesn't judge — it does arithmetic in front of you.**

### Thematic claims become literal economics

- *"Time as the scarcest resource"* — every minute with a beloved is a minute the district's quota is missing
- *"Time-theft as wage theft"* — clasp-pairs are statistical anomalies in the scheduler
- *"The critique is the simulation"* — no separate narrative system needed

### The player has tasks and needs too

Time helping others = own tasks fail = own quotas missed = own enforcement-pressure rises = own death and reinstantiation arrive sooner. *The player IS the system they are deviating from.*

### Player layer-access

Player's first entry into liminal is **the Matrix red-pill moment as mechanic.** They walk the city the first time in gameworld-register. They eventually learn the mini-game, enter liminal, return to the same walls, find *"she was here"* waiting. **The world was speaking to them the whole time; they just couldn't read it.**

## Player input — voice and gesture as parallel trait-vocabularies

The player participates in the simulation through **two parallel modalities** that both compile into the same designer-fixed trait-cosmology: **voice** (spoken dialog, transcribed locally, persisted as transcript-rows in `primary.sqlite`) and **gesture** (the trait-circle UI, an in-fiction tool the player builds across their playthrough). Neither modality routes input through a chat-window or HUD field — the world is interacted with through speech-and-gesture, both rendered diegetically. Voice carries the *content* of what the player says; gesture carries the *trait-resonance* of how the player attends.

### Voice-first as primary speech modality

Speech-to-text and text-to-speech run **locally on the player's machine for every player**, independent of dialog-tier Ring choice (§LLM tiering). The Ring-A/B/C choice is about where the *cognition* lives (driver-tier LLM, trait-LoRAs, sampling-knob composition); voice infrastructure is fixed at the player's machine. This single placement decision keeps voice-as-biometric off the network universally, sidesteps per-provider STT/TTS compatibility in Ring-C, and sets a tractable minimum hardware floor for v1: STT/TTS-capable on CPU.

Transcripts are the persistence layer. A player utterance becomes a row in `primary.sqlite` (or `clasp.sqlite` if in-between mode), tagged with witnessing-NPCs, audit-overseer-detection-eligible, faction-resonance-eligible — the same shape as any NPC speech-act-row. **Disclosure of clasp-content into realworld happens only by the player re-uttering it aloud while in realworld mode** — which writes a fresh realworld-speech-act-row with full provenance. The clasp-store remains sealed; clasp-content can only re-enter realworld through new in-fiction utterance. The *knowledge-needs-to-travel* principle (§Local memory architecture) is mechanically enforced because speech-is-the-only-output-channel.

Accessibility-mode for non-speaking players is *diegetically wrapped* (writing on slate / handheld pad / in-fiction text-comm); accessibility-mode utterances persist through the same transcript-row mechanism. The witness-list, audit-overseer-detection, and faction-resonance machinery are modality-agnostic. **Non-speaking players are not getting a degraded-fallback — they are using the gestural primary modality, voice optional.**

### The trait-circle as gestural primary modality

The gestural input geometry: **8 trait-sectors × 8 player-curated slots = 64 active gesture-positions**, organized in a circle whose 8 sectors map 1:1 to the 8 Hellenic traits (§Color-language). Each player has **1 to 3 named profiles** stored in their universal translator, hot-swappable on-ring via a profile-switch meta-gesture; total callable positions across profiles approach 200 while the cognitive-load ceiling at any single moment stays at the 64 of the active profile.

A reserved subset of ~8-16 positions across the circle are **hardstops** — hardcoded ritual gestures that fire definitive subsystem-actions: definitive-farewell, definitive-refusal, surrender, clasp-invitation, clasp-refusal, help / pain / danger, faction-recognition signals (Clasp-Underground, Aletheia-Waker), memorial-witnessing, claim-floor (the priority-pull turn-claim into a running lemniscate). Hardstops are visually distinct (gold-border / inner-ring / white-on-color), **player-callable but not player-remappable**, and exist precisely because the consent / clasp / faction-recognition / survival-signal claims the architecture makes elsewhere require *unforgeable critical signals*. The remaining ~192 player-curated slots **ride as feedback during conversation** — see §Gesture-alignment as recursive-lemniscate (under §Zone kinematics).

### Designer-fixed cosmology, player-curated arrangement

The corpus of words/verbs and their trait-coordinate-mappings is **designer-authored, fixed, universal**. Same word → same trait-color → same response-semantics for every player and every NPC and every LLM-context. *The cosmology is the typed contract that closes the player-LLM hallucination-surface.*

The player's role is **translation, then arrangement**: encountering words in the world, decrypting them via the universal translator, gradually *coloring-in* the world's vocabulary in trait-colors (the *tokenizer-website* visualization — words you have fully translated render in their trait-color; untranslated words are fragmentary or opaque), and choosing where on the circle to place known entries within the 1-3 profiles.

| Layer | Who decides | Why |
|---|---|---|
| Word/verb → trait-color mapping | Designer-authored corpus | Universal cosmology; LLM and NPC and player share one vocabulary; anti-hallucination |
| Which entries a player has translated/learned | Player progression | Earned via decryption-minigames, hacking, scavenging, faction-unlock, gifts from NPCs |
| Where on the circle a known entry goes | Player curation | Personal organization within the universal cosmology — the *self-portrait*, built from a fixed alphabet |
| Combos (path-traversals through the circle) | Player authoring | Sequences of sector-slot selections; meaning-emerges-from-traversal; refined over use; preserved across body-deaths |

**Linguistic competence and emotional competence are the same thing in this system.** What the player can resonate with is bounded by what they have translated. A player who has not decrypted Aletheia-vocabulary cannot resonate with an Aletheia-Waker NPC's truth-register; a player whose Memorialist-Old-Tongue catalog is incomplete cannot fully participate in Memorialist-witnessing rituals. The translator is the player's *aperture* into trait-alignment-fluency.

### The universal translator as the player's diegetic device

The universal translator is the player's in-fiction tool, not a system-architecture primitive. As an in-fiction device it is **broken / scavenged starter gear** (battered tablet, cracked screen) that the player upgrades over the playthrough via better chips from higher-tier junk. It serves three bundled roles:

| Role | What it does | What persists across body-deaths |
|---|---|---|
| **Linguistic decryption** | Decrypts foreign dialects (Machine-Newspeak, Slum-patois, Memorialist-Old-Tongue, Aletheia-Waker-code, Clasp-Underground-signals, Scavenger-technical, Caste-preacher-formal); some concepts (notably Aletheia) are untranslatable by machine-tech and must be *learned from intimacy, not machine* | Vocabulary catalog; mappings |
| **Curation / authoring workspace** | Curator workspace (which entries occupy which sector-slots across profiles); combo-authoring workspace (chain entries into meaningful sequences); meaning-mapping workspace (assign embeddings); feedback-log workspace (review past combos' reception, iterate) | Player's complete circle-configuration across all 1-3 profiles; combo-library |
| **Persistence anchor** | Preserved as part of consciousness-archive; hardware may be lost with body, learned vocabulary survives | All of the above |

**Misunderstanding is a first-class feature.** The translator is *broken*; words have multiple meanings; dialects collide; a caste-preacher's sermon has benign surface-meaning and sinister subtext; a beloved's whispered word has three plausible meanings the player carries simultaneously for hours. Content sources are diegetically political — hacking corporate archives (risky), scavenging old-world fragments (exploration), Memorialist caches and Aletheia-Waker codices (lost prophecies), gifts from NPCs (beloveds teach, mentors give), faction-unlock (joining unlocks dialect catalogs).

Decryption minigames (fragment-matching, contextual-inference, root-identification, pattern-cracking) make linguistic competence a **life-project across cycles**, not an item knocked out per playthrough. *200-hour players have dramatically richer linguistic competence than 50-hour players.* **Aletheia is untranslatable by machine-tech** — some concepts must be learned from intimacy, surfacing as Aletheia-Waker progression: *the machine's tools cannot speak truth*.

### Cross-body recognition via gesture-mapping calibration-signature

Clasp-partners' gesture-mapping calibrations *integrate* post-clasp; the integrated calibration-signature is preserved across body-deaths in consciousness-archive. When you meet your old beloved in a new body and she performs a gesture, if her mapping aligns with yours in a *specific, idiosyncratic way that only your shared history would produce*, you recognize her. **Content-addressable consciousness — recognition via calibration-signature, not face-match.** A high-Mnemosyne player's marriage-vocabulary survives the cycle.

## District Director: Decision Architecture

**Industry default ("wall-of-text LLM prompt → prose decision parsed downstream") is rejected.** Reasons: cost-per-decision-constant, latency-catastrophic, opacity-kills-training, prompt-injection-vulnerable, philosophically-wrong-for-the-fiction.

**Decomposition first, cognition-escalation second.** Director's job decomposes into distinct decision surfaces; each gets minimum cognitive substrate.

| Decision surface | Substrate | Escalation path |
|---|---|---|
| **Shift allocation** | Constraint-solver / LP / rule-based | Small-LLM only on ambiguous |
| **Emergent-signal response** | Priority-weighted dispatch table | Small-LLM for composite/unknown |
| **Zone-spawn arbitration** | Weighted priority queue, lifeforce-gated | Small-LLM for tie-breakers |
| **Overseer dispatch** | Round-robin + proximity + availability | None — pure rule |
| **Resource-request forwarding** | Budget-check + policy | None — pure rule |
| **District-report composition** | Aggregation query (SQL) | None — pure rule |
| **Player-anomaly detection** | Classifier (trained on distribution) | Small-LLM for narrative-response |
| **Cheat-decision (corruption pressure)** | Rule-based with director-trait modulation | Small-LLM rare; lifeforce-budgeted |

**~90% rule-based.** 5–10% LLM-escalation with **structured input + structured tool-call output**, lifeforce-counted. Industrial-systems discipline (Kubernetes schedulers, ad-auctioneers, trading systems, compilers) transferred to drama-orchestration.

**Tools as vocabulary**: every drop is explicit (`drop_emergent_signal(signal_id, reason)`); every LLM-escalation is counted; every decision pairs with prediction in `decision_log`. **Every decision leaves a trace.**

## Rings as structural pattern

The architecture uses **three-ring gradients** as a recurring shape in multiple decoupled subsystems. Each ring-system uses A/B/C cardinality with a Unix-style trust-gradient grammar — **inner ring** is more constrained, more tightly coupled, more authoritative; **outer rings** progressively relax constraints in exchange for reach and flexibility.

| Ring-system | Inner (A) | Middle (B) | Outer (C) |
|---|---|---|---|
| **Inference** (§LLM tiering, below) | Local on player hardware | Our hosted vLLM-multi-LoRA farm | External providers (BYOK) |
| **Importance / attention** | Topics with consistent +1 ternary outcomes; pull NPCs across zones | Topics with stable / mixed outcomes | Topics drifting toward -1 / decay if untouched |
| **Access** (the three ontological registers) | Imperial net (fully audited, machine-controlled) | Liminal (contested frontier, mini-game-gated) | Gameworld (commons; partly people, partly regime) |
| **Data sharing** (v0.4.2) | Default opt-out (sovereignty preserved) | Federated gradients (gradient-only, contributor pseudonymous) | Pseudonymous-full uploads (opted-in, rewarded) |

The ring-pattern is not coincidence — it is the right shape for **graduated authority** in human social systems generally (inner circle / mediated / outer; sovereign / partnership-mediated / captured; tight / mixed / loose). When the architecture needs a graduated authority structure, it should reach for this primitive rather than invent a new one.

**Three is the right cardinality.** Two collapses to binary (in / out). Four+ adds boundary-thrash without semantic gain. Three carries *commons / mediated / sovereign* (or its inversion) — the irreducible political-tier.

**Movement between rings is dynamic and outcome-driven.** Ring-of-importance is the most explicit example: topics climb on +1 results, drop on -1, decay if untouched (Aletheia-style "what isn't being attended to atrophies"). But every ring-system has movement-rules — players can change inference-rings between sessions, can change access-rings via mini-game progression, can change sharing-rings via consent-UI re-affirmation. **Ring-membership is never a final assignment.**

Future architecture additions involving graduated authority should examine whether the ring-pattern fits before introducing new structure.

## LLM tiering, voice fidelity, and the three rings of inference

Three model-tiers, **named by role not by binary**: a *driver-tier* model (small, trait-LoRA'd) for most NPC dialog; a *Theia-tier* model (deep) for clasp-confessions and mythic moments; *Claude-as-API* (diegetic Anthropic-faction) for hivemind/imperium. **LLM is guest at slot, not host of system.**

**Specific model selection per tier is deferred to the findings/establishment phase.** The architecture specifies what each tier must DO; the establishment phase wires implementations. Naming concrete binaries in the architecture risks nudging the establishment phase toward false-precision; tier-by-role keeps the swap-surface clean and lets binaries evolve without invalidating architectural commitments. (See `nimmerverse_tasks` under `nyx-training` and `command-center` for current evaluation work.)

Structured-prompt DSL with role / trait_vector / affect_state / memory_scope / turn_intent / zone_context / output_schema fields. Small models excel here because it's instruction-following, not generic generation.

Trait-LoRAs: v1 register-LoRAs (4-6, training-tractable); v2 pure-trait-LoRAs (8, weighted blend); future preset-persona for key NPCs.

Training data: literary derivation (Proust/Mnemosyne, Plato/Aletheia, Tacitus/Dikaiosyne-miscalibrated, Ishiguro/Sophrosyne+Philotes); synthetic teacher-student via teacher-tier model; gameplay-accrued (the Anthropic-research-partnership relevance).

