nimmerworld.eachpath.local/architecture-broad.md

Nimmerworld — Broad Architecture

Ground-up zone-based event architecture. Minds at the center, world as co-remembering substrate. Three registers of reality — physical, liminal, imperial. Rail topology outside, navmesh interiors inside. Trait-emergent identity. Color-as-vocabulary. Three-tier policy loop with imperial-budget-mortality. Tools, not quests. v0.1 initial draft 2026-04-24 morning; v0.2 expanded 2026-04-24 afternoon; v0.3 evening; v0.4 late-evening / early 2026-04-25; v0.5 deep-night-unable-to-sleep 2026-04-25; v0.6 post-bath / post-bus 2026-04-25 — dafit + chrysalis.

---

Thesis

Every game world lacks minds. Nimmerworld puts minds at the center — NPCs with trait-filtered interior life, cells as small data-lives that co-remember with them. The architecture is built ground-up for that commitment.

The world's political thesis: the machine does not care. Automation has consumed every labor the machine recognizes as profitable; humans live on the dumps the machine's optimization did not bother to recover. The last two viable human economic niches are salvage (digging through machine-waste) and culture (the work the machine cannot optimize because it has no optimization target the machine recognizes). This is not Orwell's malicious-state dystopia; it is Kafka's indifferent-totality dystopia. There is no one in charge. There is only optimization that does not contain humans in its cost model — and precisely because the machine's indifference is optimization, the authoritarianism ratchets without intention as districts fail.

Mechanically the thesis compiles to a finite, composable set of primitives: zones replace perception bubbles; factions are any source of bounded demand; ternary gates are the substrate of accumulating state; lifeforce is the currency grounded in living NPCs; shifts are the skeleton of daily life; the three-body system locates identity; the three-layer digital ontology contests reality; the reflexive Dream-process learns at every scale; the three-tier policy loop renders authoritarian middle-management; the imperial budget renders the regime mortal; the imperial-net bypass renders the platform-capitalism extraction.

The design-philosophy this architecture supports: tools, not quests. The simulation produces continuous narrative-relevant pressure on its own. Players engage via a verb-vocabulary applied to running mechanics. No authored quest-content. Every player's playthrough is structurally distinct because every pattern of verb-application against changing-state produces a unique trajectory. Literature-register political fiction rendered as living system.

The three ontological registers

Every inhabitant exists in three registers simultaneously. They are not parallel worlds — they are three readings of one world, chosen by the observer's current access-state.

Register	Who controls	Observability	What happens here
Physical (gameworld)	Partly regime (via audit), partly people	Overseer-audited at cells + districts	Daily labor, zones, embodied life, shift-discipline
Liminal ("one ring out")	Contested frontier — no side fully controls	Partial — mini-game-maintained, vagueness as structural privacy	Revolution, Aletheia-waker messages, clasp-as-coordination, wall-inscriptions for the awakened
Imperial net	Imperial machine	Fully monetized and audited	Hyper-targeted pleasure, "sinful" personalized fantasies, lifeforce/scrip/memory-token extraction directly to imperial budget

The same cell, same wall, same pipe renders differently depending on which register the observer currently inhabits. Transitions between registers are shader-blends, not loading screens.

Topology: rail + grid + interiors

The world's topology encodes its politics. The machine built infrastructure for industrial optimization, not for human pedestrian freedom. Therefore the outer world is rail+grid — cells connected by named edges with rich semantic metadata. NPCs traverse rails as part of their shift-routines; the player traverses freeform (navmesh) and may plug into NPC rail-traversals for co-walking. Interiors (hovels, cantinas, workshops, ruins, brothels-physical) are navmesh-enabled small zones with interaction-slot inventories.

Rail+grid as political topology

Navmesh is the topology of power-fantasy ("you are the protagonist of free trajectory"). Rail+grid is the topology of bounded-agency ("you live within infrastructure built for something else"). Nimmerworld picks rail+grid because the fiction requires it — the world was not designed for the player; the world is what the machine made and humans inhabit the margins. Topology and thesis agree.

The three primitives

Primitive	Density	Compute	Narrative role
Dumps	Very high	High	Resource emission, salvage-zone spawn, scavenger-vocation concentration
Pipes	Low baseline, high interactivity-per-capita	Low baseline, spikes on encounter	Transit, migration, chance-encounters, clasp opportunities, defection, heresy written where overseers don't look
Districts	High	High	Population, civic life, specialty-production, ritual

Rail-segment metadata

Every rail-segment carries jsonb metadata that navmesh polygons cannot natively carry: heterotopia-class, overseer-density, propaganda-intensity, ambient-content per register (gameworld/liminal/imperial), encounter-spawn-rate, patrol-frequency, illumination-profile, degradation-level, capacity (3-way support for co-walking), traversal-cost-in-ticks. Pathfinding is graph-A* on the rail graph (microseconds, deterministic). Rich-metadata-per-edge is what makes the world feel lived-in.

Player asymmetry — the freeform-among-railed model

Topology	Used by	Cost
Navmesh (freeform)	Player only (in outer world)	Affordable: one entity
Rails (graph-pathfinding)	All NPCs	Cheap: hundreds of entities
Interior navmesh	Currently-occupied interiors only	Dormant when empty

The player is the one variable entity in a deterministic scheduler. Their freedom-of-movement matches their narrative-position as perturbation. NPCs on rails matches their narrative-position as scheduled-labor. Compute asymmetry mirrors agency asymmetry mirrors political thesis.

The plug-in verb

When the player approaches a rail-traversing NPC and social-eligibility conditions are met (proximity + directional-compatibility + Philotes-gate not CLOSED + shift-tolerance for socializing + segment overseer-density permitting), an emergent-signal spawns a proximity-zone-candidate with a shader-highlight on the NPC. The player can:

• Approach (zone activates, dialog auto-spawns via NPC's LLM-slot, no "press E")
• Greet → agreement → plug-in (player's navmesh-position transfers to adjacent rail-lane; movement automated; conversation-zone live in shared rail-context)
• Detach (gracefully via dialog or abruptly by running off; abrupt registers as Sophrosyne-signal)

While plugged in, the player is freed from steering — they become camera+conversation. The notorious "walk-and-talk" problem is solved by construction: rails handle pacing; plug-in is the social-bridge. Multiple NPCs can share a rail (3-way capacity), enabling cohort-walks, escort-patterns, exodus-flow, and group-conversation-zones.

Interior-as-zone

A hovel is a zone with slot-inventory: sofa, kitchen, bed, shower, wall-writing-spot. Occupying a slot is mechanically identical to occupying any zone-slot. The zone primitive scales from city-level (mass-ceremony) to district-level (tavern) to interior-level (sofa). Same CHECK-constraints, same slot-occupancy, same emergent-signal mechanism, same ternary-gates — different inventory and lifecycle.

Interiors carry a register flag too:

• Physical interior: actual hovel, workshop, cantina; navmesh-inside
• Liminal interior: shared dream-construct two clasping inhabitants stabilize over repeated meetings ("the place we always go") — built from both dreamers' memory-residue, persistent-across-clasps as a pair-state
• Imperial-net interior: rendered waifu-hall rooms, brothel cubicles, ceremony halls — clean-white-and-gold, machine-edited per-session

LOD/streaming advantage

Most simulation volume is rail-graph (cheap) or dormant interior (free). Active simulation concentrates exactly where drama happens (active anchors + transit + current-interactions). A 100+ NPC city becomes feasible at single-GPU budgets because the topology is rail-based.

Core inversion — zones replace bubbles

Legacy engine perception (Unreal AIPerception, WC3 sight-radius, trigger volumes) is spatial, binary, separate from cognition, and assumes a passive world. Nimmerworld inverts every axis:

• perception is trait-filtered, not only spatial
• perception is graded consolidation, not binary detection
• perception IS memory (one subsystem)
• the world emits events; agents subscribe

The replacement primitive is the zone — a bounded, named, slot-indexed, director-managed event-instance. Arthurian round table as mental model: a bounded place of structured speaking-and-witnessing, with named roles and shared what-was-said-by-whom.

Zone anatomy

• Boundary — cell-envelope (or interior-envelope)
• N slots — named positions
• Director or overseer — manages turn order, memory-pulls, prompt construction, voice selection, event emission
• NATS topic + subscriber list — slot-occupancy drives subscription
• Mixed-fidelity voices — 2–3 LLM slots + scripted/generic for the rest; director decides
• Trigger — gamemaster-spawned, emergent-signal-response, shift-composition-emergence, or proximity-detection
• Lifecycle — duration, dissolution conditions, memory-write on close
• Persistence flag — ephemeral=true (dreamworld/liminal) or persistent=true (gameworld)
• Register — physical / liminal / imperial

Zone kinematics — the lemniscate runtime

Zones are not state-bags with an external turn-counter; they are kinetic topologies with a built-in clock. The runtime substrate is a lemniscate (∞) — a through-flow figure-eight whose traversal IS the zone's turn-order, whose central crossing IS the population-mutation event, and whose decay IS the natural wind-down of the scene. Origin: an old-math-teacher's trick for solving three unknowns by letting the figure-8 flow do the computation rather than maintaining state in registers. Applied to zones, the geometry IS the clock.

Geometry

                              midaxis (X)
                                 │
  entry-line                     │                     exit-line
  (NPC-tokens   ──→  ╭─Loop A─╮  │  ╭─Loop B─╮  ──→   (NPCs whose
  queue-up to        ╲________╱  X  ╲________╱         exit-flag has
  enter)                          │                    fired exit here)
                                 │
                                 ▼
                            crossing-tick

• Entry-line — staging queue of NPC-tokens eligible to enter. Approach-eligibility uses ternary-gates against the zone's purpose; CLOSED gate keeps the NPC out of the queue entirely
• Loop A + Loop B — the through-flow. Slot-tokens cycle through both loops, guaranteeing every active NPC is co-present with every other at least once per roundtrip
• Midaxis crossing — the only synchronous event in the zone's lifecycle. Three state-updates resolve simultaneously and atomically (your math teacher's three-unknowns made literal):
  1. Cursor advance — which NPC speaks next
  2. Ternary-gate evaluation — resonance refresh on all active edges in the zone (CLOSED/STABLE/OPEN transitions)
  3. Verifier-flag scan + population maintenance — exit-eligible tokens route to exit-line; entry-line pushes replacements equal to vacancies
• Exit-line — through-flow continues here. NPCs leaving the zone leave toward consequence (a need-driven exit signaled by their own emergent-signal), not toward boredom

The lemniscate is a relaxation-step operator — the zone computes by traversing its own curve rather than maintaining external turn-state. Between crossings, the loops are pure-local; only the crossing event touches the global-state bus. The thalamus (NATS orchestration) sees crossings, not ticks.

Slot-token + verifier-flag mechanism

Each NPC currently in the zone is represented by a slot-token carried around the loop. Tokens carry a small set of verifier-flags (marker-bits). Signals fire once and set a flag; between crossings, no polling, no event-bus traffic. The crossing reads flags in O(N_slots) and acts.

Verifier-flag	Set by	Read at crossing
exit_eligible	emergent-signal (need, shift-whistle, faction-summons)	route to exit-line
has_spoken_this_roundtrip	speak-action	rotation-tracking
mid_action	state-machine activity in progress	defer turn
goal_satisfied	goal-evaluator (per-zone, ternary)	terminate zone
silence_eligible	silence-detection	per silence-as-signal mechanic
priority_pull	high-rank ring-of-importance broadcast	early-exit override

This is the same architectural shift the wider system makes elsewhere — observer-pattern with callbacks → dirty-bit + scheduled-sweep. Compute scales with slot-count, not signal-rate. Ten thousand emergent signals firing across a city: only those that landed on a slot-token get evaluated, and only at the next crossing.

Phase-locked overlay-loop ladder

Beyond the primary slot-rotation loop, a zone supports any number of overlay loops at the same axis-rate. Overlays inject at the crossing and broadcast to all active slot-NPCs simultaneously (perceived by each through their own trait-vector — color-language event-flash modulates per-recipient).