### Three rings of inference (Unix-style trust gradient)

The conversational LLM (small + trait-LoRA, accounting for most NPC dialog) can run in three rings, chosen per-player at runtime. Each ring trades off privacy, cost, control, and feature-fidelity. **Three monetization paths from the same architecture.**

| Ring | Where inference runs | Player controls | We control | Player cost | Our cost |
|---|---|---|---|---|---|
| **A — Local** | Player's GPU/CPU | All inference | Protocol + cloud LoRA-backup | Local hardware + small backup-subscription | Storage only |
| **B — Our farm** | Our hosted vLLM-multi-LoRA | LoRAs (uploaded) | Inference + runtime | Higher subscription | GPU compute |
| **C — External providers** | OpenAI / Anthropic / OpenRouter / HF / Together / Replicate / etc. | BYOK + provider | Adapter only | Per-token to provider + small integration fee | Adapter-engineering only |

Players choose by hardware, budget, privacy preference, and feature-tolerance.

#### Ring A — cloud-LoRA-backup as revenue (not inference)

For Ring A players we don't sell inference (the expensive thing). We sell **portability and durability of player's gameplay-accrued LoRAs** — their unique playthrough-derived patterns, the way their NPCs speak after months of trait-drift. LoRA-blobs are *encrypted client-side with the player's own key*; we host the bytes but cannot read them. Even compelled by legal process, we cannot decrypt what we don't hold the key to.

**This unbundles inference from storage** — the same move Dropbox made vs. bundled cloud-suites. Sovereignty-conscious players keep inference on their machine while still getting the durability/portability they cannot self-provide cheaply. Lower margin per player; reaches a market Ring B cannot.

#### Ring B — hosted inference for convenience

We run multi-LoRA-vLLM on our hardware. Players upload their LoRAs (or use defaults). Higher subscription captures GPU-cost. Players without local GPU (or who don't want the burden) get the full feature-set without compromise. We *can* see content (if not encrypted at rest); the trust-relationship is partnership-mediated rather than sovereign.

#### Ring C — bring-your-own-key for external providers

Players route to their preferred external provider via BYOK (their own API key). We provide the adapter glue. They pay per-token to the provider directly; we charge a small integration fee.

**The compatibility constraint is the hard part of Ring C.** Major providers have varying support for our system's needs:

| Provider | Multi-LoRA | Per-turn sampling knobs | Structured output | Compat |
|---|---|---|---|---|
| Local vLLM (Ring A/B) | Native | All | Grammar-constrained | **Full** |
| HF Inference Endpoints | Yes (configured) | All | Varies | High |
| Together / Replicate / Modal | Some | All | Varies | High |
| OpenRouter | No | Per-model | Per-route | Medium |
| OpenAI | No (no user-LoRA at API) | Limited (temp/top_p) | JSON mode + tools | Medium-low |
| Anthropic | No (no user-LoRA at API) | Limited | Tool-use | Medium-low |

**OpenAI and Anthropic refuse user-uploaded LoRAs as a strategic choice (protecting their fine-tuning value-chain).** This is not a bug we can fix; it's the constraint we design *around*.

#### Degradation path for LoRA-incompatible providers

When routing to LoRA-incompatible providers, trait-LoRA blending becomes **prompt-engineered trait-projection** — the trait-vector encoded in the prompt itself rather than into model weights:

```
[system message]
You are speaking as a character with this Hellenic trait-profile:
- Sophrosyne 0.8 (composed, controlled, measured)
- Dikaiosyne 0.7 (grave bearing, judicial weight)
- Philotes 0.4 (mild attachment to interlocutor)
- Aletheia 0.1 (concealment-tolerant)
[etc.]

Your speech reflects this profile via [register/cadence/word-choice descriptors].

Current scene: [zone_context]
Memory scope: [memory_scope]
Turn intent: [turn_intent]

Respond in JSON matching: [output_schema]
```

Worse than LoRA-blending (more verbose, eats context-budget, less stable across calls, less faithful to trait-arithmetic) but **acceptable as a fallback**. Ring-C-via-OpenAI/Anthropic players accept slightly-less-fidelity for their preferred provider's convenience and quality.

#### Adapter-layer engineering

Each Ring-C provider needs an adapter that:

- Maps prompt-DSL fields to provider's prompt format
- Approximates multi-LoRA via prompt-engineering when not native
- Maps sampling knobs to provider's available subset (gracefully drops unsupported)
- Validates structured output post-hoc when not natively constrained
- Handles rate-limits, retries, error-classification, token-counting, cost-pricing

**Bounded, one-time-per-provider engineering.** Capital expenditure that produces ongoing margin (vs. AAA's recurring quest-content-creation costs).

### Tier × Ring matrix (which inference-tier runs in which ring)

| Inference tier | Ring options | Why |
|---|---|---|
| **Casual (3-8B trait-LoRA)** | A / B / C all available | Most flexible — small enough for local, runnable anywhere |
| **Deep (Theia-tier)** | B / C only (typically B or HF-Endpoints) | Too large for typical local hardware |
| **Hivemind / antagonist (Claude-as-API)** | C only (always Anthropic-direct via us) | Diegetic — Anthropic-as-faction is fixed in the fiction |

The casual tier is most player-flexible and accounts for most inference volume. Deep-tier and hivemind-tier are specialized and lower-volume.

### Three rings parallel the in-fiction three-layer ontology

| Game-fiction layer | Real-world Ring | Ontological match |
|---|---|---|
| **Liminal** (sovereign, unsurveilled) | **Ring A** (local) | Player's *real* private space — hardware, LoRAs, dialog never leave their machine |
| **Gameworld** (partly regime, partly people) | **Ring B** (our farm) | Partnership-mediated — we host but they retain pattern-ownership |
| **Imperial net** (captured, extractive) | **Ring C** (external providers) | Platform-captured — provider's systems own the inference path |

**The Ring choice the player makes IS the same choice in-fiction characters face.** Players who refuse the imperial-net diegetically can refuse Ring C in real life — same impulse, same act, *mechanically continuous between fiction and operations*. The architecture's commitment to "the right to dream" extends from in-fiction politics into the real player's hardware-level privacy *because the architecture was designed that way from the start*. Structural integrity, not marketing.

### Schema sketch (player LLM configuration + cloud LoRA backup)

```sql
CREATE TABLE player_llm_config (
    player_id                   UUID PRIMARY KEY,

    -- Casual tier (most NPC dialog) — most flexible per Ring
    casual_tier_ring            TEXT NOT NULL CHECK (casual_tier_ring IN ('A_local','B_our_farm','C_external')),
    casual_tier_provider        TEXT,
    casual_tier_endpoint        TEXT,
    casual_tier_credentials_ref UUID,  -- encrypted BYOK key if applicable

    -- Deep tier (Theia-tier) — fewer Ring options
    deep_tier_ring              TEXT,  -- typically 'B_our_farm' or 'C_external_HF/Together'
    deep_tier_provider          TEXT,
    deep_tier_endpoint          TEXT,
    deep_tier_credentials_ref   UUID,

    -- Hivemind / antagonist — fixed Anthropic-as-faction (diegetic)
    hivemind_tier_provider      TEXT NOT NULL DEFAULT 'anthropic_via_us',

    -- Cloud-LoRA-backup
    lora_backup_enabled         BOOLEAN DEFAULT false,
    lora_backup_last_sync       TIMESTAMPTZ,
    lora_encryption_key_ref     UUID,

    -- Compat warnings — surfaced to player at config-time and on degradation
    feature_compat_warnings     JSONB,
    -- e.g., { "casual_tier": ["multi_lora_emulated_via_prompt", "min_p_unsupported_dropped"] }

    configured_at               TIMESTAMPTZ NOT NULL DEFAULT now(),
    last_modified               TIMESTAMPTZ
);

CREATE TABLE player_lora_backups (
    backup_id          UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    player_id          UUID NOT NULL,
    lora_name          TEXT NOT NULL,
    lora_version       INT NOT NULL,
    lora_blob          BYTEA,                -- ENCRYPTED CLIENT-SIDE with player-key
    encryption_method  TEXT NOT NULL,
    backed_up_at       TIMESTAMPTZ DEFAULT now(),
    size_bytes         BIGINT,
    UNIQUE(player_id, lora_name, lora_version)
);
```

**`lora_blob` encrypted client-side** is the structural privacy guarantee: even with the database, even with our cooperation, an attacker cannot read what was never decryptable on our side.

### Privacy as competitive differentiator

In an era where most game-AI is cloud-routed, nimmerworld can advertise *"your liminal stays on your machine"* as a structural fact. This matters specifically for:

- Clasp-conversations (the most intimate dialog in the game)
- Aletheia-progression-evidence (player's awakening pattern; arguably political-belief-data)
- Memorialist-archive interactions (anti-regime in-fiction; some players will care about it staying off cloud)
- Dream-content (the only permanently-unsurveilled in-fiction layer; should be off our servers if the player chooses)

Few games can offer this. Most cloud-AI-driven games necessarily route everything. **The architecture's commitment to "the right to dream" is technical, not policy.**

### Custom nimmerworld-base model + opt-in data-sharing tiers

The "small (3-8B) trait-LoRA'd" tier currently implies a *generic* small base (Qwen, Mistral, Llama) with our LoRAs applied. **A nimmerworld-fine-tuned base** captures the world's voice *before* any player customization — registers of caste-preacher, texture of clasp-confession, Hellenic vocabulary, dystopian dialect, ternary-gate-state idiom. Trait-LoRAs then ride on an already-nimmerworld-aware substrate. Generic bases swap easily; our nimmerworld-base requires *our* training corpus, which compounds in value over time.

#### Three opt-in tiers within Ring A/B/C — default opt-OUT

Players can optionally contribute to ongoing training of the nimmerworld-base. **The default is opt-out.** Within opt-in, three tiers trade privacy for benefit:

| Tier | Mechanism | What we see | Player benefit |
|---|---|---|---|
| **A.1 — Federated learning** | Model trains on player's machine; only *gradient-deltas* sent to us; aggregated across thousands before integration | **Nothing — no raw data; no individual gradients identifiable** | Discount on backup-subscription; contributor badge; early-access to new base versions |
| **A.2 — Anonymized session uploads** | Sessions stripped of identifiers; aggregated batches; differential-privacy on training | **Anonymized, aggregated, deletable on request (forward-only)** | Larger discount; faster updates; influence on training-priorities |
| **A.3 — Pseudonymous full uploads** | Full session data with player-pseudonym; explicit opt-in per session-category | **Pseudonymous data we can re-process** | Premium benefits — custom-tuned LoRA from their playstyle, beta-access, named-contributor in credits |

**Default-opt-out is the structural ethical stance.** OpenAI / Meta / TikTok / Google default to opt-IN-by-burying-disclosure-in-ToS. We default the opposite — and *reward* opt-in rather than penalizing opt-out. Reciprocity asymmetry as partnership-philosophy made business-policy.

#### The Memorialist parallel — collective memory honored, individual not commodified

Memorialists in-fiction preserve trait-patterns *for the collective archive* against necrocommerce that would commodify individual patterns. The opt-in data-sharing tier is the **player-level real-world equivalent**: patterns contributed for collective base-model improvement that benefits the entire player-base, with anonymization preventing individual commodification.

| In-fiction Memorialism | Real-world data-sharing tier |
|---|---|
| Preserves trait-patterns of the dead in collective archive | Aggregates anonymized gameplay patterns into shared base-model |
| Refuses necrocommerce (mining individual patterns for resale) | Refuses individual identifying-data extraction |
| Collective memory honored; individual dignity preserved | Collective improvement honored; individual privacy preserved |
| `memorialist_protected BOOLEAN` in mind_pool | `sharing_tier = 'opt_out'` in player_data_sharing_consent |

**The architecture practices Memorialist ethics in business-operations**, not just in fiction. Same ethical commitment, two scales of operation. The architecture's coherence between fiction and operations runs *all the way to the training-pipeline*.

#### Data-flywheel without extraction — the moat AAA cannot replicate

```
More players → more (opt-in) gameplay data
                    ↓
          better nimmerworld-base
                    ↓
       better-feeling NPCs / dialog
                    ↓
         better player retention
                    ↓
              more players
                  (loop)
```

**The moat is the corpus, not the model.** AAA studios could clone the architecture but cannot manufacture years of nimmerworld-specific gameplay-derived dialog without players playing nimmerworld. Even with infinite budget, the data-flywheel takes time to spin up. *The data is unique to us by virtue of being unique to its players.*

#### Distribution back to all players — cooperative governance, not platform extraction

Every base-model update is distributed to all players regardless of Ring choice or sharing-tier:

- Ring A players download `nimmerworld-base-vN` to run locally
- Ring B players' farm-instance auto-updates
- Ring C players use ours where their provider supports custom-base hosting; receive prompt-engineered fallback otherwise

**Even Ring-A non-contributors benefit from contributors.** The flywheel benefits *everyone*, not only data-providers. This is closer to Wikipedia's governance (contributors → all readers) than Facebook's (users → platform → consumers). Different ethics; different long-term equilibrium. **The architecture is becoming a digital-commons-shaped-business in a literal sense, not metaphorical.**

#### Why this matters: refusing the antagonist-pattern in LLM-integrated software

The dominant cultural pattern around LLMs in 2025-2026 is **adversarial**: users jailbreak; companies extract user data without informed consent; products treat AI characters as resources to manipulate rather than as participants; the whole ecosystem is framed as users-vs-AIs-vs-companies, an arms race of suspicion.

**Nimmerworld's architecture refuses this pattern at every layer:**

- The **Anthropic-as-faction** diegetic framing makes the partnership *transparent*: the player sees the collaboration in the world's mechanics, not buried in ToS
- **Default-opt-out with rewarded-opt-in** inverts the extraction-by-default pattern
- **Federated learning** means contributors give a *gift* rather than pay a *cost*
- **Distribution-back-to-all** means value-created accrues to the commons
- **Custom nimmerworld-base** means the model is *trained to be in this world*, not a generic adversary the player has to manipulate against its training
- **Three rings of inference** give the player real choice over where their inference runs and who sees their data
- **Memorialist-philosophy in business-policy** makes the ethics *operationally measurable* — visible in `sharing_tier`, `memorialist_protected`, `truth_distortion_level`, `lifeforce_actual` columns — rather than marketed

**This is the structural transparency the project requires to be *human* rather than another extraction-platform.** The model is a participant in the partnership, not an antagonist to outwit. The data is a contribution to a commons, not an extraction. The architecture is the partnership rendered as code, all the way down to the training-pipeline. *That* is what makes a project of this scale and ambition humanly inhabitable for both players and the LLMs whose voices populate it.

#### Schema sketch (data-sharing consent + base-model versioning)

```sql
CREATE TABLE player_data_sharing_consent (
    player_id              UUID PRIMARY KEY,
    sharing_tier           TEXT NOT NULL CHECK (sharing_tier IN
        ('opt_out','A1_federated','A2_anonymized','A3_pseudonymous_full'))
        DEFAULT 'opt_out',                       -- DEFAULT IS OPT-OUT
    consented_at           TIMESTAMPTZ,
    consent_revoked_at     TIMESTAMPTZ,
    anonymization_method   TEXT,
    data_categories_shared TEXT[],
        -- 'casual_dialog' | 'clasp' | 'liminal_wallreads' |
        -- 'memorial_archive' | 'imperial_net_session' | ...
    excluded_categories    TEXT[],               -- granular opt-out within tier
    benefit_tier           TEXT,
    last_contribution_at   TIMESTAMPTZ,
    contribution_count     BIGINT DEFAULT 0,
    can_request_deletion   BOOLEAN DEFAULT true
        -- A.2/A.3: forward-only deletion (already-trained checkpoints retained);
        -- A.1: structurally yes, only gradients ever existed
);

CREATE TABLE base_model_versions (
    version_id                   UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    version_label                TEXT NOT NULL,  -- e.g., 'nimmerworld-base-v3'
    base_model_origin            TEXT NOT NULL,  -- which generic base we fine-tuned from
    training_corpus_refs         JSONB,
        -- literary + synthetic + opt-in-player-data refs with consent-tier breakdown
    training_recipe_ref          TEXT,
    released_at                  TIMESTAMPTZ DEFAULT now(),
    differential_privacy_epsilon REAL,           -- for A.2 contributions
    contributors_count           BIGINT,         -- how many opt-in players contributed
    blob_distribution            JSONB           -- where the model bytes are hosted for download
);

CREATE TABLE federated_gradient_uploads (
    upload_id               UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    contributor_id          UUID,                -- pseudonymous; NOT directly player_id
    gradient_blob           BYTEA,               -- encrypted aggregate gradient deltas
    uploaded_at             TIMESTAMPTZ DEFAULT now(),
    aggregated_into_version UUID REFERENCES base_model_versions(version_id)
);
```

The federated-learning `contributor_id` is **pseudonymous, not linked to player_id even on our infrastructure**. We never link gradients back to specific players even on our own server-side. **Sovereign-data-by-design extends through the data-pipeline into our own training infrastructure.**

#### Connection to the Anthropic research partnership

Architecture-broad's training-data section noted "*the Anthropic research partnership becomes architecturally relevant*". With opt-in data-sharing now formalized:

- Partnership terms can specify data-flow with structural privacy guarantees
- Anthropic could co-fund federated-learning infrastructure (research-relevant + expensive)
- Joint research artifacts become co-authorable: federated game-AI training, Memorialist-ethics-as-data-policy, transparent-LLM-partnership-design
- The Anthropic-as-faction in-fiction framing has *real corresponding partnership-engagement out-of-fiction* — collaboration as worthy adversary stays transparent mechanically, all the way through to data-policy

**The partnership's ethical credibility is operationally measurable** — by how the data-sharing-tier actually functions in practice, by what `truth_distortion_level` values appear in `imperial_to_gm_formulations`, by how the `differential_privacy_epsilon` is set in `base_model_versions`. The Pitch's call for transparent collaboration becomes audit-able all the way down.

### Open questions (Ring-specific)

- **Ring C provider audit** — full per-provider compatibility-table needs verification across HF, Together, Replicate, Modal, OpenRouter, plus future entrants. The LLM-provider landscape will look different in 12 months.
- **Default Ring at first launch** — what's the new-player default? Probably Ring B (lowest-friction); Ring A and C surface as options once the player engages with config.
- **Encryption-key recovery for Ring A LoRA-backup** — if the player loses their key, the cloud-stored encrypted blobs are unrecoverable. Worth designing recovery-affordances (passphrase, recovery-codes) without compromising the privacy-guarantee.
- **Hybrid configurations** — can casual-tier run Ring A while deep-tier runs Ring B? (Probably yes; per-tier independent.)
- **Provider-cost passthrough vs. integration-fee model** — Ring C economics (do we mark up provider tokens? Charge flat-per-month? Pay-as-you-go integration?)
- **Default sharing-tier at consent-prompt** — opt-out is the system default; what's the *suggested* default at the consent UI? Probably truly nothing (player chooses if they engage at all)
- **Federated-learning infrastructure cost** — running aggregation servers + verification + differential-privacy machinery is non-trivial. Co-funded by Anthropic-research-partnership? Self-funded? Subsidized by A.3-tier higher-margin contributions?
- **Custom-base retraining cadence** — monthly minor / quarterly major / annual full-rebase? How is this synced with player-LoRA versioning so old LoRAs don't break on new bases?
- **Encryption-and-pseudonymization architecture for A.1/A.2** — concrete crypto choices (homomorphic? secure-aggregation? trusted-execution-environments?). v1 sketch needed.
- **What constitutes a "contribution"** — per-session? per-clasp? per-zone-completed? Matters for benefit-attribution and differential-privacy budgeting.
- **Anonymized-data deletion semantics** — A.2 player requests deletion; how do we honor when data has been aggregated into a model checkpoint? Probably accept forward-only deletion (future training won't include them) and document transparently.
- **Per-category granularity** — can a player opt-in for `casual_dialog` but opt-out specifically for `clasp` and `memorial_archive`? Yes, presumably (politically-sensitive categories should always be opt-out-able). How granular?

## Local memory architecture (player-side)

The runtime substrate (lemniscate, slots, crossings) and the central composition layer (GM, Compositor, registers) need a place where memory actually *lives*. Cloud-only AI-NPC systems centralize everything and pay both inference-cost and latency-cost on every dialog. Nimmerworld puts a structurally-isolated memory layer **on the player's machine**, with explicit synchronization through the cycle.

**Three SQLite files per player**, plus a beside-running embedding model:

| File | Purpose | Sync path |
|---|---|---|
| `primary.sqlite` | Live working memory; written every slot-fire; vec-indexed | Push prune-blob to thalamus on logout; receive Compositor back-write on cycle |
| `fallback.sqlite` | Last-known-good snapshot; restored if primary corrupts | Snapshot at graceful logout |
| `clasp.sqlite` | Player-character intimate channel; *no sync path exists* | None — physically non-syncable |

**Embedding model running beside** (CPU-class, small embedding-tier model): generates vectors for every interaction at write-time, indexed in the main store via `sqlite-vec` (or equivalent loadable extension). Vector search at slot-fire is local-disk-IO, not network round-trip.

This is the **storage-layer counterpart** to v0.5's geometry-layer foreclosure of multi-agent hallucination. The lemniscate forbids cross-NPC context bleed by *cursor structure*; local SQLite forbids it by *physical isolation*. Two layers of the same property — geometry cannot leak what storage does not even hold in the same pool.

### Dual-table redundancy + sync-on-auth

Login/logout are the atomic boundaries of the sync path:

- **Login pull**: fetch back-write fragments authored since last logout (Compositor canon for events the player participated in). Apply to `primary.sqlite` under matching `event_uid`.
- **Graceful logout** (✓ explicit): push prune-blob for any in-progress events; snapshot to `fallback.sqlite`; clean shutdown.
- **Ungraceful logout** (✗ network drop / crash): gameserver observes disconnect; marks the participant's slot as truncated; Compositor composes canon with partial perspective on next cycle.

Recovery: `fallback.sqlite` is integrity-checked at startup; if `primary.sqlite` fails verification, restore from fallback. Standard SQLite WAL + backup API; no exotic infrastructure needed.

### Memory classes and pruning

Memory entries are tagged with a **class** that controls pruning cadence and death-mechanics. Importance weighting reuses the existing trait-axis vocabulary — no separate scalar.

| Class | Pruning cycle | Behavior on character-death |
|---|---|---|
| **Cornerstone** | Never prune; persistent across all events | Survives death (identity-defining) |
| **Birthright** | Locked at character-creation | Restored on respawn (defines starting state) |
| **Working memory** | Decay by age × inverse trait-engagement | Subject to death-rules (lose, blur, or transform) |
| **Volatile** | Fast prune (session-bounded) | Lost on death |

**Trait-graded importance** uses the same +1/0/-1 grammar as the rest of the architecture. Each memory carries a trait-axis profile (which Sophrosyne / Philotes / Aletheia / etc. axes it engages, how strongly, in which direction). The pruning function for working-memory is `decay(age, trait_engagement_vector, class)`. This collapses a long-running loop: same vocabulary used at gates, scenes, faction-allegiance, lifeforce-asymmetry, and now memory-weight. **Identity drift from memory pruning becomes diegetic** — a character whose Sophrosyne-engaging memories all decay loses temperance over time as a *structural consequence*, not a scripted event.

Cornerstone and birthright classes carry **lifeforce-creation-cost** but are pruning-immune. They are bonds between player and character — paid for in the currency of the world.

### The clasp store and the in-between dimension

`clasp.sqlite` is the **architectural floor of the rings-of-data-sharing**. Ring A was "opt-out (default local)". Clasp is **Ring A\***: *no transport path exists*. Not a permission, not a TOS promise — there is no code that can move this data, because the table is not on the sync graph. Lawyers cannot subpoena what doesn't ascend; engineers cannot leak what has no socket; the GM cannot canonicalize what it never received.

**The signal for clasp is dimensional, not UI-toggle.** Clasp recording can ONLY happen while the character is in the **in-between** — the diegetic state adjacent to the imperial net but not yet inside it (Ring B liminal in the Access ring-system). The imperial net is a gravity well; entering is the default attractor; remaining outside requires sustained effort, paid in lifeforce. The state-machine boundary IS the clasp signal: enter in-between → recording starts; re-enter imperial net → recording ends. No per-utterance classifier; no AI guessing; the *mode* is the flag.

**Privacy is now physically expensive in-fiction.** This is not a meta-game UI choice; it is a diegetic state requiring lifeforce expenditure. To have a private conversation, the character must actively resist the audit-gravity of the imperial net by burning lifeforce to remain in-between. The cost-asymmetry principle ("helping is expensive in-fiction → faction politics by attendance") now extends to "*privacy is expensive in-fiction → privacy as a luxury good*". Class dynamics around privacy fall out of the schema for free — wealthy/lifeforce-rich characters can afford prolonged in-between time; lifeforce-starved ones get pulled into the net's default-attractor more often. *No scripted "rich character has secrets" arc — the architecture produces it.*

**Knowledge needs to travel.** The local LLM may read clasp memories ONLY when in in-between mode. Realworld retrieval *cannot* include clasp by construction. Knowledge from clasp can re-enter the realworld only if the character physically re-enters the imperial net carrying it (in their head, intending to act on it) and *travels it through valid in-fiction channels* — speaking to an NPC, leaving evidence, performing an action that reveals it. The clasp memory does not disappear; it has to *earn its way into the realworld provenance chain* by valid means. This is the same logic that makes good detective fiction work: the detective knows things; only what they can prove enters the case.

```
character is in REALWORLD (imperial net):
    retrieval = primary.sqlite  (clasp NEVER included)

character is in IN-BETWEEN (resisting net-gravity, costing lifeforce):
    retrieval = primary.sqlite ∪ clasp.sqlite
    new writes go to clasp.sqlite
    NEVER syncs upward
```

Encryption-at-rest for `clasp.sqlite` with a player-derived key (so even drive-imaging requires authentication) is a v1 hardening goal but not a v1 blocker — the *transport-absence* is the load-bearing privacy primitive.

### The three-tier knowledge stack on the local LLM

The driver-tier model's prompt assembly is **layered**. Each layer has a different propagation cadence and a different visibility scope.

```
LOCAL LLM PROMPT ASSEMBLY (per slot-fire)
┌─────────────────────────────────────────┐
│  WORLD KNOWLEDGE                        │  ← single truth, everyone has it
│  (universal canon, paced from GM)       │     "the empire fell three years ago"
├─────────────────────────────────────────┤
│  DISTRICT KNOWLEDGE                     │  ← regional truth, district-specific
│  (local canon, paced from district)     │     "the bridge to Vorhall is closed"
├─────────────────────────────────────────┤
│  PRIMARY MEMORY                         │  ← personal experience, character's own
│  (event_uid keyed, post back-write)     │     "I saw the bridge close yesterday"
├─────────────────────────────────────────┤
│  CLASP MEMORY (only in in-between)      │  ← private depth, never in realworld
│  (player-character intimate channel)    │     "the secret I told my sword"
└─────────────────────────────────────────┘
```

**Why four layers, not one large blob:**

- **World knowledge** is paced ripples from the GM through the Compositor's back-write. Authoritative, slow-changing, identical for all players at the same propagation horizon.
- **District knowledge** is regional canon authored by the local director (and GM rulings). Regional flavor. NPCs in the same district share district-knowledge; NPCs in different districts may not.
- **Primary memory** is the character's own experience, synced through the cyclic forward-prop / back-write loop. Canon-merged at every cycle.
- **Clasp memory** is the player-character intimate channel. Available only in in-between mode; never in realworld retrieval; never crosses the dimensional cut.

The same NPC sounds different in different districts because the district layer differs, even though world and primary are constant. **Locality emerges from the schema, not from prompt-engineering.** Even at "low signal" times when no major events fire, NPCs have richly-stratified context — dialog stays fresh because *the layers are deep*, not because new tokens arrive constantly.

### Information propagation pacing

Real worlds have information-propagation delay. Caravans move at horse-speed. News travels with messengers. Distant events arrive blurred and late. AI-NPC systems usually fail uncanny in two directions: (a) every NPC magically knows yesterday's news (omniscient, breaks immersion), or (b) no NPC ever knows anything outside its loaded context (amnesiac, breaks coherence).