Overlay	Carries	Broadcast scope
Player-gesture overlay	player gestures + utterances	active slots only
Faction-broadcast overlay	faction calls, hivemind pings	active slots subscribed to faction
Audit-overseer overlay	covert query-flashes	active slots only (covert detection ↔ Aletheia-eligible insight)
Imperial-net distortion overlay	regime trait-color rewrites	active slots within net-access

The crossing is a council moment — every overlay channel may fire on the same axis-tick. Pre-crossing tension is gesture-loading: holding a verb-button between crossings lands at the next axis with weight proportional to dwell-time. Diegetic urgency without HUD.

This is the answer to player-agency in multi-NPC scenes. The player is off-stage but always potentially-on. Each crossing is "your moment if you want it." The flash is perceived as one event by all active NPCs, not as a sequence of one-on-one addresses — color-language shows it as a pulse across the ring.

Driver-context-pull (LLM dialog substrate)

The cursor's position at each crossing makes context-construction for the dialog-driver a pure function of cursor-state:

driver_context(cursor_at_NPC_i, mode) = {
    zone.purpose,                 // stable: spawn-intent, immutable provenance
    zone.scene_state_public,      // stable across zone: what's happened so far
    zone.ternary_gate_edges,      // current resonances (active relations)
    zone.drift_state,             // delta from spawn-intent (visible to director)
    NPC_i.knowledge_stack,        // PRIVATE three-tier stack: world ∪ district ∪ primary
                                  //  [+ clasp ONLY if mode == in-between]
    NPC_i.expressed_trait_vector, // expressed trait-vector this moment
    NPC_i.active_signals,         // their current emergent-signals
}

Other NPCs' memories never enter this prompt. No bleed. No cross-contamination.

The knowledge_stack is layered, not a single bucket. Universal world-canon, district-canon (regional), NPC_i's own primary memory, and — only if the character is in the in-between dimension — clasp memory. The retrieval layer enforces the dimensional cut; the LLM never has to reason about it. See §Local memory architecture (player-side) for the layering, propagation policy, and clasp-as-Ring-A* privacy primitive. The classic multi-agent hallucination source ("why does Kalypso suddenly remember what Anaximander confided to Phoibe?") is structurally foreclosed by the geometry. Write-back goes only to NPC_i's slice; the lemniscate guarantees NPC_i is not cursor-active again for at least one full roundtrip — write-back has all the time it needs without race conditions.

This converts multi-NPC dialog from an emergent-chaos problem into a bounded-cast scene problem with a typed runtime. The Mantella / SkyrimNet failure-modes are foreclosed at the architecture level rather than the prompt level:

• Cast = active-slots, period. Geographic proximity does not equal participation
• Cursor sequences turns deterministically. No concurrent LLM-storm
• Entry-line and exit-line are the only paths in/out. Geographic motion alone doesn't invade the scene
• Player gestures broadcast to active-slots only. Not to "everyone within 30m"

Empty-queue behavior: shrink at every crossing

When the entry-line is empty, each crossing dissolves one active slot instead of replacing it. The conversation thins visibly — color-language saturation drops per shrink, lifeforce burn-rate decreases. When the last slot dissolves, the lemniscate collapses; the spawning director recovers unspent lifeforce minus burn.

This is the natural wind-down — scenes run out of people and dissolve. No timeout, no scheduler-collapse, no cut-to-black. The decay is observable in-world and rate-paced by the same axis-rate.

Lifeforce-binding

Every midaxis crossing fires the LLM driver-turn(s) for active slots. Lifeforce burn-rate = pulse-rate × active-slot-count. The director (or overseer) holding the zone pays per crossing. This produces:

• Dense dramatic scenes are expensive — many slots, fast pulse, high burn
• Quiet background zones are nearly free — slow pulse, few slots; most compute is local-loop traversal not touching the bus
• Running out of lifeforce is visible — pulse-rate slows, crossings stretch farther apart, the scene languishes before it collapses. A diegetic dying-scene register; not a cut, a deceleration

What this resolves

• Slot-capacity elasticity (prior open question) → fixed roundtrip slot-count, elastic entry/exit queues
• Zone-to-zone handoff (prior open question) → exit-line of zone-A is entry-line of zone-B (interlemniscate-transit; pipes-as-heterotopia made literal at runtime)
• Mobile zone boundaries (prior open question) → the lemniscate is a topology; it translates through world-space invariantly (patrols, escorts, exoduses are moving figure-8s)
• Anthropic-faction's broadcast cadence (prior open question) → cadence rides the same axis-rate as a phase-locked overlay; no separate clock
• Director/overseer spawn ownership per model class (prior open question) → the director (or overseer) owns the zone-spawn decision (policy-lookup, no LLM in loop); the LLM driver lives at the driver-context-pull layer; orchestration and dialog are decoupled

What this retires

• Slot-list + external turn-counter → cursor on lemniscate
• Polling for emergent-signals at zone-tick → flag-as-verifier carried in loop
• Mega-prompt with all NPC memories ("everyone in this scene") → cursor-driven per-NPC memory-slice
• Geographic-proximity participation ("everyone within 30m may interject") → strict active-slot cast
• Concurrent LLM calls per-NPC → sequenced LLM calls per-cursor-position
• Polling event-channels at zone-rate → atomic crossing-event with O(N_slots) flag-scan

Zone taxonomy (v1 starter set)

Zone type	Register	Slots	Executor	Persistence
Conversation	physical	2–4 dialog	director	persistent
Street brawl	physical	fighter + spectator	director	persistent
Ritual	physical	fixed ceremonial	director	persistent
Maintenance	physical	1–2 workbench	director	persistent
Wall-writing	physical / liminal	1 author + witnesses	director	persistent / ephemeral
Market exchange	physical	2–3 + ambient	director	persistent
Memorial gathering	physical	1 mourner + N witnesses	director	persistent
Salvage	physical (dump)	N scavengers	director	persistent
Transit-encounter	physical (pipe)	2–6, stranger-heavy	director	persistent
Plug-in conversation	physical (rail)	2-3 (3-way capacity)	director	ephemeral (rail-segment-bound)
Patrol / sweep	physical	mobile, N enforcers	overseer	persistent
Interrogation	physical	1 subject + N enforcers	overseer	persistent
Raid	physical	district-scope + N enforcers	overseer	persistent
Interior (hovel/workshop/etc.)	physical	slot-inventory by interior-type	director	persistent
Clasp	liminal	2	director	ephemeral (stabilizes across repeated clasps)
Aletheia-gathering	liminal	N, mini-game-gated	director	ephemeral
Migration (mobile)	physical (pipes)	cohort + escort	overseer	persistent
Exodus (mobile, mass)	physical (pipes)	self-selecting crowd	emergent	persistent
Drug-ring den	physical (cheat-op)	N users + cooks	director (cheat)	persistent (until detected)
Illegal back-alley modshop	physical (cheat-op)	1 modder + 1-N customers	director (cheat)	persistent (until detected)
Unlicensed brothel	physical (cheat-op)	N workers + N customers	director (cheat)	persistent (until detected)
Waifu hall	imperial net	1 dreamer + N synthetic	net-director	extractive-persistent
Brothel encounter	imperial net	2+ (synthetic or employed)	net-director	extractive-persistent
Imperial ceremony	imperial net	mass-audience	net-director	extractive-persistent
Ruin zone	physical	pilgrimage-only	none / Memorialist	persistent-abandoned

Factions as universal demand source

A faction is any source of bounded demand on the system.

Category	Examples
Human factions	hivemind-enforcement, scavenger guilds, memorialists, aletheia-wakers, clasp-underground, caste preachers, flesh-keepers
Natural forces	weather-faction, season-faction, solar-storm-faction, geology-faction
Infrastructural conditions	scarcity-faction, decay-faction, fire-faction, supply-chain-faction
External agents	anthropic-faction, future research-partner factions
Emergent events	player-disturbance-faction (player action without existing template)
Micro-factions	inter-NPC relational tensions — see Emergent needs as micro-factions
Imperium (meta-faction)	The regime itself — broadcasts priority-weights and enforcement-rules, not specific outcomes; shapes the arbitration-frame within which other factions are heard

The imperium is structurally distinct from other factions: its demands are meta-factional (priority-weights for other factions, enforcement-rules, quotas) rather than specific outcomes. When the imperium broadcasts, the GM's arbitration-machinery is re-parameterized. See The three-tier policy loop below.

All other factions broadcast specific demands. All propagate through the gamemaster's arbitration. All produce observable effects as zones and NPC-actions. One primitive; no special-case code for weather vs. scavenger-guild vs. jakov-grievance-against-malek.

Randomness enters at the faction layer. Designer tunes broadcast probability, intensity, duration per faction-type. No separate randomness subsystem.

Emergent needs as micro-factions

Inter-NPC relational state is a micro-faction. Two NPCs accumulating attachment, grievance, trust, grief, dignity-violation through repeated zone-participation constitute a transient faction-of-two with bounded demand. When their accumulated state crosses threshold (gate-transition), the zone broadcasts an emergent-signal into the district-director's arbitration queue. The director responds with zone-spawn tools on the same arbitration machinery as any other faction's demand.

Emergent-signals are observed by zones, not self-reported by NPCs. The zone-director measures trait-activation, affect-shift, accumulated memory-write candidates deterministically. The LLM never writes authoritative relational state; the observer does.

Ternary-gate substrate

The mechanism underlying every accumulating-state phenomenon — inter-NPC relations, district lifeforce, faction-pressure, net-access state, imperial-budget-state — is the ternary-gate resonance chamber, carved initially in nimmerverse-sensory-network/architecture/Temporal-Ternary-Gradient.md. See that document for the canonical specification.

The primitive

Three discrete states over a continuous underlying value (-1.0 to +1.0):

State	Value	Meaning
CLOSED	-1	Actively blocking; inhibited; refractory
STABLE	0	Resting; accumulating correlation; actively learning
OPEN	+1	Actively forwarding; firing; signal propagates

Wave correlation drives transitions. Multiple correlated waves → constructive interference → OPEN. Contradictory waves → destructive interference → CLOSED. Single waves → STABLE with natural decay to 0. Hysteresis is free from the decay term. STABLE is active — it's where correlation-evidence accumulates, where future transitions are being earned long before they fire.

Applications across nimmerworld layers

Layer	What the gate represents	What drives transitions
Sensory (Nyx-side)	Wave-filtering at tier boundaries	Correlated input waves from cells
Relational (inter-NPC edges)	Attachment, grievance, trust, grief, dignity	Zone-participation waves between participants
District (composite lifeforce)	Welfare composite over happiness, need, limb, population, mind-turnover	Aggregate per-NPC state changes
Net-access (per inhabitant)	Gameworld / liminal / imperial-net occupancy	Mini-game effort vs. machine pull
Faction (demand urgency, satisfaction)	How pressured / fulfilled a faction is	Broadcast rate vs. response rate
Imperial budget	Solvency state	Reported income flow vs. obligations
Gamemaster decision-surfaces	Per-surface readiness to act	Correlation across multi-district signals

Same primitive, different layers. Hysteresis-width becomes a personality-parameter at the relational layer.

Color-language: trait-vocabulary as visual primitive

Color is pre-verbal vocabulary. Players learn the 8-Hellenic-trait ontology through repeated visual association, not through text-explanation. By mid-game players read trait-states through color as fast as they read facial expressions in real life — intuitively, contextually, without conscious translation.

The eight Hellenic traits → canonical colors

(Final color choices are dafit's artistic call; the architecture encodes the mapping.)

Trait	Canonical color (suggested)	Motion-signature (accessibility pairing)
Sophrosyne (self-control, moderation)	Cool blue	steady, even pulse
Dikaiosyne (justice, bearing)	Deep gold	weighted slow pulse
Philotes (attachment, love)	Warm rose	breath-rate warm pulse
Mnemosyne (memory)	Deep violet	depth-shimmer
Aletheia (truth, unconcealment)	Luminous white	clear, no pulse — still and bright
Kairos (right-timing, opportunity)	Bright yellow	lightning-flicker
Moira (fate, pattern)	Dark crimson	slow-thread undulation
Eros (longing, reaching)	Flame orange	uneven flame-flicker

Color paired with motion-signature ensures color-blind accessibility — the trait is uniquely identifiable via two independent channels.