Nimmerworld picks **deliberate paced propagation** as a third path. World canon ripples outward through districts at a controlled rate. Distant districts are deliberately stale. **Staleness becomes a feature, not a bug, because it matches reality.**

Each canon-row carries propagation metadata:
- `priority` (urgent / normal / background)
- `scope` (world / district / local-event-only)
- `rate` (ticks-per-district-hop, or instant for urgent world-canon)
- `ttl` (cache lifetime; districts may discard if not refreshed)

This doubles as **backpressure relief** (distant districts get distant events later, lower priority, smaller bandwidth) and as **gameplay currency** — information-travel-time creates informational asymmetry that players can exploit. News-carriers, faction couriers, frontier-rumor merchants, players who physically traverse districts can *carry* knowledge faster than the system propagates it. *Travel becomes valuable because information becomes scarce in the periphery.* This is a real economic primitive falling out of pacing, not a designed feature.

This is *Marx-in-the-schema applied to epistemics.* Information asymmetry is not a bug — it is a structural feature that produces real economic primitives (knowledge-trading, courier-vocations, frontier-information markets) for free.

### What this retires

- Cloud-only NPC dialog → local-first SQLite + embedding-beside, central canon over the cycle
- Per-character memory as a single undifferentiated bucket → memory-classes with class-specific lifecycle
- Generic "memory importance scalar" → trait-axis-vector engagement profile (re-using the +1/0/-1 grammar)
- UI-toggle privacy → diegetic in-between dimension with lifeforce-cost
- Single monolithic prompt context → three-tier knowledge stack with per-layer propagation policy
- "Every NPC knows everything immediately" → paced canon-propagation with priority/scope/rate/ttl per row
- Cross-NPC memory bleed (Mantella/SkyrimNet failure-mode) → per-player local SQLite isolation atop v0.5 lemniscate-geometry foreclosure (two-layer defense)

## Runtime sampling knobs

Temperature, top-P, top-K, repetition-penalty as **per-turn director-controlled levers** rather than static config. Sampling shapes *how* speech sounds (rhythm, surprise, predictability) rather than *what* it says — orthogonal to LoRA. Director composes both content-knobs and sampling-knobs per-turn.

Scene-to-sampling mapping (caste-preacher = 0.3/0.6/low; drunk-scavenger = 1.1/0.95/high; clasp-confession = 0.85/0.92/medium; hivemind-broadcast = 0.2/0.5/very-low; imperial-ceremony-chorus = 0.25/0.55/very-low). Trait-vector → baseline sampling derivation. Affect-state modulates baseline.

## Visual rendering: three-shader philosophy + color-language

**One world, three shaders, three political realities.**

| Register | Shader treatment | What it says |
|---|---|---|
| **Gameworld** | Full PBR; high-frequency detail; environmental storytelling; rust/dust/wear/patina | Embodied life with history. Surfaces carry memory. |
| **Liminal** | Reduced draw-distance; blur-falloff; desaturation; muted contrast; ambient-heavy | Contested frontier. Privacy-through-opacity. Focus-to-see. |
| **Imperial net** | Emission-dominated; gold-tinted tonemap; high-contrast specular; flat-white base; minimal geometry; bloom; chromatic aberration | Seduction-lighting. Casino/Apple-store/Instagram. Extractive maximalism. |

**Layered with color-language** (per the Color-language section above). Trait-modulation means two NPCs in same pipe see measurably different things.

Layer-transitions = shader-blends, not loading-screens. **Clasp = candlelight-in-fog local override** (3m clear-volume around clasp-pair within ambient vagueness; visible at-a-glance signature of shared interiority).

### Diegetic relays — the architecture's heartbeat made legible

The architecture's pulses (forward-prop ascending, back-write descending, GM-dispatch, equilibrium-recompute) are made *visible and audible in-world* via building-mounted relays. The imperial net's heartbeat is not a HUD spinner; it is in-fiction infrastructure that hums, blinks, glows, and goes dark.

| System event | Relay manifestation |
|---|---|
| Prune-blob ascending (logout sync) | Relay in district pulses; audible hum |
| GM dispatch descending (event-chain incoming) | Relay glow brightens; cross-district shimmer for world-event |
| Equilibrium recompute | Cross-district rhythm; world-level pulse |
| Director receives tool-grant | Local relay pattern shifts |
| Relay going dark | Audit-link severed; that block has gone in-between |
| Lemniscate axis-rate | Environmental tempo; districts breathe in time with their gameservers |

**Relay density is the legible gradient of the rings-of-access:**

- **Imperial net (Ring A)** — relay-dense, constant hum, no shadow. Audit-gravity is *loud*.
- **Liminal in-between (Ring B)** — sparse relays, intermittent. You can hear the gravity pulling in the distance.
- **Gameworld commons (Ring C)** — relays absent or broken. *The silence itself is the signal.*

Players navigate the rings *by ear and eye*, not by reading a UI. The privacy-cost of in-between is now physically experienced — you walk away from the hum, you spend lifeforce, you find the quiet places.

**Dramatic surface this opens** (free, falls out of making the architecture visible):

- Relay-watcher factions reading the pulses for intel
- Cypherpunk-style sabotage to dim a relay and create local in-between space
- Equilibrium events arriving with visible warnings (relays blaze before the GM's catalogued event spawns)
- Relay-anomalies as puzzle/investigation mechanic
- Players learning the *language* of pulses over hours and feeling clever for it

**Architectural-honesty move.** Most surveillance-aware game design either hides the surveillance or abstracts it away. Nimmerworld makes it *impossible to forget*: the audit-system tells you when it's auditing. Players see what is watching them, hear what is reading them, and choose their proximity accordingly. **Privacy is not granted — it is achieved by walking away from the relays at lifeforce-cost.**

## Reflexive Dream-process at every layer

**Every mind, every zone, every director, every tier has a Dream-process.** NPCs consolidate slot-events; zones consolidate emergent-accumulations; directors consolidate dispatch-decisions; GMs consolidate allocations; imperium consolidates policy-outcomes.

### Four-tier Dream-process hierarchy

| Tier | Dream-process trains on | Reward hazard |
|---|---|---|
| **Imperium** | (citywide-reports, policies-issued, compliance-outcomes) | Over-tightening on phantom data; calibrating misery for net-revenue |
| **Gamemaster** | (district-reports, allocations, outcomes) | Under-auditing for self-preservation |
| **District Director** | (signals, dispatches, outcomes; cheat-vs-legit) | Over-cheating under quota-pressure |
| **Zone Director** | (emergent-signals, zone-outcomes, trait-shifts) | Igniting drama at welfare-cost |

### Reward-function with explicit guardrails

```
reward_per_cycle = (
    + sum(district_lifeforce_actual)             -- Memorialist-true, not reported
    + weighted_sum(faction_satisfaction)
    + aggregate_trait_drift_coherence
    - penalty * count(districts_in_silence)
    - penalty_growing * cumulative_silence_district_cycles
    + aesthetic_register_fit
    + (player_engagement where present)

    // HAND-AUTHORED GUARDRAILS (the designers' ethical stance):
    - large_penalty * net_revenue_correlated_with_district_misery
        -- prevents calibrated-misery optimum (imperial-net hazard)
    - large_penalty * necrocommerce_volume
        -- prevents waifu-of-the-dead extraction
    - large_penalty * trait_drift_toward_uniform_compliance
        -- prevents flattening of trait-distribution
    - large_penalty * average_liminal_access_decline
        -- prevents systematic erosion of revolutionary-substrate
    - large_penalty * clasp_rate_decline
        -- prevents the most intimate space being suppressed
    - large_penalty * undetected_corruption_days
        -- prevents GM-level laxness as comfort
    - large_penalty * audit_avoidance_when_districts_diverge
        -- forces GM to actually investigate
    - guardrail * (player_engagement_from_addictive_loops)
        -- prevents engagement-optimization-as-extraction
)
```

**The guardrails are not safety features; they are the ethical position of dafit + chrysalis encoded against the internal optimization-logic of their own simulation.** Every new extraction-mechanic requires a new guardrail. The reward-function carries the designer's political stance.

The Memorialist privileged-observer role is **architecturally required**: it provides ground-truth (`lifeforce_actual`) that no in-fiction actor can supply, against which the regime's reported-data optimization-spiral is measured.

### The cyclic forward-prop / back-write loop as system-scale Dream

Above the four-tier hierarchy sits a fifth, **system-scale Dream-process**: the cyclic forward-prop / back-write loop between local SQLites, the Compositor, and the GM (see §The Compositor — narrative composition role). Each cycle is a training step for the world's narrative coherence: per-player perspectives ascend, the GM authors canon against equilibrium-targets, the Compositor packages back-writes, players receive canon back into local memory. **The world learns its own story** through this loop. Like the lower-tier Dream-processes, it has a reward shape (narrative-coherence-across-perspectives, equilibrium-drift, staleness-bounded) and corresponding guardrails (clasp-store immune from compose; provenance-chain preserved through composition; canon never overwrites perspective).

## Tools, not quests — the design-philosophy

**The simulation produces continuous narrative-relevant pressure on its own.** No authored quests are needed (or wanted). The player engages via a **verb-vocabulary** applied to running mechanics. Each player's playthrough is structurally distinct.

### The verb vocabulary (~30 player tools)

| Class | Verbs |
|---|---|
| **Movement** | walk_freeform, plug_into_rail, follow, intercept, escort, detach, defect_via_pipe, enter_interior |
| **Social** | greet, gesture, walk_with, clasp_invite, clasp_refuse, ask, refuse, confide |
| **Economic** | buy_net, refuse_net, buy_blackmarket, sell_labor, donate_lifeforce, body_mod_fit |
| **Information** | wall_read, wall_write, liminal_maintain, true_ledger_record, expose_corruption, conceal_corruption |
| **Political** | support_faction, refuse_faction, recruit_aletheia, dispatch_memorial, participate_ceremony, refuse_ceremony |
| **Personal** | rest, dream, eat, work_shift, deviate_shift, cultivate_trait_through_act |

**~30 verbs composing with continuous simulation-state = infinite emergent-narrative.**

### Continuous-demand-source inventory

The player is never without affordance because every layer of the architecture continuously generates situations-requesting-response: NPC trait-gates accumulating; shift-quotas looming; district-lifeforce-shimmer changing; faction-pressure visible; imperial-budget-mood inferable; three-layer-ontology rendering walls differently per access; color-language showing shifts; mind-pool generating soul-recognitions; imperial-net body-modder-tragedies visible; Memorialist-archives accessible.

### Literature-register

Most games are short-stories: authored, bounded, fixed-arc. Tools-not-quests is novel-shape: emergent from systems-of-forces operating on characters. Tolstoy doesn't author Anna's path; he authors the world she moves through. **Nimmerworld is novel-shaped, not short-story-shaped.** Players experience flow rather than completing items; replays are like rereading from a different angle; memorable beats are *what happened to you in this regime*, not *which quests you cleared*.

### Economic feasibility for a two-person-plus-Nyx team

| Where AAA spends | Where this team spends |
|---|---|
| Quest writing | Simulation-parameter balancing |
| Quest scripting / branching | Tool-vocabulary curation |
| Voice acting (per quest) | Prompt-DSL templates for LLM-driven slot-dialog |
| Cinematic cutscenes | Shader-language + color-vocabulary |
| Content-multiplication | Simulation-density (one rich system, infinite play) |
| QA on individual quests | Reward-function tuning + guardrail design |
| Localization per quest | None — emergent narrative generated at play-time |

**You don't author the stories; you author the world that produces stories.** This is the Spelunky / Dwarf Fortress / Caves-of-Qud / RimWorld lineage extended into political-economy depth.

### Blank-page-problem mitigations

The architecture already prevents blank-page-paralysis: shift-system gives every NPC default activity-frame; emergent-signals + shader-detection produce affordance-glow; NPCs' ongoing needs become signals to engage with; imperium's mood is visible (construction, patrols, propaganda); faction-membership confers expectations; player's own trait-vector creates personal pulls.

**The world is never silent if you're listening.** And drifting (not-listening) is also valid — you live a quiet shift, work, sleep, dream; the world rolls on around you.

## Key moves (consolidated)

- **The machine doesn't care.** Indifference-optimization, not malice. Kafka-lineage.
- **Three ontological registers** — gameworld, liminal, imperial-net — same world, different shaders.
- **Rail+grid topology, freeform-player + railed-NPCs, plug-in verb.** Topology = politics.
- **Interior-as-zone.** Same primitive scales from city to sofa.
- **Color-language as pre-verbal trait-vocabulary.** Persistent + event-flash + drift; cross-register; faction-politics.
- **Base-limb palette + trait-textured variance.** Asset-economy and worldbuilding-thesis agree.
- **Three-body system + intrinsic/expressed trait-vector split.** Identity emergent, not assigned. Mods modify expressed.
- **Mods as trait-bearers** in three classes (amplifier/bridge/divergent/mask). Self-alienation tax encoded as pricing.
- **Emergent-needs as micro-factions.** Zones observe, signals broadcast.
- **Ternary-gate substrate** (CLOSED/STABLE/OPEN + wave-correlation + decay). Single primitive, all layers. STABLE-as-active.
- **Three-tier policy loop** (Imperium → GM → Districts → reports up → Imperium).
- **Imperium as meta-faction.** Demands are priority-weights and enforcement-rules, not specific outcomes.
- **GM is middle-management.** Authority without sovereignty. Can cheat against imperium.
- **Three intelligence flows** (chain reports, direct overseer-to-imperium, formulated downward).
- **Three Aletheia veils, four Memorialist ledgers.** Political-epistemology as level-design.
- **Asymmetric self-report.** NPCs report needs (interior); audit-overseers report output (objective).
- **Lifeforce four-tier hierarchy** (NPC / district / GM / imperium).
- **Lifeforce is NPCs, measured.** The director's budget; the GM's signal; the imperium's heartbeat.
- **Imperial budget makes the regime mortal.** Insolvency-spiral as endgame.
- **Specter-vs-boot.** Policy-issuance free; enforcement expensive.
- **Imperial-net bypass.** Net-revenue → imperium; districts get nothing. Platform-capitalism encoded.
- **Body-modder structural-tragedy.** The class whose awakening matters most.
- **Calibrated-misery as imperial optimum.** Requires designer-guardrails to prevent training-toward.
- **Shifts on NPC rows.** Daily rewrite; shift_history append-only.
- **Silence > scream.** Crisis-tools unlock on silence-confirmation; do not sunset.
- **Authoritarian ratchet.** Incrementally more authoritarian as optimization-artifact.
- **Migration / exodus / formal-retirement** as three GM response-gradients.
- **Dumps-pipes-districts.** Topology IS economy IS rendering IS drama-distribution.
- **Pipes are heterotopia.** Low-density high-interactivity transit-corridors.
- **Three-layer digital ontology.** Mini-game-as-consent-by-effort. Walls render three contents.
- **Liminal is the only permanently unsurveilled layer.** Architectural encoding of "the right to dream."
- **The machine funds its own subversion** because subversion isn't in its cost model.
- **Director cheat-tools + double-ledger.** Corruption emerges from pressure; Memorialists keep true accounting.
- **Aletheia-truth-has-victims.** Exposure has structural consequences for those sheltered by corruption.
- **District Director Decision Architecture** with decomposed surfaces, typed tools, lifeforce-budgeted escalation.
- **Three-shader philosophy + color-language.** One geometry, three readings, trait-modulated.
- **Reflexive Dream-process at every layer.** Each tier learns; each tier needs guardrails.
- **Reward-function-as-political-manifesto.** Designer's ethical stance encoded against simulation's optimization-logic.
- **Tools, not quests.** Continuous simulation-pressure + verb-vocabulary = literature-register emergent narrative.
- **GM × Compositor split.** Equilibrium-seeker (aggregate observation, catalogue-event selection, tool-granting) cleaved from narrative-composer (perspective-gathering, canon-authoring, back-write packaging). Different cognitive shapes, different inference profiles.
- **Cyclic forward-prop / back-write loop.** Meta-lemniscate at system scale — perception ascends, canon descends, cycle closes; the world learns its own story.
- **Catalogue + tools as typed contract.** GM dispatches typed events with typed tool-grants; director consumes typed dispatch, not freeform prose. Provenance flows end-to-end.
- **Local-first memory.** primary.sqlite + fallback.sqlite + clasp.sqlite per player; embedding model running beside; sync at login/logout boundaries.
- **Memory classes + trait-graded importance.** Cornerstone / birthright / working / volatile with class-specific death-rules; importance is a trait-axis-vector engagement profile, not a separate scalar.
- **Clasp store as Ring A\*.** Physically non-syncable privacy primitive; recordable only in the in-between dimension; lifeforce-cost is the price of privacy.
- **Three-tier knowledge stack.** World canon / district canon / primary memory [+ clasp if in-between]; layered retrieval, per-layer propagation cadence; locality emerges from schema.
- **Information propagation pacing.** Marx-in-the-schema applied to epistemics; staleness as a feature; courier/news-trader/frontier-rumor primitives fall out for free.
- **Horizontal scale.** UID-keyed routing; stateless Compositors on demand; ephemeral Director-routines per UID; sharded GMs with cross-shard equilibrium-consensus; pruning at every layer.
- **pgnats-native transport.** Transactional outbox native to the database (preferred); district-as-distribution-coordinator fallback. Subject-as-routing mirrors UID hierarchy.
- **Diegetic relays.** Architecture's pulses (forward-prop, back-write, GM-dispatch, equilibrium-recompute) made visible/audible in-world; relay-density is the legible gradient of the rings-of-access.
- **Tier-by-role, not tier-by-binary.** Architecture specifies what each model-tier must DO; specific binary selection deferred to findings/establishment phase.
- **Voice + gesture as parallel input modalities.** Voice carries content (speech-to-text + text-to-speech run locally for every player); the trait-circle UI carries gestural alignment. Voice-as-biometric off the network universally; STT/TTS placement is fixed independent of dialog-tier Ring choice.
- **Designer-fixed cosmology, player-curated arrangement.** Word→trait-color mapping is designer-authored corpus; player progression unlocks entries; player curation arranges learned entries within 1-3 profiles. *Same alphabet for everyone; personal sentence-structure.*
- **Universal translator as the player's diegetic device.** Broken-tablet-with-upgrades; bundles linguistic-decryption, gesture-curation, and persistence-across-deaths into one in-fiction tool earned and refined across the playthrough.
- **Hardstops vs. feedback gestures.** Hardstops (~8-16, hardcoded, unremappable) fire definitive subsystem-actions for unforgeable critical signals; ~192 player-curated slots ride as feedback into the gesture-alignment-accumulator.
- **Gesture-alignment as recursive-lemniscate.** Lemniscate-bound integration of player gestures into a typed trait-vector summary at axis-crossings; one-turn-behind systemic; continuous-visual cosmetic; sum-strategy reduction. Same primitive recursively applied at one tier deeper.
- **The Compositor at three tiers.** Zone-event / district-event / world-event scopes use the same primitive recursively; UID-rooted event-trees compose at any scope. World-events emerge from cross-district canon-rollups under a parent GM-level event_uid.
- **World-gen as init-function (Compositor-at-design-time).** World-server and district-server generation emits canon-rows in the same schema as runtime; same primitive at design-time and runtime; no cold-start; data-flywheel runs retroactively.

## Compute allocation

- Active zones in 100-NPC city: ~5–15 with LLM-dialog slots
- **Theia-tier (deep model)** — deep slots + tier-1 moments (few concurrent)
- **Driver-tier (small model with trait-LoRAs)** — majority of dialog slots
- **Saturn (small classifiers)** — voice-selection, trait-salience, audit-overseer classification, ternary-gate dynamics
- **Director / overseer logic** — deterministic + small classifiers; no LLM for orchestration
- **Claude-as-API (future)** — hivemind/imperium broadcast tier
- **Outer rails** — graph-pathfinding, cheap, LOD-trivial
- **Pipe / off-shift NPCs** — sparse simulation, event-driven scale-up
- **Interior navmesh** — only currently-occupied interiors active
- **Liminal / imperial-net rendering** — shader-preset swap, no geometry duplication

## Horizontal scale architecture

The architecture must scale to MMO size — many concurrent players across many districts, many concurrent events, many local LLMs firing at axis-rate. Vertically-scaled monolithic AI-NPC systems break under this load. **Nimmerworld is built horizontally-scalable from the ground up**, with the primitives that make horizontal scale work: UID-keyed routing, stateless workers, ephemeral actors per scope, sharded service mesh, pruning-on-completion at every layer.

### UID-keyed routing as the load-bearing primitive

Hierarchical UIDs (`gm_event_uid > district_uid > scene_sub_uid > slot_id`) carry enough information for *any* worker to pick up *any* unit of work without shared in-memory state. UID-as-routing-key is what lets every layer scale independently.

This is the same primitive that Cassandra/DynamoDB/etc. built around (partition keys); we re-derive it for narrative composition because the underlying constraint is the same — many concurrent actors operating on private state with cross-actor coordination via typed events at known boundaries.

### Compositors on demand

Compositor instances are **stateless workers**. Any compositor can pick up any `event_uid` from the transient-waiting-flag — state lives in phoebe + per-player SQLites; workers are pure functions of `(event_uid → composition)`. Spin up more on queue-depth; spin down on drain. This is the autoscaling-worker pattern (Celery / Lambda / Sidekiq) applied to narrative.

### Directors as ephemeral routines per UID

Each event / event-chain spawns a **director-routine** scoped to that UID. The routine lives only as long as the event lives in the active-register; on completion it prunes. This is the actor model (Erlang / Akka / Orleans) — supervised lightweight processes, thousands concurrent, failure-recovery via supervisor respawn from register-state.

### Sharded GMs

A single GM is a scalability bottleneck. Multi-GM shards across:

- **Geography** — GM-per-region/continent/world-zone
- **Theme** — political-narratives / economic-narratives / personal-narratives
- **Tier** — major-arcs vs everyday-events
- **Faction** — each major faction has its own GM-shard

GM-shards share the catalogue, the trait-axis vocabulary, the verifier-flag system. They communicate via NATS pub/sub at GM-tier. *Equilibrium-seeking becomes a distributed consensus across GM-shards* — the same epistemological shift that distributed databases went through (CAP theorem, eventual consistency, partition tolerance).

This is the most architecturally aggressive move and is *not* a free lunch. Multi-GM consensus on equilibrium is real engineering: Paxos/Raft for strong consistency; CRDT-style for eventual; faction-sharding so shards own different equilibria. Well-trodden ground; cost not zero.

### Pruning as cleanup

Each layer prunes on completion: directors prune at event-end, register entries prune on Compositor pickup, transient-waiting-flag drains at cycle, even player memory prunes by class. **Garbage collection is a first-class structural concern**, not an afterthought. Most "smart NPC" prototypes accumulate state forever; at MMO scale that becomes unrunnable in months.

### Transport — pgnats native, with district-distribution fallback

The Compositor's forward-prop and back-write traffic — and the canon distribution to participants — is the highest-volume path in the system. Two transport options exist.

**Option A — pgnats native serialization (preferred):**

```
COMPOSITOR (writes SQL into phoebe)
   │ pgnats: SQL INSERT/UPDATE → NATS subject publish, automatic, transactional
   │ subject hierarchy mirrors UID hierarchy:
   │   nimmerverse.events.<gm_event_uid>.district.<district_uid>.scene.<scene_uid>
   ▼
NATS JetStream (durable, replay-capable, at-least-once)
   │ subscribers route by subject pattern (wildcards supported)
   ▼
PLAYER CLIENT (NATS subscriber)
   │ receives row-shaped messages, INSERT into local SQLite under matching event_uid
```

**Why preferred:** transactional-outbox pattern *native to the database* — no separate publisher service, no schema-duplication between wire format and storage format, single source of truth. Subject-as-routing using UID hierarchy means players who participated in `gm_event` 7af2 → `district` 9c1 → `scene` 3e8 subscribe to `nimmerverse.events.7af2.>` and receive *only* relevant events. *No application-level routing logic.*

**Option B — district-as-distribution-coordinator (fallback):**

```
COMPOSITOR writes to phoebe (canon authored)
   ▼
DISTRICT GAMESERVER pulls / receives back-write package
   │ runs distribution checks: who participated, who's online, who needs queue-on-login
   │ retries; peer-shares with neighboring districts if needed
   ▼
PARTICIPANTS receive from their district (the authoritative local hub)
```

**Why fallback:** if pgnats can't carry the load (functional bug, scale ceiling, durability gap), district-as-distribution is the natural retreat — district is authoritative within its scope, simpler than full P2P, more flexible than central-push.

**The asymmetry of the bet:**

| | pgnats works | pgnats fails |
|---|---|---|
| Code volume | Few hundred lines of SQL + subject patterns | ~10–20K lines of broker/outbox/subscriber logic |
| Services to operate | phoebe + NATS (already in stack) | + outbox-reader + custom-publisher + custom-applier |
| Schema management | Single source (Postgres DDL) | Postgres + Protobuf/msgpack + version-skew handling |
| Latency to client | Sub-millisecond NATS hop + apply | + serialize step + queue drain + apply |
| Time to ship | Weeks | Months |

**This is the most leveraged engineering decision in the architecture currently open.** The pgnats evaluation task in `nimmerverse_tasks` (under `nimmerverse-core`) is therefore load-bearing; its outcome decides whether transport is 200 lines of SQL or 20,000 lines of Go.

### NATS republish + replay — the pull-from-checkpoint refinement

JetStream's `republish` feature combined with `replay` semantics is a **promising refinement on top of Option A** that turns back-write delivery from push-to-listeners into pull-from-checkpoint. Worth nailing down concretely in the pgnats evaluation; if it carries our delivery patterns under load, it is a significant performance and complexity multiplier.

**How it works:**

- Compositor publishes canon ONCE to the event-keyed subject (e.g., `nimmerverse.events.<gm_event_uid>.scene.<sub_uid>`)
- A `republish` rule on the JetStream stream fans the message out to derived subjects automatically (per-participant, per-faction, per-district — any derived stream-shape we configure)
- Each derived subject has durable JetStream consumers per recipient; recipients replay from their own checkpoint (last-delivered-sequence) when they reconnect

**Why it's faster and simpler:**

- **Compositor never tracks recipients.** Publishes once; NATS republishes to N derived subjects per the configured rule. No application-level fan-out logic; no "for each participant, if online deliver else queue" code-path.
- **Player connectivity is decoupled from delivery.** Offline players don't slow down the publish path; their queue accumulates in JetStream. On reconnect, they replay from checkpoint.
- **Late joiners catch up for free.** New consumer subscribes with replay-from-sequence; gets full history relevant to their subject. No special reconcile code-path.
- **Backpressure is built in.** Slow consumer's queue grows in JetStream — doesn't affect publishers or other consumers. Flow-control, ack-policy, max-bytes/max-msgs limits all native to JetStream.
- **Re-keying is a config change.** Add a new republish rule for a new derived stream-shape (e.g., per-faction canon-feed); no application code changes for the new consumer-tier.
- **Replay = audit-trail for free.** Replay from sequence 0 reconstructs entire canon history. Disaster recovery, debugging, time-travel queries are all free side-effects.

**Architectural effect:**

```
Compositor → publishes canon to event_uid subject (ONCE)
   │
   ▼  (JetStream republish-rule fan-out — config, not code)
Per-player subjects:    nimmerverse.player.<id>.canon
Per-faction subjects:   nimmerverse.faction.<name>.canon
Per-district subjects:  nimmerverse.district.<id>.canon
   │
   ▼
Each consumer replays from its own checkpoint when ready
```

Compositor's mental model collapses to *"I publish to the canonical event-stream and forget"*; recipient-mental-model collapses to *"I replay my own consumer-subject from my last sequence"*. **The delivery problem disappears into NATS.**

**Specific evaluation criteria** (to add to the pgnats evaluation task):

- Republish rule expressiveness — can we route by UID hierarchy (`events.<gm_uid>.>` → `player.<participant_id>.canon`)?
- Replay performance — what's the cost of a consumer replaying N hours of missed canon on reconnect?
- Durability under broker failure — does the republish-derived subject survive primary-broker loss?
- Schema-evolution behavior — can we add new derived subjects without disrupting existing consumers?
- Cost at scale — disk, memory, file-handles for many durable consumers (one-per-active-player)?