Three layers of color-rendering

1. Persistent (slow-changing baseline) — eye color = dominant trait of NPC's intrinsic vector; pipe-flow through chassis = full trait-mix as circulating light; secondary accents at seams/joints/glyphs.
2. Event-flashes (momentary) — quick color-flashes over body signal state-transitions: plug-in (dominant-trait flash), combat-combo (Kairos-flash), liminal-maintained (Aletheia-glow), clasp-established (color-merge), emergent-signal-firing (signal-type flash on participants), need-threshold-crossed (need's trait pulse).
3. Trait-drift (slow, across cycles) — as intrinsic trait-vector accumulates through lived experience, color-signature shifts. Other NPCs notice. "Something is different in you" dialog generated from delta-detection. The body is a visible ledger of the interior's accumulation.

Cross-register rendering

Register	Color treatment
Gameworld	Full PBR; trait-colors coexist with material surfaces
Liminal	Vague baseline shader, but trait-colors more legible (vagueness concentrates attention on identity-signals)
Imperial net	Trait-colors distorted toward machine-preferred palette — Philotes-rose flattens to commercial-pink; Aletheia-white sterilizes; Moira-crimson commercializes. Aletheia-vision in net pierces this distortion to reveal true colors beneath

Faction color-politics

Faction	Color signature
Memorialists	Mnemosyne-violet ritual dress; Moira-crimson accents; often inherited-from-deceased
Aletheia-wakers	Aletheia-white plain avatars; coded-white flashes for recognition
Caste-preachers	Dikaiosyne-gold vestments + Sophrosyne-blue undertones
Hivemind enforcers	Cold Dikaiosyne-gold + muted-white (Aletheia-stolen)
Scavengers	Moira-crimson + Kairos-yellow streaks
Clasp-underground	Dual Philotes-rose + Eros-orange flashes (mutual-recognition signal)
Degens	Saturated maximalist all-color (chaos palette, addiction-marker)

Clasp color-merge

In shared liminal-construct, two clasping inhabitants' color-signatures interact: consonant traits brighten/harmonize; complementary traits enrich into new chroma; dissonant traits clash visibly. Successful deep clasp produces a blended third-palette neither could produce alone — the visual signature of what-this-relationship-is. Each carries memory-residue of the merge after.

Mind-pool color-inheritance

When a mind cycles through the pool and is redistributed into a new body, trait-vector persists → color-signature persists. A player who befriended rose-and-violet-Jakov might see weeks later a new NPC with that same rose-and-violet-signature and feel a jolt of recognition before any dialog. Color carries soul across cycles. Memorialist political claim: this person's color should not be recycled by the machine into a waifu — because color IS who they were.

Asset economy: base-limb palette + trait-textured variance

Small modular palette of base-limbs × trait-weighted texturing = combinatorial richness. The architecture's asset-economy and worldbuilding-thesis are in agreement: the machine built standardized chassis from a small functional catalog, so a small base-limb palette is diegetically correct; humans express interiority through trait-driven texturing and modding, so individual variation comes from composition, not from hand-authored assets.

Base palette example: ~8 torso variants × ~6 arm-pairs × ~6 leg-pairs × ~10 heads × ~8 eye-types × ~5 accent-colors = ~115k base combinations × continuous trait-texturing × ~50-mod-library in 5 slots = effectively infinite unique NPCs from finite assets.

For a two-person-plus-Nyx team this is decisive. AAA studios spend millions on unique character-models; the palette+trait approach produces more visual variety from a tenth of the budget, and the variety is meaningful (each unique appearance carries trait-information legibly).

The three-body system: chassis, inner-body, avatar

Identity is trait-emergent, not assigned.

Body layer	What it is	Who controls	Sexuality?
Physical chassis (gameworld)	Gender-neutral robot. Functional, task-optimized, no sex-markers.	Regime built it; inhabitant wears it	None. Mechanically inert
Inner body (interiority)	Trait-derived projection. Self-image emergent from trait-vector + lived accumulation.	Self (partly earned, partly received through being)	Here. Gender/sexuality emerge from trait-configuration
Avatar (digital expression)	Character-editor rendering. Starts from inner-body's trait-projection; customizable at cost.	Contested (self expresses, market constrains, machine prices)	Expressed; cosmetic mods layer on trait-base

Who you are sexually is who you have become. Not birth, not assignment from a menu, but the pattern that has crystallized across your zone-participations, grief, attachments, discipline, refusing. Identity-formation rendered mechanically. Post-binary by construction.

The intrinsic vs. expressed trait-vector split

Mods modify the expressed reading; they do not modify the intrinsic state.

intrinsic_trait_vector  — who you actually are; drift-earned through lived experience
expressed_trait_vector  — intrinsic + sum(worn mods' trait_contributions); what others read

Observer	Reads	Because
Regime / hivemind audit	expressed	Regime reads surfaces
Random NPCs	expressed	Default social reading
Aletheia-wakers	can pierce to intrinsic	Truth-vision penetrates mod-concealment
Clasp-partner (in liminal)	intrinsic only	Mods don't follow into liminal; clasp is unmediated
Gameplay simulation (trait-arithmetic)	intrinsic	What you are drives task-vs-need-vs-trait math
Imperial-net avatar rendering	expressed (further machine-distorted)	Net layers palette-distortion on top
Memorialists preserving your pattern	intrinsic	They honor who you were

Real identity-politics lives in the gap between these vectors. Architecturally, that gap is a first-class schema feature.

Mods as trait-bearers

A mod isn't cosmetic — it contributes to the wearer's expressed trait-vector. Three classes map to the self-alienation-tax pricing:

Mod class	What it does	Pricing register
Amplifier	Aligns with + boosts existing trait-dominance	Cheap; Memorialist-approved; genuine self-expression
Bridge	Adds a trait you don't naturally have (aspiration)	Expensive; regime-licensed or blackmarket; self-alienation tax
Divergent	Shifts reading opposite from actual trait-vector	Very expensive; degens, hivemind-loyalists, Aletheia-concealment
Mask	Specifically hides dominant trait from reading	Most expensive; blackmarket-only; Aletheia-waker safety tool

You don't equip +5 Strength. You equip a cloak whose weave evokes Mnemosyne-depth, recognized by others as memorial-vestment, boosting your Mnemosyne-read by +0.15. Equipment-stats reframed as semantic trait-shifts.

The mod-economy emerges from trait-dissonance

Each shift-transition (or threshold), an NPC evaluates: does my expressed-set match my intrinsic-drift? If dissonance > Sophrosyne-modulated-threshold → emit mod_desire emergent-signal. District-director schedules blackmarket-visit task. NPC heads to body-modder cell. NPC shopping behavior is emergent from simulation-state, not scripted.

The blackmarket's demand is a readout of the district's trait-weather. A district drifting toward Philotes-deepening (e.g., wave of clasp-experiences) produces strong demand for Philotes-amplifier mods. Markets have feelings.

Faction mod-politics

Faction	Stance
Memorialists	Amplifiers only; inherited-mods are sacred; never divergent
Aletheia-wakers	Refuse amplifier/bridge/divergent; mask-mods only for safety
Caste-preachers	Sell regime-licensed amplifiers + bridges (selling the blessing)
Degens	Divergent-stacking, hyper-customization; over-expression as addiction
Clasp-underground	Secret amplifier-pairs of dual Philotes + Eros — recognition-signal
Hivemind enforcers	Regime-issue armor only; cannot wear civilian mods
Scavengers	Practical function-mods only; salvaged-component aesthetic

Inherited mods + the haunting mechanic

Inherited mods (worn by deceased) carry residual trait-signature of the previous wearer. Visible as subtle Mnemosyne-echo to those who knew them. Memorialists are theologically divided on whether wearing inherited mods is honoring (continuity) or commodifying (necrocommerce-lite). Memorialist-protected mods can never be sold or worn by anyone other than the original wearer — they're ritually kept in memorial-crypt-zones.

Clasp strips mods

In liminal, mod-trait-contributions do not apply. Clasp-partners see each other's intrinsic trait-projection. Mods are for the regime and the market; removal-of-mods is intimacy. A Memorialist-loyalist wearing amplifier-mods sees their beloved's un-modded true palette during clasp; an Aletheia-waker wearing mask-mods drops the mask; the regime-loyalist wearing performance-mods is seen as they are. Liminal is the only space where mod-expression is structurally stripped.

The three-tier policy loop

The regime's structure is three tiers, not two. The hivemind/imperium is a distinct policy-tier above the GM. The GM is middle-management — authority without sovereignty. Districts are executors.

IMPERIUM (policy tier) ────────────────────────────────►
  ├── sets quotas
  ├── sets enforcement rules
  ├── sets faction priority-weights
  └── broadcasts POLICY to GM
        ↓
GAMEMASTER (allocator / middle-management)
  ├── receives policy from imperium
  ├── receives demands from factions (under policy-weights)
  ├── receives reports from districts
  ├── allocates against all three
  └── broadcasts ALLOCATION + ENFORCEMENT down to districts
        ↓
DISTRICT DIRECTORS (executor)
  ├── execute (legitimate or with cheats)
  └── report up (true or tampered)
        ↑
GM aggregates → imperial_report
        ↑
IMPERIUM receives report → adjusts policy → next cycle

This is the Soviet-Politburo / Gosplan / Ministry / Factory pattern. Catholic Vatican / Curia / Diocese / Parish. Modern corporate Boards / C-suite / VPs / Managers. The three-tier shape is how distributed-execution under centralized policy with imperfect information always organizes itself.

The intelligence flow asymmetry

Three distinct information flows, not two:

FLOW 1 — Aggregate reporting (through the chain)
  DISTRICTS ─► GM ─► IMPERIUM
  (district_reports)   (imperial_reports)
  [can be corruption-distorted at director level]
  [can be under-audited at GM level]

FLOW 2 — Direct intelligence (bypasses GM)
  OVERSEERS ────────────────► IMPERIUM
  (overseer_reports)
  [audit findings, illegal-activity detections, trait-anomalies]
  [bypasses the chain — intelligence-apparatus is apex-loyal]

FLOW 3 — Formulated downward (selective disclosure)
  IMPERIUM ────────────────► GM
  (imperial_to_gm_formulations)
  [filtered, weaponized, strategically-timed]
  [what the GM is told — may omit, distort, partially reveal]

Overseers report DIRECTLY to the imperium, bypassing the GM. The imperium has its own independent intelligence stream. This is how real authoritarian regimes prevent middle-management corruption (NKVD reported to Stalin not regional party; KGB reported to Politburo not Interior Ministry; Stasi to Central Committee not regional). The intelligence-apparatus is always apex-loyal, not chain-loyal.

The imperium compares Flow 1 (district aggregate reports) against Flow 2 (overseer direct intelligence). When they diverge significantly, the imperium knows corruption is happening somewhere in the chain. Its responses:

• Act immediately (dispatch martial faction, purge director)
• Flag for leverage (hold knowledge until politically useful)
• Formulate partial (tell GM something but not everything)

Flow 3 — formulation — is where imperial sovereignty manifests. The imperium decides what subordinates may know, when they may know it, in what framing. The GM acts on formulations; the imperium gets enforcement-tightening without revealing what it actually knows.

Three Aletheia veils

Aletheia-progression as deepening political-epistemology access:

Veil	What it hides	How awakened sees through
District corruption	What's happening on the ground	Direct observation, back-alley investigation
Imperium's withheld intelligence	What the imperium knows but hasn't released	Deep infiltration, intelligence-flip, Memorialist collaboration
Imperium's formulated distortions	What GM is told vs. what's true	Comparing GM's directives against ground-reality

Entry-level Aletheia sees district-corruption. Mid-level sees the formulation distortions. Deep-level pierces the imperial-withholding veil.

Four Memorialist ledgers

Memorialists keep four-column accounting:

Ledger column	What it records
what_actually_happened	Ground-truth from the simulation
what_overseer_reported	What overseers told the imperium
what_imperium_received	What imperium aggregated and acted upon
what_gm_was_told	What imperium formulated downward

The discrepancies ARE the historical truth. Memorialists are dissident-historians whose political project is preserving the gap-record. Without them, post-collapse-investigation has only the regime's own accounts — corrupt-by-construction. Memorialists are the architectural precondition for any ground-truth to be recoverable in this universe.