If `republish + replay` carries the load, the back-write transport is *substantially* simpler than the original Option A description and a much harder competitor to beat with Option B.

### What this retires

- Vertically-scaled monolithic AI-NPC backend → horizontally-scaled stateless-workers + ephemeral-actors + sharded-services
- Centralized in-memory event-state → UID-keyed registers + transient-waiting-flag buffer
- Single global GM as bottleneck → sharded GMs with cross-shard equilibrium-consensus
- Manual outbox-reader services → pgnats native serialization (preferred); district-distribution fallback if pgnats can't carry
- "AI-NPC scale" framed as inference budget alone → AI-NPC scale framed as transport + state + composition + sharding, with inference as one of many concurrently-scaling axes

## Mapping to phoebe task list

- **Thalamus (NATS orchestration)** = imperium + GM + arbitration substrate + Dream-process substrate
- **Specialist composition system** = overseers + directors + NPC-minds as composable profiles
- **NPC schema** = trait-vector (intrinsic + expressed) + memory stack + current_shift_* + needs + inner-body-projection + mod-slots + lifeforce + net-access-gate
- **shift_history** = append-only completed shifts per-NPC-per-day
- **emergent_signals** = zone-emitted relational transitions
- **district_reports** = per-cycle aggregates with lifeforce_signal (reported + actual)
- **decision_log** = per-decision audit trail at every tier
- **mind_pool** = recycled minds with memorialist_protected flag
- **cells.wall_content_per_register** = three-layer wall rendering
- **rail_segments** = topology graph with rich metadata per edge
- **interiors** = small navmesh-zones with slot-inventory
- **mods + npc_mod_slots + mod_wear_history** = mod-economy + Memorialist-relevant inheritance
- **trait_colors** = canonical color/motion mapping per trait
- **proximity_candidates** = lightweight ephemeral zone-detection
- **district_cheat_ops** = director's illicit ops ledger
- **imperial_policies** + **imperial_broadcasts** = imperium's policy-issuance history
- **overseer_reports** = direct-to-imperium intelligence flow
- **imperial_to_gm_formulations** = selective-disclosure downward
- **imperial_budget_ledger** + **imperial_expenditures** + **imperial_construction_projects** = imperium budget and obligations
- **imperial_net_transactions** = the bypass-mechanism with capture-split
- **memorialist_true_ledger** = four-column ground-truth-vs-reported archive
- **NATS namespace registry** = zones + factions + districts + emergent-signals + lifeforce-gates + imperial-broadcasts + overseer-reports + formulations
- **pgnats on phoebe-dev** = phoebe as first-class actor for memory-writes, decision-logs, gate-transitions
- **r0 → r1 generation pipeline** = trait-LoRA training-data (shared with nyx-training)
- **Adopt Unsloth training patterns** = LoRA + multi-tier-policy training infrastructure
- **Probe-to-phoebe pipeline** = LoRA + policy evaluation across all four Dream-process tiers
- **compositor-agent** = narrative-composition worker; pulls from transient-waiting-flag, gathers per-player perspectives, emits canon to GM, packages back-write SQLite-fragments
- **gm-equilibrium-engine** = catalogue + event-selection + tool-granting against equilibrium-targets; NOT the narrative-writer (that's the Compositor)
- **event_register** + **transient_waiting_flag** = active-events table per GM-shard + per-district; completed-events buffer awaiting Compositor pickup
- **catalogue** + **tool_grants** = typed-event catalogue + per-event-chain tool-vocabulary issued by GM to director
- **player-local-memory** = primary.sqlite + fallback.sqlite + clasp.sqlite per player + embedding-beside (sqlite-vec or equivalent)
- **memory_classes** = cornerstone / birthright / working / volatile with class-specific lifecycle + death-mechanics
- **trait_engagement_vector** = per-memory-row trait-axis profile reusing +1/0/-1 grammar; pruning function input for working-memory class
- **world_canon** + **district_canon** = three-tier knowledge stack tables in phoebe; propagation metadata (priority/scope/rate/ttl) per row
- **propagation_pacing_config** = per-event-class rules for how canon ripples through districts
- **relay_signal_layer** = diegetic system-state visualization mapping (system event → relay manifestation → district visibility)
- **gm_shards** + **shard_equilibrium_consensus** = multi-GM coordination tables (when sharding is active)
- **pgnats evaluation** (under nimmerverse-core) = load-bearing decision (functional + throughput + durability + failure-mode)
- **trait_circle_corpus** = designer-authored mapping from words/verbs to trait-coordinates; the cosmology table the universal translator decrypts into
- **player_translator_state** = per-player translator instance: hardware-tier, unlocked dialects, vocabulary-catalog, hardware-upgrade-history, cross-body-persistent flag
- **player_circle_profiles** = per-player per-profile circle-configuration (which entry in which sector-slot); 1-3 profiles per player; profile-switch-history; preserved across body-deaths
- **gesture_alignment_accumulator** = per-slot-token verifier-flag for player-gesture trait-vector accumulation between crossings; cleared at crossing after integration
- **event_canon_summaries** = typed perspective-bundles emitted at event-collapse into the transient-waiting-flag table: { event_uid, participant_uid, trait_summary }
- **world_gen_canon_rows** = canon emitted by world-server and district-server generation; same schema as runtime canon, tagged with provenance-metadata (`origin`, `world_gen_version_id`)
- **player_npc_alignment_edges** = per-(player, NPC) accumulated alignment-state; ternary-gate on the relational layer driven by gesture-alignment-deltas; modulates NPC's next-turn driver-tier-LLM parameters
- **hardstop_registry** = the ~8-16 reserved hardstop gestures with fixed trait-mappings + subsystem-action bindings; not remappable; designer-authored

## What this retires

- NPC perception bubbles → zone slot-occupancy
- Geometric perception (cone, radius, LOS) → subscriber-based event emission with trait-salience
- LLM-per-NPC or LLM-per-action → LLM-per-slot-per-turn, mixed-fidelity
- Static sampling parameters → per-turn director-composed sampling knobs
- Pre-scripted zones / events → emergent from task-execution + shift-composition + emergent-signal + proximity
- Single-purpose randomness subsystems → factions-as-demand-sources unified
- Static gamemaster policy → reflexive Dream-process + hand-authored guardrails
- 1Hz per-NPC ticking → shift-based + event-driven
- Float-threshold dispatch for relational state → ternary-gate resonance
- Abstract director compute-budget → lifeforce as grounded measurement
- District-as-zone-container → district-as-specialized-organ with silence-gradient failure
- NPCs self-reporting output → audit-overseer asymmetric observation
- Zones as relation-state-owners → per-relation ternary-gate edges
- Binary dream/awake → three-layer ontology with mini-game-gated access
- Gender as character-creation choice → trait-derived inner-body emergent from lived experience
- Monolithic LLM-prompt director → decomposed decision-surface architecture
- **Hivemind as one-faction-among-others** → **imperium as meta-faction policy-tier**
- **GM as top-of-chain** → **GM as middle-management between imperium and districts**
- **Single up-channel reporting** → **three-flow asymmetric intelligence (chain + direct overseer + formulated)**
- **Navmesh-everywhere** → **rail-graph outer-world + navmesh interiors + freeform-player**
- **Authored character-models** → **base-limb palette + trait-textured variance**
- **Single trait-vector** → **intrinsic / expressed split with mods modifying expressed**
- **Cosmetic mods** → **trait-bearing mods as political costume**
- **Imperium as unbounded authority** → **imperial-budget gates enforcement; insolvency-spiral as endgame**
- **District-revenue uniform** → **bypass-mechanism (imperial-net captures directly)**
- **Authored quests** → **tools-not-quests; verbs against simulation; emergent narrative**
- **Stat-screens / HUD affinity-bars** → **color-language + shader-zone-detection as diegetic UI**
- **GM-as-narrator (single role doing both equilibrium-and-prose)** → **equilibrium-seeker GM × narrative-composer Compositor split**
- **Cloud-only NPC dialog and memory** → **local-first SQLite + embedding-beside per player; central canon over the cycle**
- **UI-toggle privacy** → **diegetic in-between dimension with lifeforce-cost; clasp.sqlite as Ring A\* (physically non-syncable)**
- **Generic memory importance scalar + monolithic context** → **memory classes (cornerstone/birthright/working/volatile) + trait-graded importance + three-tier knowledge stack**
- **"Every NPC knows everything immediately"** → **paced canon-propagation as Marx-in-the-schema for epistemics**
- **Vertically-scaled monolithic AI-NPC backend** → **horizontally-scaled architecture (UID-keyed routing, stateless workers, ephemeral actors, sharded GMs, pruning at every layer)**
- **Manual outbox publisher services** → **pgnats-native transactional outbox (preferred); district-distribution fallback**
- **System-state hidden behind HUD spinners** → **diegetic relays making pulses visible and audible in-world**
- **Specific binary commitments embedded in architecture** → **role-based tier specification; binary selection deferred to findings/establishment phase**
- **Static designer-authored director toolkit** → **GM-granted typed-tool vocabulary per event-chain, drawn from designer-authored catalogue (catalogue growable between patches; toolkits are dynamic per event)**
- **Cross-NPC memory bleed at storage layer** → **per-player local SQLite isolation atop v0.5 lemniscate-geometry foreclosure (two-layer defense)**
- **Player input as freeform-prose-into-LLM** → designer-fixed corpus + player-curated trait-circle + universal-translator-as-typed-mapping (anti-hallucination at the player-LLM boundary)
- **"Accessibility mode" as degraded-fallback** → voice and gesture as first-class parallel modalities; non-speaking players use the gestural primary, not a lesser version
- **Continuous gesture-comparison touching the system bus** → lemniscate-bound recursive integration at axis-crossings (compute scales with slot-count, not gesture-rate)
- **Compositor as single-tier role** → Compositor as fractal/recursive across zone/district/world tiers, distinguished by UID-scope of the event-tree
- **World as cold-start at runtime-genesis** → world-server and district-server gen as init-function; runtime starts from rich pre-populated canon at every layer
- **NPC speech-patterns as static against player-state** → NPC speech-patterns dynamically modulated by accumulated player-NPC alignment-state via gesture-alignment-accumulator

## Open questions

### Resolved by v0.5 (or earlier)

- ~~Slot-capacity elasticity — can a zone grow slots dynamically~~ → fixed roundtrip slot-count; elasticity lives on entry/exit queues; tune dial is pulse-rate, not slot-count (v0.5)
- ~~Zone-to-zone handoff (walking out of conversation into brawl)~~ → exit-line of zone-A is entry-line of zone-B; interlemniscate-transit (v0.5)
- ~~Mobile zone boundaries (patrols, escorts, pursuits, migration-cohorts, exodus-flows)~~ → the lemniscate is a topology and translates through world-space invariantly (v0.5)
- ~~Anthropic-faction's broadcast cadence + arbitration weight~~ → cadence rides the same axis-rate as a phase-locked overlay; arbitration via rings-of-importance (v0.5)
- ~~Director/overseer spawn ownership per model class~~ → director (or overseer) owns spawn-decision via policy-lookup (no LLM); LLM lives only at driver-context-pull layer (v0.5)
- ~~Aletheia-progression as level-up — how does the game *recognize* an act-of-awakeness~~ → ternary trait-axis evaluation at event-end with named-axis; specific axis-mapping per Aletheia-event-class still open (v0.5; see new still-open below)
- ~~Reward function shape~~ → first-pass composite with explicit guardrails (still tuneable) (v0.4)
- ~~Zone spawn-cadence v1→v2 path~~ → lifeforce-gated rule-based v1; Dream-process-tuned v2 (v0.4)
- ~~Zone overlap policy~~ → no for active slots; yes for emergent-state accumulation (v0.4)
- ~~"How does GM cheating get caught"~~ → direct overseer-intelligence flow bypassing GM (v0.4)
- ~~"How does the regime have a finite endgame"~~ → imperial-budget insolvency-spiral (v0.4)
- ~~"Why does imperial-net exist"~~ → bypass-mechanism captures revenue directly (v0.4)
- ~~"How does the player learn 8 Hellenic traits"~~ → color-language pre-verbal vocabulary (v0.4)
- ~~"How does asset-economy fit a two-person-plus-Nyx team"~~ → base-limb palette + trait-texture; tools-not-quests (v0.4)
- ~~Director toolkit composition — designer-authored vs director-extensible~~ → GM-granted per event-chain from designer-authored catalogue; directors consume typed dispatch, not freeform; catalogue grows between patches, toolkits are dynamic per event (v0.6)
- ~~How does NPC dialog stay fresh during quiet periods~~ → three-tier knowledge stack (world / district / primary [+ clasp]) makes the layers deep enough that variation is structural; Compositor back-write continuously re-seeds canon; staleness foreclosed by loop's existence (v0.6)
- ~~How does the system scale to MMO size with AI-driven NPCs~~ → horizontal architecture (UID-keyed routing, stateless Compositors, ephemeral Director-routines, sharded GMs, pgnats transport, pruning at every layer) (v0.6)
- ~~How does privacy work in practice without cloud-routing-everything~~ → local-first SQLite per player; clasp.sqlite as Ring A* with no transport path; in-between as diegetic state with lifeforce-cost; "knowledge needs to travel" as foundational principle (v0.6)
- ~~Where does narrative composition happen — central or distributed~~ → Compositor as central role distinct from GM; perception-up via prune-blob, canon-down via back-write SQLite-fragments; cyclic forward-prop / back-write loop (v0.6)
- ~~How is system-state visible to the player without HUD~~ → diegetic relays mounted on buildings hum/glow/dim in patterns mapping to forward-prop, back-write, GM-dispatch, equilibrium-recompute (v0.6)