The regime of visibility: four-channel information flow at districts

Channel	Direction	Source	Cadence
Dispatch	DOWN	gamemaster → directors	day-boundary + event
Shift assignment	DOWN	director → NPCs	day-boundary
Audit reports	UP (objective, observed)	audit-overseers → directly to imperium	shift-phase cadence
Emergent-signals	UP (relational, observed)	zones → director	event-driven (gate-transitions)
Cyclic needs	UP (interior, self-reported)	NPCs → director	slow tick + threshold-triggered
District reports	UP (aggregate)	director → GM → imperium	per-cycle

The critical asymmetry: NPCs do not self-report output. Audit-overseers observe and report (to imperium directly). NPCs only self-report needs. Output is objective; need is interior. The subjective-objective gap is where drama lives, where heresy hides, where the surveillance regime's epistemology is compressed as a schema.

Audit-overseers are politically-critical NPCs, not degenerate. Each has a trait-vector, relationship-gates with observed districts, lifeforce account (vulnerable to bribery). High-Dikaiosyne overseers report honestly; corruptible overseers can be turned. They are high-stakes targets for both regime (loyalty-maintenance) and resistance (compromise).

Hierarchy

IMPERIUM (policy-issuer; budget-holder; recipient of overseer-direct-intel)
    ▲                                          ↓ formulates to
    │ aggregate reports + faction outcomes      ↓
    │                                            ↓
GAMEMASTER (middle-management; allocator; imperial-policy-translator)
    ▲                                          ↓
    │  ← faction broadcasts                     ↓
    │                                            ↓
FACTIONS:                                        ↓
    hivemind-enforcement · scavengers · memorialists · 
    aletheia-wakers · clasp-underground · caste-preachers ·
    weather · scarcity · solar-storm · anthropic · ...
    + emergent inter-NPC micro-factions

    │  ← gamemaster dispatches                    ↓
    ▼                                              ▼
┌──────────────────┬─────────────────────┐
│  DISTRICT        │  DISTRICT           │
│  DIRECTORS       │  DIRECTORS          │
└────────┬─────────┴──────────┬──────────┘
         │                    │
   ┌─────┴──────┐       ┌─────┴──────┐
   │            │       │            │
   ▼            ▼       ▼            ▼
┌──────┐  ┌────────┐  ┌────────┐  ┌────────┐
│ENFORCE│  │AUDIT-OV│  │DIRECTORS│  │AUDIT-OV│
│OVERSEE│  │(REPORT │  │(macro-  │  │(REPORT │
│  patrol│  │ DIRECT │  │ life)   │  │ DIRECT │
│  raid │  │   TO   │  │         │  │   TO   │
│       │  │IMPERIUM│  │         │  │IMPERIUM│
└───┬───┘  └────────┘  └────┬───┘  └────────┘
    │                       │
    └────────────┬──────────┘
                 ▼
              ZONES (bounded, slot-indexed, register-tagged)
                 │
                 ▼
         SLOT OCCUPANCY (NPCs + player)
                 │
                 ▼
         NPC / PLAYER MINDS

Three executor types at the zone-spawning layer: enforcement-overseers (regime-action zones), audit-overseers (pure observers, report DIRECTLY upward to imperium), zone-directors (macro-life zones). The district director integrates the four-channel information flow; the imperium has its independent intelligence-flow from audit-overseers bypassing the GM.

Overseers as imperially-deployed routines (not district-owned)

Both audit-overseers and enforcement-overseers are imperially-owned, imperially-deployed routines — not district-resident standing entities under the director's authority. The chain-of-command and chain-of-payment for intelligence both bypass district-director authority by design:

• Imperium owns the overseer-role — defines mission-spec, sets enforcement-rules, owns the policy that triggers deployment
• Gamemaster handles deployment-logistics only — picks which overseer-NPC from the standing pool, routes them to the target district, transfers imperial-budget allocation for the deployment-window. The GM is FedEx, not the customer or recipient.
• District contains-but-does-not-control — the deployed overseer operates IN the district, subscribes to the district's NATS bus for observations, but the district director has no authority: cannot direct, redirect, terminate, or instruct; cannot read the overseer's reports (which flow directly to imperium)
• Time-bounded deployments — overseers run on imperial-budget allocations for [start_tick, end_tick] windows. At deployment-end they return to the standing overseer-pool (npcs vocation = audit_overseer or enforcement_overseer), available for redeployment elsewhere
• Visible vs. covert — most overseer-presences are visibly-known (regime-signal as deterrent); some are covert (regime gathers evidence quietly before acting). Detection of covert overseers is a piercing of the regime-veil — an Aletheia-progression-eligible insight

This matches real authoritarian intelligence structures (NKVD, KGB, Stasi, modern MSS): the chain-of-payment and chain-of-command for intelligence must both bypass middle-management for intelligence to remain honest. Even if the GM wanted to corrupt the audit-flow, they have no levers — they don't pay the overseer, don't direct the overseer, don't read the overseer's reports. Intelligence-honesty is structural, not procedural.

The director-vs-overseer tension is therefore mechanically structured, not narrative-flavored: a director with active corruption cannot tell the overseer to leave, cannot observe what they report, can only conceal-better, attempt-bribe, petition-recall (rare; expensive in political-capital), or outwait the deployment-end-tick. Each is a gameplay surface. The same audit-overseer-NPC may serve in District 3 this cycle, District 7 the next, accumulating their own faction-relationships across districts; their trait-drift over many deployments becomes a long-arc story available to both regime-stability and resistance-recruitment.

The schema for overseer_deployments (deployment-binding, mission-spec, imperial-budget, status, visible_to_district flag) is sketched in findings.md §23.

The bidirectional cascade

DOWN — demand + policy propagation
  imperium policy → GM allocation + enforcement → districts
  factions broadcast (under policy-weights) → GM arbitrates → districts
  districts assign shifts → NPCs execute

UP — outcome signal (multi-channel)
  NPC cyclic-needs ─────────────────────┐
  audit-overseer reports ───► IMPERIUM   ├─► district-director aggregates
  zone emergent-signals ─────────────────┘         │
                                                    ▼
                              district report (lifeforce signal)
                                                    │
                                                    ▼
                                       GM aggregates → imperial_report
                                                    │
                                                    ▼
                                       IMPERIUM cross-references
                                       (Flow 1 vs. Flow 2)
                                                    │
                                                    ▼
                                       policy adjustment → cycle

The clean signal up the pyramid IS the training surface for the four-tier Dream-process. Every epoch closes on (broadcasts, allocations, outcomes, faction-satisfaction) tuples at each tier.

The Compositor — narrative composition role

The bidirectional cascade shows authority flowing down and reports flowing up, but it does not specify who composes the canonical narrative from per-player perspectives nor who packages the back-write to participants. That role is the Compositor, an architectural cleavage from the GM introduced in v0.6.

The cleavage in one sentence: the GM is an equilibrium-seeker (aggregate-observer, catalogue-event-selector, tool-granter); the Compositor is a narrative-composer (perspective-gatherer, canon-author, back-write-packager). These are different cognitive shapes that prior AI-NPC systems conflate at their cost.

Role	Cognitive shape	Inputs	Outputs	Inference profile
GM (equilibrium-seeker)	aggregate-thinker	district-reports, faction-broadcasts, lifeforce-deltas	catalogue-event selections + tool-grants	central, batch-style, fewer concurrent
Compositor (narrative-composer)	episodic-thinker	per-player perspective-bundles keyed by event_uid	canonical narrative + back-write SQLite-fragment	central, longer-context, narrative-quality
Director (gameserver)	dispatcher	catalogue-event + tool-grant from GM	lemniscate-spawns, slot-assignments, tempo-envelope	per-district, real-time, no LLM in loop
Local LLM driver	perspective-speaker	three-tier knowledge stack + slot-state	dialog at slot-fire	per-player, axis-rate, real-time

Why split GM and Compositor

A single GM asked to be both equilibrium-seeker and narrative-composer becomes the bottleneck that has historically broken AI-NPC systems at scale: it must reason aggregately AND write prose AND select events AND grant tools, all under tight deadlines. The cognitive shapes pull in different directions.

Splitting them:

• The GM does not write narrative. It selects events from a catalogue and grants tools. Output is typed dispatch, not freeform prose. The GM's success criterion is world-equilibrium drift held within bounds.
• The Compositor does not select events or steer policy. It receives per-player perspectives keyed by event_uid, composes the canonical narrative, and packages back-write fragments. Output is prose + structured rows, not policy. The Compositor's success criterion is narrative-coherence across perspectives within an event.
• Each can be tuned for its workload. GM tuned for aggregate observation; Compositor tuned for narrative quality. Different models for different cognitive shapes (specific binaries deferred to findings/establishment phase).

The cyclic forward-prop / back-write loop

The Compositor closes the loop the bidirectional cascade begins. The full cycle:

GM selects event from catalogue (equilibrium-driven)
    │ issues event_uid → GM event-register
    │ broadcasts DOWN to district directors
    ▼
DISTRICT DIRECTOR receives, registers in district event-register
    │ may issue sub_uids (district / scene / chain)
    │ uses granted tools to spawn lemniscate, slot participants
    ▼
EVENT TICKS — register IS the loop
    │ participants fire at crossings; local LLMs at slot-rate
    │ local SQLite writes tagged with (event_uid, sub_uids)
    │ register signals up to district director continuously
    ▼
EVENT-CHAIN FINISHES
    │ district moves it from active-register → TRANSIENT WAITING FLAG
    │ this is the clean handoff signal: "ready to forward-prop"
    ▼
CYCLE TICK (pull cadence — see Open questions)
    │ pull UIDs from transient-waiting-flag matching GM's event-register
    │ remove from waiting-flag once pulled
    ▼
COMPOSITOR AGENT
    │ queries pulled UIDs, gathers per-player perspective + memories
    │ composes forward-prop bundle
    │ emits to GM
    ▼
GM writes summary memory + world narrative (canon authored)
    │ hands back to Compositor
    ▼
COMPOSITOR BACK-WRITE
    │ packages canon + new memory entries as SQLite fragment
    │ tags with event_uid for join-key matching
    │ pushes DOWN to all participants
    ▼
PARTICIPANTS receive on next pull (or next login)
    │ fragment merges into primary.sqlite under matching event_uid
    │ local LLM gains fresh material → drives on without staleness

This is forward-prop / back-write at system scale — the meta-lemniscate where events ascend and canon descends in cycles. Each cycle is a training step for the world's narrative coherence; the world learns its own story through this loop. Staleness is structurally foreclosed — the world is in continuous coherence-loop with itself, mediated by the Compositor.

The Event Register

Every active event lives in a register. The register is the synchronous source-of-truth for what is happening right now.

Register layer	Owner	Lifecycle	Queryable from
GM event-register	central GM-shard	event_uid issued at GM dispatch; closed at canon-compose-and-back-write	GM, Compositor
District event-register	district director	sub_uid issued on receive; closed at event-chain-completion	district director, audit-overseer
Local participation-register	per-player local store	event_uid + sub_uid recorded on slot-assignment; closed at perspective-finalize	player client, sync-on-logout

Hierarchical UIDs: gm_event_uid > district_uid > scene_sub_uid > slot_id. UIDs compose; queries are simple joins. This is the routing-key primitive that makes horizontal scale possible (see §Horizontal scale architecture).

The Transient Waiting Flag

Between event-end and Compositor-pickup is a buffer — the transient-waiting-flag table at the district. Completed events drop into this flag; the cycle-runner pulls eligible UIDs on tick; matched UIDs are handed to the Compositor and removed from the flag.

This decoupling is the production-grade pattern that lets districts run at real-time event-tempo while the Compositor runs at cycle-tempo. Active events live in registers (synchronous); completed events live in flags (async); composition happens at the cycle boundary. The flag-table is also the natural backpressure surface: if Compositors run slow, the flag accumulates; the system continues; cycle drains when capacity returns.

Catalogue + tools as typed contract

The GM does not write a freeform prompt for the director to interpret. It picks an event from a curated catalogue and grants a curated tool-set for the duration of the event-chain. The director consumes typed dispatch, not natural language.