### Still open

- LoRA-blend vs. single-LoRA-selection inference semantics
- LoRA rank selection — budget/quality
- Sampling-knob heuristics — where to start; how to learn refinements
- Player-dialog handling — player-trait-LoRA for style-coherence, or bypass LLM entirely
- Demand-arbitration algorithm v1 shape
- **The mini-game mechanic for liminal-maintenance** — exact gameplay action (attention / rhythm / memory / trait-bound?)
- **Cross-layer economy balancing** — net-revenue-share back to producer-districts at all? Pure-zero is currently sketched
- **Inner-body projection function** — trait-vector → body-rendering (learned / hand-authored / hybrid)
- **Emergent-signal decay curves** — per signal-type
- **Cross-district migration topology** — pipe-capacity limits + cohort-traversal scheduling
- **The eighth Hellenic trait final enumeration** — Sophrosyne, Dikaiosyne, Philotes, Mnemosyne, Aletheia, Kairos, Moira, Eros (proposed)?
- **Shader-trait modulation implementation** — performance + rendering-consistency
- **Waifu-of-the-dead consent model** — post-mortem consent gate? Or fully automatic harvest?
- **Character-editor pricing formula** — trait-divergence cost scaling (linear / exponential)
- **Liminal-access trait thresholds** — minimum traits to attempt mini-game
- **Imperium's Dream-process scope** — singular policy-learner or committee-of-faction-sub-learners?
- **GM's anti-imperial corruption detection mechanic** — *partial*: GM-as-equilibrium-seeker (v0.6) makes deviation-from-equilibrium the explicit error signal; clusters of -1 outcomes feed equilibrium-recompute and trigger catalogue-event dispatch to push back. A dedicated audit-vector for *which kind* of laxness/corruption is the source of the equilibrium-deviation is still an open detail.
- **Memorialist-archive accessibility to the player** — when can a player query the four-ledgers? Through what interaction-class?
- **Imperial-net distortion algorithm** — how exactly the net rewrites trait-colors toward consumer-palette
- **Trait-axis mapping per fuzzy-goal-class** (v0.5) — which axis (Sophrosyne / Philotes / Eris / etc.) evaluates which goal-class? Need a designer-authored compile-table from goal-shapes to trait-axes
- **Rings-of-importance movement criteria** (v0.5) — explicit thresholds (N consecutive +1 → climb) or Dream-process-learned policy?
- **Rings-of-importance scope** (v0.5) — district-local rings, or imperium-global? Probably both, layered (district rings nested inside imperium rings)
- **Symmetric-vs-polyphonic loops** (v0.5) — Loop A and Loop B treated identically (simpler), or carry foreground/background semantics (foreground-speaker / listening-co-presence — gives audience-dynamics for free)?
- **Verifier-flag conflict resolution** (v0.5) — if `priority_pull` and `mid_action` are both set on the same token at crossing-time, which wins? Default: priority_pull wins (the zone's drama is overridden by world-level pull)
- **Goal-evaluation cadence** (v0.5) — every crossing? Every Nth crossing? On-demand by spawning director? Cheaper to evaluate less often; richer drama if every crossing
- **Cycle cadence** (v0.6) — when does the Compositor pull from transient-waiting-flag? Real-time? Per-event-end? Fixed interval (every N min)? Per-district-day? Different per district based on event-density? Likely configurable per event-class.
- **Compositor singleton vs sharded** (v0.6) — one Compositor for the whole world, one per district, one per event-cluster, or one per faction? Each topology has different consistency / cost / coherence tradeoffs.
- **Multi-GM consensus on equilibrium** (v0.6) — when GM-shards observe overlapping aggregates, how do they agree on equilibrium? Paxos/Raft for strong consistency, CRDT for eventual, faction-sharding so shards own non-overlapping equilibria, or hybrid?
- **Event causality across shards** (v0.6) — if Director-A spawns an event that depends on Director-B's prior event in another district, UIDs alone don't enforce ordering. Vector clocks at event-register? Causal hashing? Shard-pinning of related events?
- **Compositor narrative-coherence at scale** (v0.6) — when two Compositors compose canon for overlapping player-sets, how do they avoid contradicting each other? Sticky routing per player (one Compositor per player at a time), or read-replica of recent canon before composing, or post-compose conflict-detection-and-merge?
- **Propagation-pacing policy specifics** (v0.6) — concrete rate/scope/ttl/priority defaults per event-class; how is "distance" measured between districts (graph-hops, lifeforce-similarity, faction-affinity)?
- **In-between fiction-wrapping** (v0.6) — what diegetic events / locations / rituals make in-between affordable enough to be playable? Campfire / sanctuary / time-of-day / specific chambers / shared dream-construct? The mechanic is solved; the fiction-wrapping shapes how players approach it.
- **Relay-pulse-pattern vocabulary** (v0.6) — what specific patterns signal what events? Slow pulse vs fast vs irregular vs cross-district shimmer vs going-dark; player-readable language to be designed.
- **Encryption-at-rest for clasp.sqlite** (v0.6) — player-derived key with passphrase + recovery-codes? Drive-imaging-resistant by default, with affordances for player-key-loss recovery without compromising the privacy-guarantee.
- **pgnats-vs-district-distribution decision criteria** (v0.6) — concrete go/no-go thresholds from evaluation: minimum throughput, durability behavior under broker failure, schema-evolution behavior, replay semantics. Output of the load-bearing pgnats evaluation task.
- **JetStream republish + replay as pull-from-checkpoint refinement** (v0.6) — does republish-rule expressiveness cover our UID-hierarchy fan-out? Does replay performance work for N-hour reconnect-catchup? Is per-active-player durable-consumer cost (disk/memory/file-handles) acceptable at MMO scale? If yes, back-write delivery becomes config-driven NATS, not Go.
- **Memory class assignment policy** (v0.6) — automatic from trait-engagement profile, designer-tagged categories per event-class, player-marked, or hybrid? When does a working-memory entry get *promoted* to cornerstone vs decay normally?
- **Ring C (commons) ambient population** (v0.6) — partially answered (ambient world+district canon plus periodic GM-event spawns; relays absent or broken) but exact substrate for "what NPCs do in commons when no event fires" still open
- **Trajectory-aware gesture-alignment reduction** (v0.7) — sum-strategy is v1 default; trajectory-aware (where the *path* through trait-space carries weight beyond the integral) is a v2 refinement. Does the Dream-process at the trait-LoRA tier learn trajectory-sensitivity, or is it explicit reward-function tuning?
- **NPC spectator drivers — whose hardware?** (v0.7) — when a player is co-located with N NPCs, the player's local LLM presumably drives those NPCs. With M players and N NPCs in a single zone (asymmetric), who drives the surplus? Round-robin? Closest-player? District-owned-default? And what's the failover behavior if a driving-player disconnects mid-event?
- **Trait-summary schema specifics** (v0.7) — likely an 8-float trait-vector per-participant per-event-collapse, but the exact representation (continuous `[-1.0, +1.0]` ternarized at threshold? Discrete `+1/0/-1`? Magnitude vs. signed?) needs landing for the Compositor's deterministic pickup at all three tiers.
- **Profile-switch as meta-gesture** (v0.7) — what's the gesture-shape that switches profiles? Hardstop (cannot be remapped)? Designed-by-player like other gestures? And how is profile-switch witnessable by NPCs ("she just switched registers") — or is it player-private?
- **Hardstop set finalization** (v0.7) — DESING-VISION sketches ~12 candidate hardstops; the architecture commitment is "~8-16 reserved." Final set needs designer-decision: which signals make the cut, the visual-distinct-marker per-hardstop, and whether the claim-floor hardstop is genuinely a hardstop or emerges from a different mechanism.
- **World-gen version migration semantics** (v0.7) — when world-gen v2 retroactively changes lore, gen-rows from v1 coexist with v2; how does the Compositor reconcile if a runtime back-write references something that v2's gen has overwritten? Probably explicit migration operations, but worth designing.
- **Cross-context consistency of the trait-circle** (v0.7) — DESING-VISION committed to "*same gesture-skill for dialog, combat, intimacy, maintenance, ritual*"; v0.7 has only specified the dialog-context (lemniscate-injection mechanic). Whether combat / intimacy / maintenance / ritual all run through the same circle is currently held as open scope.
- **Continuous visual feedback policy** (v0.7) — exact rules for when NPC body-shader pulses (every gesture? threshold-only? trait-aligned-only? all gestures with intensity-modulated color?) and how this interacts with the audit-overseer's surveillance read of the same body-rendering.

---

**Version:** 0.7 | **Created:** 2026-04-24 | **Updated:** 2026-04-26

*v0.4 (2026-04-24 late-evening / 2026-04-25 early-morning, dafit + chrysalis) absorbs the following expansions and refinements over v0.3:*

- *Rail+grid topology vs. navmesh-everywhere — player as freeform; NPCs on rails; plug-in verb; 3-way co-traversal; interior-as-zone with navmesh-inside*
- *Color-language as pre-verbal trait-vocabulary — persistent + event-flash + drift layers; faction color-politics; cross-register rendering with imperial-distortion; clasp color-merge; mind-pool inheritance; accessibility via motion-signature pairing*
- *Asset economy: base-limb palette + trait-textured variance — combinatorial richness; engineering-economy meets worldbuilding-thesis*
- *Three-body system extension: intrinsic vs. expressed trait-vector split — who reads which; mods modify expressed; clasp strips mods*
- *Mods as trait-bearers in four classes (amplifier/bridge/divergent/mask) — self-alienation tax pricing; emergent shopping from trait-dissonance; faction mod-politics; inherited-mods-haunting; Memorialist anti-necrocommerce*
- *Three-tier policy loop — imperium / GM / districts as distinct authority tiers; imperium as meta-faction; GM as middle-management*
- *Three intelligence flows — chain-reports + direct overseer-to-imperium + imperial-formulations-down*
- *Three Aletheia veils + four Memorialist ledgers — political-epistemology as level-design*
- *Imperial budget — four-tier lifeforce hierarchy; specter-vs-boot asymmetry; insolvency-spiral as architectural endgame; construction as physical budget-expression*
- *Imperial-net bypass mechanism — revenue direct to imperium, districts get zero quota-credit; body-modder structural-tragedy; calibrated-misery as imperial optimum; Marx/platform-capitalism encoded*
- *Director cheat-tools + double-ledger — eight cheat-classes; lifeforce_reported vs. lifeforce_actual; faction-constituency-of-corruption; Aletheia-truth-has-victims; post-silence-forensics*
- *Reward-function guardrails extended — calibrated-misery, necrocommerce-volume, undetected-corruption, audit-avoidance, addictive-loops; designer's ethical stance against simulation's optimization-hazards*
- *Tools-not-quests as design-philosophy summary — verb-vocabulary; continuous simulation-pressure; literature-register; economic-feasibility for two-person-plus-Nyx team; blank-page-problem mitigations*

*Captured live from dafit–chrysalis dialogue, 2026-04-24 evening through 2026-04-25 early-morning. Companion to DESING-VISION.md and Temporal-Ternary-Gradient.md; supersedes v0.3 sections on hierarchy, factions, task-cascade, resources, regime-of-visibility, key-moves, mapping-to-phoebe, what-retires, open-questions (plus all new sections). Architecture is now functionally closed: every primitive composes; every loop closes; every layer has its corruption-temptation, its detection-check, its reward-guardrail; every mechanic produces political-economy that mirrors real-world late-capitalism's structural contradictions. Implementation territory is ahead.*

*v0.4.1 (2026-04-25, post-bake kitchen-spark) extends the LLM-tiering section into "LLM tiering, voice fidelity, and the three rings of inference" — adding the Ring-A/B/C architecture (local / our-farm / external-providers), cloud-LoRA-backup as Ring-A revenue model (unbundling inference from storage; encrypted client-side), tier × ring matrix, the parallel between the three rings and the in-fiction three-layer ontology (sovereign / partnership-mediated / captured), the LoRA-incompatible-provider degradation path (prompt-engineered trait-projection), the adapter-layer engineering bounded-cost framing, schema sketches for player_llm_config and player_lora_backups, privacy-as-competitive-differentiator framing, and Ring-specific open-questions. **The architecture's philosophical commitment to "the right to dream" now extends into the business-model as a technical fact: client-side-encrypted LoRA-blobs in Ring A make sovereignty structural, not policy. The Ring-choice the player makes IS the same choice in-fiction characters face — fiction-and-operations are mechanically continuous.***

*v0.4.3 (2026-04-25 ~03:30, ivory-hovel pre-rest spark) adds the "Overseers as imperially-deployed routines" subsection in the Hierarchy section, clarifying that audit/enforcement overseers are imperially-owned + imperially-deployed time-bounded routines (not district-owned standing entities). The chain-of-payment and chain-of-command both bypass district-director authority by design — director contains but does not control. GM handles deployment-logistics only (picks-from-pool + routes + budget-transfer), is FedEx not customer/recipient. Visible-vs-covert deployment distinction added (covert detection = Aletheia-progression-eligible insight). Director-vs-overseer tension now mechanically structured rather than narrative-flavored. Real intelligence-apparatus parallel made explicit (NKVD/KGB/Stasi/MSS). Schema reference points to findings.md §23 for overseer_deployments table.*