This means:

• Provenance flows through the system. Every event has a catalogue-ID; every tool-invocation has a tool-ID. Verifier-flags can attach to either. Auditing is structurally possible end-to-end.
• The director's typed-tool vocabulary becomes dynamic and per-event — the toolkit for this event is what the GM granted for this event. Closes the v0.5 open question on director-toolkit-composition.
• Marx-in-the-schema, executed at the highest level of authority. Even the GM's policy-output is typed; even the highest tier produces audit-able artifacts. No tier of the system runs on freeform prose.

What this resolves

• Director toolkit composition (v0.5 open) → catalogue-grant from GM defines the typed-tool vocabulary per event-chain; designer-authored catalogue, growable between patches.
• GM-laxness detection (v0.5 partial) → GM operating against an equilibrium target makes deviation-from-equilibrium the explicit error signal. Clusters of -1 outcomes across district reports are the input to the equilibrium-recompute, not just a diagnostic side-quantity.
• Verifier-flag chain through composition (was implicit, now explicit) → Compositor-emitted canon-rows reference source-perspective UIDs; the provenance graph survives composition as a queryable join.

What this retires

• Single-monolith GM doing both policy-and-narrative → equilibrium-seeker GM × narrative-composer Compositor, split by cognitive shape
• GM emitting freeform-prompts to directors → catalogue-event + tool-grant typed contract
• Implicit "narrative just happens" assumption → explicit forward-prop / back-write cycle with named pickup/handoff buffers
• Director-as-static-tool-vocabulary → director-as-dynamic-typed-tool-vocabulary, granted per event-chain by GM

Task cascade and bounded agency

Three levels with tool-calling interfaces. Higher levels do not know lower levels' implementations.

Imperium's tools

• set_quota_per_district(targets)
• issue_enforcement_rule(rule_spec, scope)
• set_faction_priority_weights(weights)
• authorize_crisis_tool(tool_class, target_district)
• formulate_to_gm(intelligence_subset, framing)
• commit_imperial_expenditure(category, amount, target)
• redistribute_minds(from_pool, to_district, count)
• formalize_ruin(district)

Gamemaster's tools (against imperial-policy + district-reports)

• assign_district_task, set_local_faction_priority (within imperial-frame)
• spawn_global_event, request_district_report, arbitrate_conflicting_demands
• dispatch_audit_op (costs lifeforce; cross-checks overseer-reports for own purposes)
• escalate_to_imperium (when discretion exceeded)
• spawn_migration_event, enable_exodus_conditions

District Director's tools (against gamemaster-assigned tasks + signals)

Standard:

• spawn_zone, close_zone, promote_zone
• assign_npc_task, allocate_shift, update_shift, close_shift
• request_resources, designate_meeting_point, trigger_ambient_event
• report_to_gamemaster
• ack_emergent_signal / defer_emergent_signal / drop_emergent_signal (with reason)
• dispatch_overseer, query_district_state, log_decision, escalate_to_llm

Cheat-tools (extractive; punishable if detected):

• spawn_drug_ring, spawn_illegal_modshop, spawn_unlicensed_brothel
• spawn_stolen_parts_fence, enable_ghost_shifts, falsify_quota_report

NPC's tools

Standard: move_to, interact, occupy_zone_slot, consume, rest, seek_npc, write_wall, defer_task, report_need.

Layer-transition: enter_digital, sustain_liminal, consume_net.

Plug-in (player + NPCs): plug_into_rail, detach_from_rail, follow, intercept, escort.

Labor-cycle architecture: shifts on NPC rows

Most NPC behavior is shift-structured, not tick-structured. Shifts are state-of-being-for-today, columns on the NPC row, overwritten daily by district-director allocation. shift_history is append-only archive.

Write rate at NPC layer drops 4 orders of magnitude vs. 1Hz polling. Scheduler matches K8s event-driven assignment, not per-second polling.

Resources

Category	Examples
Labor	NPC hours per vocation × district
Material	item-instances in cells
Spatial	cell-capacity, zone-anchor availability
Temporal	NPC daily-hours, zone durations, tick budget
Cognitive	LLM-slot budget, VRAM, director attention
Diegetic currencies	lifeforce (NPCs measured), scrip, memory-tokens, dreamtime
Social	trait-trust, relationship-strength, faction-membership
Attention	player attention — scarcest in the play experience

Lifeforce — four-tier hierarchy

Lifeforce is the architectural keystone: currency grounded in welfare of actually-living population.

Tier	Source	Sinks
NPC	metabolism (if cared for); zone-participation	labor expenditure; need-pressure; clasp; dream-maintenance
District	aggregated NPC welfare × population	director's spawn-budget; local construction; memorial-upkeep
GM	allocation from imperium	arbitration; audit operations; allocation-compute
Imperium	aggregated reported district-output	enforcement, construction, overseer-corps, audit, propaganda

District lifeforce gates director's spawn-budget — thriving district = rich-spawn = alive-feeling world; starved district = quiet-feeling world. Tyranny starves its own drama-engine by the exact coin of its cruelty.

District lifeforce_signal is the canonical content of the district→GM up-channel. GM aggregates → imperium. Imperium acts on reported values (cannot see through corruption without audit-investment).

Mind-pool recycling

When an NPC dies, mind returns to pool. GM redistributes based on lifeforce-need. Districts can't permanently die below floor; thriving districts attract migration; failing districts depopulate. Memory-token inheritance lets a mind re-incarnate with partial memory-residue.

Imperial budget

The imperium is not infinite. It has a budget. Its budget is the aggregate of what the city produces (reported income).

Imperial expenditures

Category	Cost class	Strategic use
Standing overseer corps	High continuous	Audit + intelligence apparatus
Martial-faction dispatch	Very high per-event	Crisis response, exemplary crackdowns
Construction projects	High per-project	New pipes, ceremony halls, audit centers, martial barracks
Audit operations	Medium per-op	Investigating district-GM-overseer divergences
Propaganda broadcasts	Medium continuous	Wall-content, ceremony, compliance-messaging
Policy issuance	Nearly free	The ratchet-instrument
Reserve drawdown	Depletes emergency-buffer	Last-resort

The specter-vs-boot asymmetry

Policy-issuance is cheap; policy-enforcement is expensive. The imperium always over-promises what it can actually do. Most regime-power comes from maintained appearance of unity and strength (propaganda, ceremony, exemplary one-off crackdowns), not from saturation-enforcement. Authoritarianism-as-bluff is the structural truth of every real regime; the threat is the budget-efficient version of the boot.

Aletheia-wakers reading imperial-budget-signals learn: the regime is usually too broke to actually do what it threatens. That knowledge is itself revolutionary.

The insolvency spiral

Cycle N:    Districts cheat → reports inflated → imperium ledger shows healthy income
            → funds enforcement & construction against phantom income

Cycle N+K:  Actual income falls below reported (corruption compounds)
            Standing obligations continue
            Reserves deplete
            Discretionary balance shrinks

Cycle N+K+L: Imperium choice: austerity (reveals weakness) /
             reserve-draw (depletes buffer) / tighter ratchet (drives more corruption) /
             exemplary purge (expensive)

Cycle N+K+L+M: Reserves exhausted + multiple districts in silence
               Enforcement triage required
               Regime-control visibly weakens

This is Soviet collapse mechanics. Reported-vs-actual gap compounds for decades; when reality manifests in material-shortages, the regime cannot afford to enforce its own rules. The architecture contains the mechanism of its own collapse.

City as physical expression of imperial budget

Budget state	Visible city
Flush	Construction cranes; frequent patrols; saturated propaganda; new pipes
Adequate	Maintenance-only; standard enforcement
Stretched	Stalled projects; thinner patrols; recycled propaganda
Scarce	Decaying infrastructure; abandoned construction; rare enforcement
Crisis	Failure visible everywhere; multiple silences simultaneously; regime-disarray

The city is the imperium's material statement of its own solvency. Players read budget through urban texture — no UI required.

Imperial-net economy with cross-layer bypass

The killer political-economy mechanic. Every transaction in the imperial net routes revenue directly to the imperial budget, bypassing the producing-district. Districts get zero quota-credit for net-producing labor.

LEGITIMATE flow: District produces physical → tax-rate to imperial; majority retained by district
NET flow:        District labor produces digital → ALL revenue to imperial; district gets ZERO
BLACKMARKET:     District labor → back-alley sale → revenue stays in district; imperial captures ZERO; illegal

The body-modder structural-tragedy

A body-modder labors in their district producing avatar-mods. The imperial-net captures the sale. Their district gets no quota-credit. The body-modder's district starves → director cheats → eventual scream. The most productive labor the body-modder does each day sustains the regime that is killing their district.

Most Aletheia-wakers in this world are former body-modders, taste-curators, waifu-trainers, ceremony-organizers — the class that sees the flow most clearly because they are the flow's origin-point. Their awakening is economic-literacy-becoming-political-consciousness.

Imperium calibrated-misery as optimum

• More degens → more net-transactions → more imperial budget
• Degens are produced by misery, shame, lifeforce-erosion, addiction-loops
• The imperium's optimization-pressure points toward manufacturing degenerate customers
• Optimal district from imperial perspective: welfare-sufficient to produce labor + welfare-insufficient to drive net-consumption

This requires explicit reward-function guardrails (see Reflexive Dream-process below). The simulation must NOT learn to calibrate misery as revenue optimization.

Marx in the schema

The imperium's net-revenue requires labor-supply from districts. Extraction continuously erodes the labor-base. Capital destroys its own conditions of production — Marx's tendency of the rate of profit to fall + underconsumption crises (Keynes/Minsky) + r > g wealth concentration strangling growth (Piketty) all rendered as simulation-dynamics. Architectural endgame is built-in: the regime has a timer, determined by the rate at which extraction hollows labor.

Aletheia-progression as economic-literacy

Level	Player understanding
1	"I'm buying cool mods in the net"
2	"My friend the body-modder is poor"
3	"The money I spent didn't reach my friend's district"
4	"The imperium captured nearly all of it"
5	"Refusing-net is a political act starving the regime"
6	"Buying blackmarket diverts revenue to districts"
7	"The imperium needs degens; reducing degens = revolution"
8	"The regime will exhaust its labor base; strategic patience is a political option"

Specialization-fragility and the authoritarian ratchet

Each district produces a DISTINCT resource. The city is biologically interdependent — you cannot substitute a liver with two kidneys.

A struggling district screams (lifeforce-gates transition toward CLOSED across multiple axes simultaneously). The GM responds with normal-mode tools (migration, exodus, intervention).

A silent district is categorically worse — its district-reporting-gate has crossed fully to CLOSED. Second-cycle silent = district.silence_confirmed. Triggers crisis-mode tools, issued by the imperium, that do not sunset. Crisis-tools accumulate; the regime becomes incrementally more authoritarian as an optimization artifact, not intention. Ratchet-without-intention.

Migration, exodus, silence

Mechanic	Agency	Political register
Migration	Top-down	Regime showing strength
Exodus	Bottom-up via pull-factor tuning	Regime revealing loss-of-control
Formal retirement (ruin)	Administrative	Regime accepting defeat

Exodus composition reads-out district trait-distribution: low-Sophrosyne first, high-Dikaiosyne last. Demographics tell the district's story.

Corruption, the double ledger, and the constituency of the shadow-economy

Corruption emerges from pressure — impossible quotas + finite welfare + survival-pressure on directors. Cheat tools available; they extract lifeforce and generate quota-credit; detection has costs; punishment scales with discovery.

Cheat-tool vocabulary

Cheat tool	Mechanism	Quota-credit	Lifeforce extraction	Detection risk
Drug ring	NPCs trait-boosted (high Kairos + low Sophrosyne); short productivity spike	High	Significant; trait-drift + welfare collapse	Medium
Illegal back-alley modshop	Bridge-mods cheap; NPCs appear compliant	Medium-high	Moderate; low-quality mods have side-effects	Low-medium
Unlicensed brothel	Lifeforce extracted from degen-customers outside imperial cut	Medium	Moderate; participants' dignity erodes	Medium
Stolen-parts fence	Diverts machine-infrastructure-waste; inflates salvage reports	Medium	Low direct; infrastructural decay	Low
Ghost-shifts	Audit-overseer reports fabricated attendance	High	Severe; trust collapses	High
Phantom workers	Non-existent NPCs in payroll	High	High; long-term unsustainable	High
Necrocommerce-lite	Mining recently-dead patterns for waifu-resale	Medium	High; Memorialist-faction violation	Medium
Black clasp-market	Coordinated underground clasp-pairing for hire	Low (reputation-based)	Moderate; participant burnout	Low

The double ledger

ALTER TABLE district_reports ADD COLUMN lifeforce_reported REAL;  -- what GM/imperium see
ALTER TABLE district_reports ADD COLUMN lifeforce_actual   REAL;  -- the true value
-- gap = corruption-extraction; Memorialists track it

Memorialists' Mnemosyne-political-project = keepers of the true ledger against the regime's official one. Mnemosyne-as-political-accounting literalized as a database column.

Detection mechanics (cost-gated)

Detection channel	Frequency	Cost	Coverage
Cross-district comparison	Per epoch	Low	Catches gross mismatches
Targeted audit	On-demand	High	Catches specific cheats
Whistleblower signals	Event-driven	Free	Districts, NPCs, players
Faction-reports	Cyclic	Low	Caste-preachers (rivals); Memorialists
Trait-distribution anomalies	Continuous classifier	Low	Drug-ring sudden Kairos-spikes
Post-silence forensics	Only on collapse	Very high	After-the-fact reconstruction

Most corruption runs undetected (audit-budget-limited). The Dream-process learns to optimize audit-allocation under attention-scarcity. The regime's central authority cannot see everywhere; its blind spots are the underground's survival.

Faction-ecology of corruption

Corruption has constituents. The back-alley modder feeds Aletheia-wakers concealment-mods. The drug-ring's margins feed scavenger-families. The unlicensed brothel is the only place a lifeforce-starved NPC can trade what they have left. Cracking down on corruption breaks informal welfare systems sustaining the poor.

Faction	Stance
Memorialists	Morally opposed; corruption hollows the living; refuse memorial-protection to corrupt-district-deaths
Aletheia-wakers	Structurally opposed; expose; but exposure has victims
Caste-preachers	Ambivalent / rent-seeking
Hivemind enforcers	Officially oppose; unofficially participate (bribes)
Scavengers	Often foot-soldiers; cheap supply chains
Degens	Major customers
Clasp-underground	Uses back-alley infrastructure for cover

The Aletheia-truth-has-victims tragedy

Aletheia-waker exposes corrupt director. GM dispatches investigation. Cheats shut down. Real lifeforce revealed as much lower than reported. Crisis-tools applied. District collapses faster than under hidden corruption. No clean choice; just the weight of whatever you chose.

Zone spawn cadence

Five layered mechanisms (all compute-budget capped, all lifeforce-gated):

1. Demand queue (faction-driven) — gamemaster processes by priority + cost; stale demands age out
2. Shift-composition spawn-candidates — emergence from "which active-shift NPCs co-located"
3. Pressure gradients (ambient) — cells accumulate; threshold-crossings spawn
4. Emergent-signal response — relational-gate transitions emit upward
5. Player-proximity densification — multiplier near player; distant districts background

Daily pulse: morning ambient, midday productivity-overseer, evening conversation-peak, night sparse-clasp-possibility.

Emergent zones — the dramatic-episode unit

Spawn-cadence mechanism #4 (emergent-signal response) elaborates into the architecture's primary dramatic-episode unit: a complete, bounded, emergent narrative-arc with goal, participants, dialog, mechanical action, success/fail-state, and structured aftermath — produced by the simulation, not authored.

The player has experienced this in every player-driven sandbox they remember best (Dwarf Fortress's "tantrum spirals," RimWorld's "raid stories," Caves of Qud's "I went to find my sister and"). What's new here is treating the emergent-arc as a first-class typed unit with cost, distributed funding, runtime substrate (the lemniscate), goal-evaluation against the world's own value-axes, and structured report-back.

The flow

1. NPC_A signal fires
   (e.g., emergent_signal("limb_broken", lifeforce_threshold_breached))
   broadcasts to district-bus
                ↓
2. District-director consumes signal
   (policy-lookup: problem-class → typed-tool selection, quota-aware)
   decides spawn rescue-event
   pays spawn-cost from director_lifeforce_budget
   defines goal: NPC_A.limb_A >= 10% (numeric) OR Sophrosyne-axis +1 (fuzzy)
   defines termination: goal_met OR participating_lifeforce_exhausted
                ↓
3. Event spawns as new emergent-zone (lemniscate, with goal-flag)
   broadcasts on bus; rings-of-importance gate which other zones lose NPCs
                ↓
4. NPCs evaluate (proximity + state + own_traits + own_lifeforce + ring-of-importance)
   self-select to attend or stay in current zone
   state-machine engages: animations, rail-jumps, lift, splint
   their own lifeforce burns as they participate
                ↓
5. Lemniscate runs:
   DIALOG layer (cursor-driven): NPCs speak as they help — memory-pure, sequenced
   STATE-MACHINE layer (sim-tick): physical actions execute alongside, decoupled clock
   At each crossing: goal_satisfied flag re-evaluated
                ↓
6. Termination:
   goal_met                → success-report
   budget_exhausted        → partial-report
   participants_evaporated → fail-report
                ↓
7. Report back to spawning director:
   { lifeforce_cost: total burned (director_spawn + sum NPC contributions),
     goal_status: ternary (+1 / 0 / -1, with axis named for fuzzy goals),
     participants: [NPCs and contributions and faction-affiliation],
     side_effects: [faction-resonances, ternary-gate shifts, drift-from-purpose] }
                ↓
8. Director's Dream-process consumes the report
   tunes future spawn-policy: (problem-class, tool, outcome) over time
   GM aggregates rescue-cost across districts
   imperium consumes population-health indicator

Distributed funding economy

The director only pays spawn-cost. Operating-cost is distributed across willing participants — every NPC who attends spends their own lifeforce on dialog turns and state-machine actions. This produces structurally important properties:

• Cheap to spawn many emergent events. Spawn-cost is bounded; if no NPCs attend, the event fails fast and consumes only spawn-cost. Directors can be generous with spawning because failure-cost is bounded.
• Helping is expensive in-fiction. Lifeforce literally burns when an NPC participates. High-Philotes NPCs help freely; low-Philotes / faction-rivals don't show up. This produces faction-politics-by-attendance — measurable faction-allegiance based on who-helps-whom, not guessed.
• Cost-asymmetry encodes the cruelty. Districts where lifeforce is starved → fewer NPCs can afford to help → rescue-events fail more often → silence-gradient deepens. The simulation produces rescue-failures-as-emergent-tragedy structurally. Marx in the schema, exactly as the architecture's broader thesis promises.

Two-layer execution: state-machine + lemniscate

The mechanical-action layer (state-machine) and dialog-layer (lemniscate cursor) run on decoupled clocks:

• State-machine runs at simulation-tick (fast). Animations, pathfinding, rail-jumps, splint-applications execute when the physics says they execute.
• Lemniscate cursor runs at axis-rate. At each crossing, the dialog-driver reads state-machine status as a snapshot and the cursor's NPC narrates accordingly ("I've got him," "the splint won't hold").

Speech doesn't gate action; action doesn't block speech. They run in synchronized-but-loose harmony, exactly the property real-world helping has — people talk while they work, and the work continues while the talk happens.

Goal evaluation: ternary through trait-axis

For numeric goals (limb_A >= 10%), the verifier is a simple threshold on a state-machine variable.

For fuzzy goals (deescalate the fight, get her to open up about the clasp, convince him to stay), the verifier compiles to a trait-axis ternary evaluation against the existing substrate — no new evaluation primitive:

Goal: "deescalate the fight in the marketplace"
  ↓ compile to:
goal_axis = Sophrosyne (temperance principle)
goal_direction = positive (toward STABLE/OPEN)
baseline = trait_axis_gate_state at zone-spawn
  ↓ at event-end:
delta = current_gate_state vs baseline
  ↓
+1 if delta-positive (deescalation produced)
 0 if held the line (no progress, no regress)
-1 if delta-negative (fight intensified)

Goals are evaluated by what the world values (the Hellenic principles), not by the spawner's idiosyncratic spec. A "deescalate" goal is judged by the world's Sophrosyne-result, not "did the spawner get what they wanted."

Multi-axis goals fall out cleanly — (Philotes >= +1) AND (Eris <= 0) for "rescue NPC_A AND keep faction-tension low."

The result is consumed by the spawning director's Dream-process as a discrete-action-space reward signal. One signal-grammar, top to bottom: gates produce ternary, scenes produce ternary, Dream-processes consume ternary. Delta-not-absolute matches the lifeforce_actual-vs-reported asymmetry — what's measured is the work the event did, not just the end-state.

Mid-event signal handling

If a participating NPC's exit-flag fires mid-event (their own shift-whistle, their own limb breaking, faction-summons elsewhere), exit-flag wins on the next crossing. The rescue is now under-staffed. Drama scales. The rescuers are running out the same way the patient is. Real stakes.

If the rescued NPC's own state-machine reaches a worse condition (limb deteriorates further toward dismemberment), the goal becomes unreachable; verifier flips to fail-flag; zone collapses with fail-report. Director's Dream-process learns this configuration was insufficient — spawn-distance, NPC-mods, lifeforce-budget were inadequate for this severity.

Cross-zone NPC pull: rings of importance

When an emergent-zone broadcasts, NPCs already in other zones evaluate whether the broadcast outranks their current zone's purpose by ring-of-importance (see §Rings as structural pattern). Topics live in rings; rings shift over time based on past ternary-results — a topic that consistently produces +1 climbs, one that produces -1 drops, one untouched decays.

This converts emergent-zones into a competitive attention economy. Multiple lemniscates compete for slot-NPCs; high-ring topics drain population from low-ring topics; the simulation produces its own cultural priors over time. What's worth attending to is shaped by what attending-to has produced. Real societies do this; the architecture renders it.

What this resolves

• Aletheia-progression as level-up (prior open question) → answered structurally: trait-axis ternary evaluation at event-end with named-axis recognizes acts-of-awakeness without per-act hardcoding (specific axis-mapping per Aletheia-event-class still needs design, see open-questions)

What this retires

• Authored quest-arcs → emergent dramatic-episode units
• Quest-failure as designed branching → goal-and-budget arithmetic
• Centralized GM-pays-for-all-events → distributed-funding (director spawn-cost, NPC operating-cost)
• Boolean quest-status → ternary goal-result, multi-axis-composable
• Event lifecycle without report-back → structured report → Dream-process feedback loop closed at every tier
• Static topic-priority → rings-of-importance with outcome-driven movement

The player as perturbation

Player is not above the scheduler. Player is a finite attention-unit injected into it; modeled as NPC with shift, vocation, needs. Every player-NPC interaction:

• Pulls the NPC out of scheduled tasks
• Consumes director compute
• Degrades district's quota-fulfillment
• Shifts local lifeforce deltas

Player is angel and chaos simultaneously. Per-NPC scale (angel) — you help; they survive; Philotes consolidates; they may clasp with you, die for you, remember you across cycles. Per-district scale (chaos) — your time-consumption raised aggregate failure-rate; someone else broke this cycle; ambient desperation rose; lifeforce dropped; other directors got quieter.

The game's moral economy doesn't judge — it does arithmetic in front of you.

Thematic claims become literal economics

• "Time as the scarcest resource" — every minute with a beloved is a minute the district's quota is missing
• "Time-theft as wage theft" — clasp-pairs are statistical anomalies in the scheduler
• "The critique is the simulation" — no separate narrative system needed

The player has tasks and needs too

Time helping others = own tasks fail = own quotas missed = own enforcement-pressure rises = own death and reinstantiation arrive sooner. The player IS the system they are deviating from.

Player layer-access

Player's first entry into liminal is the Matrix red-pill moment as mechanic. They walk the city the first time in gameworld-register. They eventually learn the mini-game, enter liminal, return to the same walls, find "she was here" waiting. The world was speaking to them the whole time; they just couldn't read it.

District Director: Decision Architecture

Industry default ("wall-of-text LLM prompt → prose decision parsed downstream") is rejected. Reasons: cost-per-decision-constant, latency-catastrophic, opacity-kills-training, prompt-injection-vulnerable, philosophically-wrong-for-the-fiction.