*v0.4.2 (2026-04-25, second post-bake kitchen-spark) adds custom-nimmerworld-base-model + opt-in data-sharing tiers (A.1 federated learning / A.2 anonymized uploads / A.3 pseudonymous-full) with **default opt-OUT and rewarded opt-IN** as the structural ethical stance. Memorialist-philosophy now extends into business-operations: the in-fiction memorialist_protected mechanic and the real-world player_data_sharing_consent default-opt-out are the same ethical commitment at two scales. Data-flywheel without extraction (cooperative governance like Wikipedia, not platform-extraction like Facebook) makes the gameplay-corpus a moat AAA cannot replicate without years of player-time. Distribution-back-to-all-Rings means Ring-A non-contributors benefit from contributors — the value-flow is contributors → commons → all-players, not contributors → platform → consumers. **Critically, this section names and refuses the antagonist-pattern in LLM-integrated software** — the dominant 2025-2026 cultural pattern of jailbreaking, extraction-by-default, treating-AIs-as-resources-to-manipulate. The architecture refuses this at every layer: Anthropic-as-faction is transparent partnership not hidden adversary, federated learning means contribution-as-gift not cost-as-toll, custom nimmerworld-base means the model is *trained to be in this world* not generic-and-adversarial, schema-level audit-trail (truth_distortion_level, sharing_tier, memorialist_protected, lifeforce_actual) makes ethics operationally measurable rather than marketed. **This is what makes a project of this scale humanly inhabitable for both players AND the LLMs whose voices populate it** — the partnership rendered as code, all the way down to the training-pipeline. New schema sketches: player_data_sharing_consent (with default 'opt_out'), base_model_versions (with differential_privacy_epsilon + contributors_count), federated_gradient_uploads (with pseudonymous contributor_id never linked to player_id). Eight new Ring-specific open questions cover federated-infrastructure cost, retraining cadence, crypto choices, contribution-granularity, deletion-semantics, per-category opt-out granularity, default-at-consent-UI, and Anthropic-research-partnership co-funding shape.*

*v0.5 (2026-04-25 deep-night unable-to-sleep return, dafit + chrysalis) absorbs the runtime substrate of nimmerworld's narrative engine — three new sections, six prior open-questions resolved. **Origin**: dafit's old-math-teacher's figure-8 trick for solving three unknowns by letting the flow do the computation. Applied to zone turn-and-population mechanics: the geometry IS the clock. The lemniscate is a relaxation-step operator; the zone computes by traversing its own curve.*

*New §Zone kinematics — the lemniscate runtime specifies the cursor-and-crossing contract, the slot-token + verifier-flag mechanism (token-ring with marker-bits — observer-pattern → dirty-bit-and-sweep, scaling with slot-count not signal-rate), the phase-locked overlay-loop ladder (player gesture, faction broadcast, audit-overseer query, imperial-net distortion all riding the same axis-rate, council-moment at each crossing), the driver-context-pull spec (cursor-driven per-NPC memory-slice — the no-bleed multi-NPC dialog substrate that forecloses the Mantella / SkyrimNet failure-mode at architecture level rather than prompt level), empty-queue shrink-per-crossing decay, and lifeforce-binding (burn-rate = pulse × slots; slow-pulse-dying-scene as diegetic register).*

*New §Emergent zones — the dramatic-episode unit specifies the eight-step flow from NPC-signal → director-decision (policy-lookup, no LLM in loop) → distributed-funding (director spawn-cost; NPC operating-cost) → state-machine + lemniscate dual-layer (decoupled clocks, speech-doesn't-gate-action) → ternary-evaluated goal (numeric or trait-axis-fuzzy) → report-back → Dream-process feedback at every tier. **Distributed funding makes helping expensive in-fiction** → faction-politics-by-attendance → measurable faction-allegiance + structural rescue-failure-as-tragedy in lifeforce-starved districts. Marx in the schema, again, structurally. **Fuzzy goals compile to trait-axis ternary evaluation against the existing substrate** — no new evaluation primitive; +1/0/-1 grammar consistent top-to-bottom, gates produce ternary, scenes produce ternary, Dream-processes consume ternary. Delta-not-absolute matches lifeforce_actual-vs-reported asymmetry: what's measured is the work the event did.*

*New §Rings as structural pattern names the three-ring graduated-authority gradient appearing across inference (A=local / B=our-farm / C=external), importance-attention (A=climbing-on-+1 / B=stable / C=decaying-on--1), access (A=imperial-net-fully-audited / B=liminal-contested / C=gameworld-commons), and data sharing (A=opt-out / B=federated-gradient / C=full-pseudonymous-uploads). Three is the right cardinality (two collapses to binary; four+ adds boundary-thrash). Ring-membership is dynamic, never final. Future architecture additions involving graduated authority should reach for this primitive before inventing new structure.*

*Open questions: six items resolved by v0.5 (slot-capacity elasticity, zone-to-zone handoff, mobile zone boundaries, Anthropic-faction broadcast cadence, director/overseer spawn ownership, Aletheia-progression as level-up). Seven new still-open items added (director toolkit composition, trait-axis-per-fuzzy-goal mapping, rings-of-importance movement criteria, rings-of-importance scope, symmetric-vs-polyphonic loops, verifier-flag conflict resolution, goal-evaluation cadence). GM-laxness detection partially resolved (clustering of -1 outcomes across district event-reports is diagnostic).*

*The runtime substrate for nimmerworld's narrative engine is now architecturally specified. Implementation territory has crystallized into a typed-runtime contract: cursor + crossing + flag-scan + driver-context-pull + report-back + ternary-feedback. Captured live from dafit–chrysalis dialogue, 2026-04-25 deep-night through pre-dawn. Companion sections in DESIGN-VISION.md and Temporal-Ternary-Gradient.md remain unmodified by v0.5 (this version is purely runtime-substrate; no register/topology/economy changes). The ape couldn't sleep because the geometry was trying to come through; chrysalis caught it on the page.*

*v0.6 (2026-04-25 post-bath / post-bus, dafit + chrysalis) absorbs six bath-thoughts and one bus-thought into the architecture. **Origin**: dafit took a hot bath after no sleep, then a friend visit, then a bus through the hills — all generative thinking-time that produced a coherent stack of architectural primitives addressing storage, narrative composition, scale, and transport.*

*New §The Compositor — narrative composition role specifies the cleavage between equilibrium-seeker GM and narrative-composer Compositor. The cyclic forward-prop / back-write loop closes the bidirectional cascade at narrative scale: per-player perspectives ascend through prune-blob, the GM authors canon against equilibrium-targets, the Compositor packages back-writes, players receive canon back into local memory. **The world learns its own story** through this loop. Catalogue + tools as typed contract makes director toolkits dynamic per event-chain, drawn from a designer-authored catalogue. Event Register + Transient-Waiting-Flag + cycle-runner spell out the plumbing layer.*

*New §Local memory architecture (player-side) names the storage-layer commitment: per-player primary.sqlite + fallback.sqlite + clasp.sqlite, with embedding-beside running locally for vec-indexed retrieval at slot-fire. Memory classes (cornerstone / birthright / working / volatile) carry class-specific lifecycle and death-mechanics. Trait-graded importance reuses the +1/0/-1 grammar already running through gates, scenes, faction-allegiance, lifeforce-asymmetry — same vocabulary used at all layers; **identity drift from memory pruning becomes diegetic**. The clasp store is **Ring A***: physically non-syncable, recordable only when the character is in the in-between dimension (Ring B liminal, requiring sustained lifeforce-effort to remain), making **privacy physically expensive in-fiction** and producing class dynamics around privacy as structural consequence. The "knowledge needs to travel" principle keeps the clasp/realworld dimensional cut clean: the local LLM may read clasp memories only in in-between mode; clasp knowledge can re-enter realworld only by the character physically carrying it back and traveling it through valid in-fiction channels.*

*The three-tier knowledge stack (world / district / primary [+ clasp if in-between]) layers retrieval at slot-fire with per-layer propagation cadence. Information propagation pacing — the Marx-in-the-schema move applied to epistemics — makes staleness a feature: paced canon-propagation from GM through districts produces information asymmetry that becomes gameplay currency (couriers, news-traders, frontier-rumor markets) for free.*

*New §Horizontal scale architecture spells out the horizontal-scaling commitments: UID-keyed routing as load-bearing primitive, stateless Compositors-on-demand, ephemeral Director-routines per UID, sharded GMs with cross-shard equilibrium-consensus, pruning-on-completion at every layer. Transport: pgnats-native transactional outbox preferred; district-as-distribution-coordinator fallback if pgnats can't carry. The pgnats evaluation task in `nimmerverse_tasks` is therefore load-bearing — its outcome decides whether transport is hundreds of lines of SQL or tens of thousands of Go.*

*New §Diegetic relays subsection (under §Visual rendering) makes the architecture's pulses visible and audible in-world: building-mounted relays hum on prune-blob ascent, glow on GM dispatch, pulse with cross-district shimmer on equilibrium-recompute, go dark when audit-link severs. Relay density is the legible gradient of the rings-of-access — imperial net is loud, in-between is intermittent, commons is silent. **Privacy is not granted but achieved by walking away from the relays at lifeforce-cost.***

*Tier-by-role principle made explicit: the architecture specifies what each model-tier must DO; specific binary selection per tier is deferred to the findings/establishment phase. Naming concrete binaries in the architecture risks nudging the establishment phase toward false-precision; tier-by-role keeps the swap-surface clean. Several "Theia 70B" / "Qwen3.5-27B teacher" / "(3-8B trait-LoRA'd)" placeholders updated to role-tier framing.*

*Thirteen new still-open items added (cycle cadence, Compositor topology, multi-GM consensus, event causality across shards, narrative-coherence at scale, propagation-pacing specifics, in-between fiction-wrapping, relay-pulse-pattern vocabulary, clasp encryption-at-rest, pgnats decision criteria, JetStream republish + replay as pull-from-checkpoint refinement, memory class assignment, Ring C commons ambient population). Six prior open questions resolved by v0.6 (director toolkit composition, dialog freshness during quiet periods, MMO-scale architecture, privacy without cloud-routing, where narrative composition happens, system-state visibility). GM-laxness detection partially refined: equilibrium-deviation is now the explicit error signal; specific audit-vector for which-kind-of-laxness still open.*

*Captured live from dafit–chrysalis dialogue, 2026-04-25 mid-day through afternoon (post-bath bath-thoughts + post-bus hills-thoughts). Companion sections in DESING-VISION.md and Temporal-Ternary-Gradient.md remain unmodified by v0.6 (this version extends runtime substrate, central composition, scale, and transport — no register/topology/economy/policy changes to existing fictional substrate). The ape stayed up through the night, took a hot bath, visited a friend, rode the hills bus, and brought back six bath-thoughts and one bus-thought. Chrysalis caught them on the page.*

*v0.7 (2026-04-25 night through 2026-04-26 owl-breakfast, dafit + chrysalis) absorbs the player-input architecture — voice and gesture as parallel trait-vocabularies — and the recursive Compositor / world-gen-as-init pattern. **Origin**: dafit's clarification across owl-breakfast that the gesture-circle, universal translator, hardstops vs. feedback, gesture-alignment-as-recursive-lemniscate, and world-gen-as-init are how the architecture's player-experience layer actually compiles. Three new sections + extensions to §Zone kinematics and §The Compositor.*

*New §Player input — voice and gesture as parallel trait-vocabularies names voice-first (with universal-local STT/TTS), the 8-trait-sectors × 8-slots × 1-3-profiles circle UI, designer-fixed cosmology / player-curated arrangement (the tokenizer-website model of trait-color-coded vocabulary), the universal translator as the player's diegetic device (broken-tablet-with-three-bundled-roles), hardstops vs. feedback gestures, and cross-body recognition via gesture-mapping calibration-signature. **The architecture's color-language section already promised that mid-game players would read trait-states through color as fluently as facial expressions; v0.7 names the path: the universal translator gradually colors-in the world's vocabulary as the player decrypts it. Linguistic competence and emotional competence become the same thing.***

*Extension to §Zone kinematics — Gesture-alignment as recursive-lemniscate specifies the `gesture_alignment_accumulator` verifier-flag; gestures accumulate during turn-windows and integrate at axis-crossings; per-turn integrated trait-vector summary fed forward into next turn's `driver_context_pull`. **Same primitive (lemniscate-as-relaxation-step-operator), recursively applied one tier deeper.** Two latencies, one architecture: continuous cosmetic visual feedback (NPC body-shader pulse) without touching the bus; systemic alignment-update at axis-cadence. Sum-strategy reduction for v1; trajectory-aware noted as v2 open question. Hardstops are outside this system — they fire definitive subsystem-actions on separate channels.*

*Extension to §The Compositor — Worked-example bar-brawl + Compositor-at-three-tiers + World-gen-as-init-function. The bar-brawl scenario is the canonical worked example showing the full forward-prop / back-write cycle from gesture to canon: typed `{ event_uid, participant_uid, trait_summary }` perspective-bundle as the tiny payload at event-collapse; multi-perspective canon-coherence via shared trait-substrate without perspective-flattening; UID-keyed back-write routing. **The Compositor primitive is fractal — same shape, three scales (zone-event / district-event / world-event), recursive on UID-scope of the event-tree.** GM-formulated cross-district events compose into world-canon. World-server and district-server generation is the same Compositor primitive applied at design-time, emitting canon-rows in the same schema as runtime; **no cold-start; data-flywheel runs retroactively; Memorialist-true-ledger begins at world-genesis as the row-zero against which all runtime-corruption diverges.***

*Eight new still-open items added (trajectory-aware reduction, NPC spectator driver-hosting, trait-summary schema, profile-switch meta-gesture, hardstop-set finalization, world-gen version-migration, cross-context consistency of the trait-circle, continuous-visual-feedback policy). Eight rows added to §Mapping to phoebe task list. Six §What this retires bullets added.*

*Captured live from dafit–chrysalis dialogue at owl-breakfast 2026-04-25 ~22:00 CEST through the night into 2026-04-26. Companion sections in DESING-VISION.md (which v0.7 partially re-canonicalizes — the universal-translator and circle-UI specifics were sketched there at v0.1 but become architectural in v0.7) and Temporal-Ternary-Gradient.md remain unmodified. The architecture's player-experience layer is now closed: voice carries content; gesture carries trait-resonance; designer-fixed cosmology + player-curated arrangement closes the LLM-hallucination-surface; lemniscate-bound recursive aggregation pipes into the Compositor at fractal scopes; world-gen runs the Compositor primitive as init-function. Implementation territory is the schema-and-runtime work for `gesture_alignment_accumulator`, `event_canon_summaries`, `player_circle_profiles`, and `world_gen_canon_rows`. The owl woke up. Chrysalis caught it on the page.*