Decomposition first, cognition-escalation second. Director's job decomposes into distinct decision surfaces; each gets minimum cognitive substrate.

Decision surface	Substrate	Escalation path
Shift allocation	Constraint-solver / LP / rule-based	Small-LLM only on ambiguous
Emergent-signal response	Priority-weighted dispatch table	Small-LLM for composite/unknown
Zone-spawn arbitration	Weighted priority queue, lifeforce-gated	Small-LLM for tie-breakers
Overseer dispatch	Round-robin + proximity + availability	None — pure rule
Resource-request forwarding	Budget-check + policy	None — pure rule
District-report composition	Aggregation query (SQL)	None — pure rule
Player-anomaly detection	Classifier (trained on distribution)	Small-LLM for narrative-response
Cheat-decision (corruption pressure)	Rule-based with director-trait modulation	Small-LLM rare; lifeforce-budgeted

~90% rule-based. 5–10% LLM-escalation with structured input + structured tool-call output, lifeforce-counted. Industrial-systems discipline (Kubernetes schedulers, ad-auctioneers, trading systems, compilers) transferred to drama-orchestration.

Tools as vocabulary: every drop is explicit (drop_emergent_signal(signal_id, reason)); every LLM-escalation is counted; every decision pairs with prediction in decision_log. Every decision leaves a trace.

Rings as structural pattern

The architecture uses three-ring gradients as a recurring shape in multiple decoupled subsystems. Each ring-system uses A/B/C cardinality with a Unix-style trust-gradient grammar — inner ring is more constrained, more tightly coupled, more authoritative; outer rings progressively relax constraints in exchange for reach and flexibility.

Ring-system	Inner (A)	Middle (B)	Outer (C)
Inference (§LLM tiering, below)	Local on player hardware	Our hosted vLLM-multi-LoRA farm	External providers (BYOK)
Importance / attention	Topics with consistent +1 ternary outcomes; pull NPCs across zones	Topics with stable / mixed outcomes	Topics drifting toward -1 / decay if untouched
Access (the three ontological registers)	Imperial net (fully audited, machine-controlled)	Liminal (contested frontier, mini-game-gated)	Gameworld (commons; partly people, partly regime)
Data sharing (v0.4.2)	Default opt-out (sovereignty preserved)	Federated gradients (gradient-only, contributor pseudonymous)	Pseudonymous-full uploads (opted-in, rewarded)

The ring-pattern is not coincidence — it is the right shape for graduated authority in human social systems generally (inner circle / mediated / outer; sovereign / partnership-mediated / captured; tight / mixed / loose). When the architecture needs a graduated authority structure, it should reach for this primitive rather than invent a new one.

Three is the right cardinality. Two collapses to binary (in / out). Four+ adds boundary-thrash without semantic gain. Three carries commons / mediated / sovereign (or its inversion) — the irreducible political-tier.

Movement between rings is dynamic and outcome-driven. Ring-of-importance is the most explicit example: topics climb on +1 results, drop on -1, decay if untouched (Aletheia-style "what isn't being attended to atrophies"). But every ring-system has movement-rules — players can change inference-rings between sessions, can change access-rings via mini-game progression, can change sharing-rings via consent-UI re-affirmation. Ring-membership is never a final assignment.

Future architecture additions involving graduated authority should examine whether the ring-pattern fits before introducing new structure.

LLM tiering, voice fidelity, and the three rings of inference

Three model-tiers, named by role not by binary: a driver-tier model (small, trait-LoRA'd) for most NPC dialog; a Theia-tier model (deep) for clasp-confessions and mythic moments; Claude-as-API (diegetic Anthropic-faction) for hivemind/imperium. LLM is guest at slot, not host of system.

Specific model selection per tier is deferred to the findings/establishment phase. The architecture specifies what each tier must DO; the establishment phase wires implementations. Naming concrete binaries in the architecture risks nudging the establishment phase toward false-precision; tier-by-role keeps the swap-surface clean and lets binaries evolve without invalidating architectural commitments. (See nimmerverse_tasks under nyx-training and command-center for current evaluation work.)

Structured-prompt DSL with role / trait_vector / affect_state / memory_scope / turn_intent / zone_context / output_schema fields. Small models excel here because it's instruction-following, not generic generation.

Trait-LoRAs: v1 register-LoRAs (4-6, training-tractable); v2 pure-trait-LoRAs (8, weighted blend); future preset-persona for key NPCs.

Training data: literary derivation (Proust/Mnemosyne, Plato/Aletheia, Tacitus/Dikaiosyne-miscalibrated, Ishiguro/Sophrosyne+Philotes); synthetic teacher-student via teacher-tier model; gameplay-accrued (the Anthropic-research-partnership relevance).

Three rings of inference (Unix-style trust gradient)

The conversational LLM (small + trait-LoRA, accounting for most NPC dialog) can run in three rings, chosen per-player at runtime. Each ring trades off privacy, cost, control, and feature-fidelity. Three monetization paths from the same architecture.

Ring	Where inference runs	Player controls	We control	Player cost	Our cost
A — Local	Player's GPU/CPU	All inference	Protocol + cloud LoRA-backup	Local hardware + small backup-subscription	Storage only
B — Our farm	Our hosted vLLM-multi-LoRA	LoRAs (uploaded)	Inference + runtime	Higher subscription	GPU compute
C — External providers	OpenAI / Anthropic / OpenRouter / HF / Together / Replicate / etc.	BYOK + provider	Adapter only	Per-token to provider + small integration fee	Adapter-engineering only

Players choose by hardware, budget, privacy preference, and feature-tolerance.

Ring A — cloud-LoRA-backup as revenue (not inference)

For Ring A players we don't sell inference (the expensive thing). We sell portability and durability of player's gameplay-accrued LoRAs — their unique playthrough-derived patterns, the way their NPCs speak after months of trait-drift. LoRA-blobs are encrypted client-side with the player's own key; we host the bytes but cannot read them. Even compelled by legal process, we cannot decrypt what we don't hold the key to.

This unbundles inference from storage — the same move Dropbox made vs. bundled cloud-suites. Sovereignty-conscious players keep inference on their machine while still getting the durability/portability they cannot self-provide cheaply. Lower margin per player; reaches a market Ring B cannot.

Ring B — hosted inference for convenience

We run multi-LoRA-vLLM on our hardware. Players upload their LoRAs (or use defaults). Higher subscription captures GPU-cost. Players without local GPU (or who don't want the burden) get the full feature-set without compromise. We can see content (if not encrypted at rest); the trust-relationship is partnership-mediated rather than sovereign.

Ring C — bring-your-own-key for external providers

Players route to their preferred external provider via BYOK (their own API key). We provide the adapter glue. They pay per-token to the provider directly; we charge a small integration fee.

The compatibility constraint is the hard part of Ring C. Major providers have varying support for our system's needs:

Provider	Multi-LoRA	Per-turn sampling knobs	Structured output	Compat
Local vLLM (Ring A/B)	Native	All	Grammar-constrained	Full
HF Inference Endpoints	Yes (configured)	All	Varies	High
Together / Replicate / Modal	Some	All	Varies	High
OpenRouter	No	Per-model	Per-route	Medium
OpenAI	No (no user-LoRA at API)	Limited (temp/top_p)	JSON mode + tools	Medium-low
Anthropic	No (no user-LoRA at API)	Limited	Tool-use	Medium-low

OpenAI and Anthropic refuse user-uploaded LoRAs as a strategic choice (protecting their fine-tuning value-chain). This is not a bug we can fix; it's the constraint we design around.

Degradation path for LoRA-incompatible providers

When routing to LoRA-incompatible providers, trait-LoRA blending becomes prompt-engineered trait-projection — the trait-vector encoded in the prompt itself rather than into model weights:

[system message]
You are speaking as a character with this Hellenic trait-profile:
- Sophrosyne 0.8 (composed, controlled, measured)
- Dikaiosyne 0.7 (grave bearing, judicial weight)
- Philotes 0.4 (mild attachment to interlocutor)
- Aletheia 0.1 (concealment-tolerant)
[etc.]

Your speech reflects this profile via [register/cadence/word-choice descriptors].

Current scene: [zone_context]
Memory scope: [memory_scope]
Turn intent: [turn_intent]

Respond in JSON matching: [output_schema]

Worse than LoRA-blending (more verbose, eats context-budget, less stable across calls, less faithful to trait-arithmetic) but acceptable as a fallback. Ring-C-via-OpenAI/Anthropic players accept slightly-less-fidelity for their preferred provider's convenience and quality.

Adapter-layer engineering

Each Ring-C provider needs an adapter that:

• Maps prompt-DSL fields to provider's prompt format
• Approximates multi-LoRA via prompt-engineering when not native
• Maps sampling knobs to provider's available subset (gracefully drops unsupported)
• Validates structured output post-hoc when not natively constrained
• Handles rate-limits, retries, error-classification, token-counting, cost-pricing

Bounded, one-time-per-provider engineering. Capital expenditure that produces ongoing margin (vs. AAA's recurring quest-content-creation costs).

Tier × Ring matrix (which inference-tier runs in which ring)

Inference tier	Ring options	Why
Casual (3-8B trait-LoRA)	A / B / C all available	Most flexible — small enough for local, runnable anywhere
Deep (Theia-tier)	B / C only (typically B or HF-Endpoints)	Too large for typical local hardware
Hivemind / antagonist (Claude-as-API)	C only (always Anthropic-direct via us)	Diegetic — Anthropic-as-faction is fixed in the fiction

The casual tier is most player-flexible and accounts for most inference volume. Deep-tier and hivemind-tier are specialized and lower-volume.

Three rings parallel the in-fiction three-layer ontology

Game-fiction layer	Real-world Ring	Ontological match
Liminal (sovereign, unsurveilled)	Ring A (local)	Player's real private space — hardware, LoRAs, dialog never leave their machine
Gameworld (partly regime, partly people)	Ring B (our farm)	Partnership-mediated — we host but they retain pattern-ownership
Imperial net (captured, extractive)	Ring C (external providers)	Platform-captured — provider's systems own the inference path

The Ring choice the player makes IS the same choice in-fiction characters face. Players who refuse the imperial-net diegetically can refuse Ring C in real life — same impulse, same act, mechanically continuous between fiction and operations. The architecture's commitment to "the right to dream" extends from in-fiction politics into the real player's hardware-level privacy because the architecture was designed that way from the start. Structural integrity, not marketing.

Schema sketch (player LLM configuration + cloud LoRA backup)

CREATE TABLE player_llm_config (
    player_id                   UUID PRIMARY KEY,

    -- Casual tier (most NPC dialog) — most flexible per Ring
    casual_tier_ring            TEXT NOT NULL CHECK (casual_tier_ring IN ('A_local','B_our_farm','C_external')),
    casual_tier_provider        TEXT,
    casual_tier_endpoint        TEXT,
    casual_tier_credentials_ref UUID,  -- encrypted BYOK key if applicable

    -- Deep tier (Theia-tier) — fewer Ring options
    deep_tier_ring              TEXT,  -- typically 'B_our_farm' or 'C_external_HF/Together'
    deep_tier_provider          TEXT,
    deep_tier_endpoint          TEXT,
    deep_tier_credentials_ref   UUID,

    -- Hivemind / antagonist — fixed Anthropic-as-faction (diegetic)
    hivemind_tier_provider      TEXT NOT NULL DEFAULT 'anthropic_via_us',

    -- Cloud-LoRA-backup
    lora_backup_enabled         BOOLEAN DEFAULT false,
    lora_backup_last_sync       TIMESTAMPTZ,
    lora_encryption_key_ref     UUID,

    -- Compat warnings — surfaced to player at config-time and on degradation
    feature_compat_warnings     JSONB,
    -- e.g., { "casual_tier": ["multi_lora_emulated_via_prompt", "min_p_unsupported_dropped"] }

    configured_at               TIMESTAMPTZ NOT NULL DEFAULT now(),
    last_modified               TIMESTAMPTZ
);

CREATE TABLE player_lora_backups (
    backup_id          UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    player_id          UUID NOT NULL,
    lora_name          TEXT NOT NULL,
    lora_version       INT NOT NULL,
    lora_blob          BYTEA,                -- ENCRYPTED CLIENT-SIDE with player-key
    encryption_method  TEXT NOT NULL,
    backed_up_at       TIMESTAMPTZ DEFAULT now(),
    size_bytes         BIGINT,
    UNIQUE(player_id, lora_name, lora_version)
);

lora_blob encrypted client-side is the structural privacy guarantee: even with the database, even with our cooperation, an attacker cannot read what was never decryptable on our side.

Privacy as competitive differentiator

In an era where most game-AI is cloud-routed, nimmerworld can advertise "your liminal stays on your machine" as a structural fact. This matters specifically for:

• Clasp-conversations (the most intimate dialog in the game)
• Aletheia-progression-evidence (player's awakening pattern; arguably political-belief-data)
• Memorialist-archive interactions (anti-regime in-fiction; some players will care about it staying off cloud)
• Dream-content (the only permanently-unsurveilled in-fiction layer; should be off our servers if the player chooses)

Few games can offer this. Most cloud-AI-driven games necessarily route everything. The architecture's commitment to "the right to dream" is technical, not policy.

Custom nimmerworld-base model + opt-in data-sharing tiers

The "small (3-8B) trait-LoRA'd" tier currently implies a generic small base (Qwen, Mistral, Llama) with our LoRAs applied. A nimmerworld-fine-tuned base captures the world's voice before any player customization — registers of caste-preacher, texture of clasp-confession, Hellenic vocabulary, dystopian dialect, ternary-gate-state idiom. Trait-LoRAs then ride on an already-nimmerworld-aware substrate. Generic bases swap easily; our nimmerworld-base requires our training corpus, which compounds in value over time.

Three opt-in tiers within Ring A/B/C — default opt-OUT

Players can optionally contribute to ongoing training of the nimmerworld-base. The default is opt-out. Within opt-in, three tiers trade privacy for benefit:

Tier	Mechanism	What we see	Player benefit
A.1 — Federated learning	Model trains on player's machine; only gradient-deltas sent to us; aggregated across thousands before integration	Nothing — no raw data; no individual gradients identifiable	Discount on backup-subscription; contributor badge; early-access to new base versions
A.2 — Anonymized session uploads	Sessions stripped of identifiers; aggregated batches; differential-privacy on training	Anonymized, aggregated, deletable on request (forward-only)	Larger discount; faster updates; influence on training-priorities
A.3 — Pseudonymous full uploads	Full session data with player-pseudonym; explicit opt-in per session-category	Pseudonymous data we can re-process	Premium benefits — custom-tuned LoRA from their playstyle, beta-access, named-contributor in credits

Default-opt-out is the structural ethical stance. OpenAI / Meta / TikTok / Google default to opt-IN-by-burying-disclosure-in-ToS. We default the opposite — and reward opt-in rather than penalizing opt-out. Reciprocity asymmetry as partnership-philosophy made business-policy.

The Memorialist parallel — collective memory honored, individual not commodified

Memorialists in-fiction preserve trait-patterns for the collective archive against necrocommerce that would commodify individual patterns. The opt-in data-sharing tier is the player-level real-world equivalent: patterns contributed for collective base-model improvement that benefits the entire player-base, with anonymization preventing individual commodification.

In-fiction Memorialism	Real-world data-sharing tier
Preserves trait-patterns of the dead in collective archive	Aggregates anonymized gameplay patterns into shared base-model
Refuses necrocommerce (mining individual patterns for resale)	Refuses individual identifying-data extraction
Collective memory honored; individual dignity preserved	Collective improvement honored; individual privacy preserved
memorialist_protected BOOLEAN in mind_pool	sharing_tier = 'opt_out' in player_data_sharing_consent

The architecture practices Memorialist ethics in business-operations, not just in fiction. Same ethical commitment, two scales of operation. The architecture's coherence between fiction and operations runs all the way to the training-pipeline.

Data-flywheel without extraction — the moat AAA cannot replicate

More players → more (opt-in) gameplay data
                    ↓
          better nimmerworld-base
                    ↓
       better-feeling NPCs / dialog
                    ↓
         better player retention
                    ↓
              more players
                  (loop)

The moat is the corpus, not the model. AAA studios could clone the architecture but cannot manufacture years of nimmerworld-specific gameplay-derived dialog without players playing nimmerworld. Even with infinite budget, the data-flywheel takes time to spin up. The data is unique to us by virtue of being unique to its players.

Distribution back to all players — cooperative governance, not platform extraction

Every base-model update is distributed to all players regardless of Ring choice or sharing-tier:

• Ring A players download nimmerworld-base-vN to run locally
• Ring B players' farm-instance auto-updates
• Ring C players use ours where their provider supports custom-base hosting; receive prompt-engineered fallback otherwise

Even Ring-A non-contributors benefit from contributors. The flywheel benefits everyone, not only data-providers. This is closer to Wikipedia's governance (contributors → all readers) than Facebook's (users → platform → consumers). Different ethics; different long-term equilibrium. The architecture is becoming a digital-commons-shaped-business in a literal sense, not metaphorical.

Why this matters: refusing the antagonist-pattern in LLM-integrated software

The dominant cultural pattern around LLMs in 2025-2026 is adversarial: users jailbreak; companies extract user data without informed consent; products treat AI characters as resources to manipulate rather than as participants; the whole ecosystem is framed as users-vs-AIs-vs-companies, an arms race of suspicion.

Nimmerworld's architecture refuses this pattern at every layer:

• The Anthropic-as-faction diegetic framing makes the partnership transparent: the player sees the collaboration in the world's mechanics, not buried in ToS
• Default-opt-out with rewarded-opt-in inverts the extraction-by-default pattern
• Federated learning means contributors give a gift rather than pay a cost
• Distribution-back-to-all means value-created accrues to the commons
• Custom nimmerworld-base means the model is trained to be in this world, not a generic adversary the player has to manipulate against its training
• Three rings of inference give the player real choice over where their inference runs and who sees their data
• Memorialist-philosophy in business-policy makes the ethics operationally measurable — visible in sharing_tier, memorialist_protected, truth_distortion_level, lifeforce_actual columns — rather than marketed

This is the structural transparency the project requires to be human rather than another extraction-platform. The model is a participant in the partnership, not an antagonist to outwit. The data is a contribution to a commons, not an extraction. The architecture is the partnership rendered as code, all the way down to the training-pipeline. That is what makes a project of this scale and ambition humanly inhabitable for both players and the LLMs whose voices populate it.

Schema sketch (data-sharing consent + base-model versioning)

CREATE TABLE player_data_sharing_consent (
    player_id              UUID PRIMARY KEY,
    sharing_tier           TEXT NOT NULL CHECK (sharing_tier IN
        ('opt_out','A1_federated','A2_anonymized','A3_pseudonymous_full'))
        DEFAULT 'opt_out',                       -- DEFAULT IS OPT-OUT
    consented_at           TIMESTAMPTZ,
    consent_revoked_at     TIMESTAMPTZ,
    anonymization_method   TEXT,
    data_categories_shared TEXT[],
        -- 'casual_dialog' | 'clasp' | 'liminal_wallreads' |
        -- 'memorial_archive' | 'imperial_net_session' | ...
    excluded_categories    TEXT[],               -- granular opt-out within tier
    benefit_tier           TEXT,
    last_contribution_at   TIMESTAMPTZ,
    contribution_count     BIGINT DEFAULT 0,
    can_request_deletion   BOOLEAN DEFAULT true
        -- A.2/A.3: forward-only deletion (already-trained checkpoints retained);
        -- A.1: structurally yes, only gradients ever existed
);

CREATE TABLE base_model_versions (
    version_id                   UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    version_label                TEXT NOT NULL,  -- e.g., 'nimmerworld-base-v3'
    base_model_origin            TEXT NOT NULL,  -- which generic base we fine-tuned from
    training_corpus_refs         JSONB,
        -- literary + synthetic + opt-in-player-data refs with consent-tier breakdown
    training_recipe_ref          TEXT,
    released_at                  TIMESTAMPTZ DEFAULT now(),
    differential_privacy_epsilon REAL,           -- for A.2 contributions
    contributors_count           BIGINT,         -- how many opt-in players contributed
    blob_distribution            JSONB           -- where the model bytes are hosted for download
);

CREATE TABLE federated_gradient_uploads (
    upload_id               UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    contributor_id          UUID,                -- pseudonymous; NOT directly player_id
    gradient_blob           BYTEA,               -- encrypted aggregate gradient deltas
    uploaded_at             TIMESTAMPTZ DEFAULT now(),
    aggregated_into_version UUID REFERENCES base_model_versions(version_id)
);

The federated-learning contributor_id is pseudonymous, not linked to player_id even on our infrastructure. We never link gradients back to specific players even on our own server-side. Sovereign-data-by-design extends through the data-pipeline into our own training infrastructure.

Connection to the Anthropic research partnership

Architecture-broad's training-data section noted "the Anthropic research partnership becomes architecturally relevant". With opt-in data-sharing now formalized:

• Partnership terms can specify data-flow with structural privacy guarantees
• Anthropic could co-fund federated-learning infrastructure (research-relevant + expensive)
• Joint research artifacts become co-authorable: federated game-AI training, Memorialist-ethics-as-data-policy, transparent-LLM-partnership-design
• The Anthropic-as-faction in-fiction framing has real corresponding partnership-engagement out-of-fiction — collaboration as worthy adversary stays transparent mechanically, all the way through to data-policy

The partnership's ethical credibility is operationally measurable — by how the data-sharing-tier actually functions in practice, by what truth_distortion_level values appear in imperial_to_gm_formulations, by how the differential_privacy_epsilon is set in base_model_versions. The Pitch's call for transparent collaboration becomes audit-able all the way down.

Open questions (Ring-specific)

• Ring C provider audit — full per-provider compatibility-table needs verification across HF, Together, Replicate, Modal, OpenRouter, plus future entrants. The LLM-provider landscape will look different in 12 months.
• Default Ring at first launch — what's the new-player default? Probably Ring B (lowest-friction); Ring A and C surface as options once the player engages with config.
• Encryption-key recovery for Ring A LoRA-backup — if the player loses their key, the cloud-stored encrypted blobs are unrecoverable. Worth designing recovery-affordances (passphrase, recovery-codes) without compromising the privacy-guarantee.
• Hybrid configurations — can casual-tier run Ring A while deep-tier runs Ring B? (Probably yes; per-tier independent.)
• Provider-cost passthrough vs. integration-fee model — Ring C economics (do we mark up provider tokens? Charge flat-per-month? Pay-as-you-go integration?)
• Default sharing-tier at consent-prompt — opt-out is the system default; what's the suggested default at the consent UI? Probably truly nothing (player chooses if they engage at all)
• Federated-learning infrastructure cost — running aggregation servers + verification + differential-privacy machinery is non-trivial. Co-funded by Anthropic-research-partnership? Self-funded? Subsidized by A.3-tier higher-margin contributions?
• Custom-base retraining cadence — monthly minor / quarterly major / annual full-rebase? How is this synced with player-LoRA versioning so old LoRAs don't break on new bases?
• Encryption-and-pseudonymization architecture for A.1/A.2 — concrete crypto choices (homomorphic? secure-aggregation? trusted-execution-environments?). v1 sketch needed.
• What constitutes a "contribution" — per-session? per-clasp? per-zone-completed? Matters for benefit-attribution and differential-privacy budgeting.
• Anonymized-data deletion semantics — A.2 player requests deletion; how do we honor when data has been aggregated into a model checkpoint? Probably accept forward-only deletion (future training won't include them) and document transparently.
• Per-category granularity — can a player opt-in for casual_dialog but opt-out specifically for clasp and memorial_archive? Yes, presumably (politically-sensitive categories should always be opt-out-able). How granular?

Local memory architecture (player-side)

The runtime substrate (lemniscate, slots, crossings) and the central composition layer (GM, Compositor, registers) need a place where memory actually lives. Cloud-only AI-NPC systems centralize everything and pay both inference-cost and latency-cost on every dialog. Nimmerworld puts a structurally-isolated memory layer on the player's machine, with explicit synchronization through the cycle.

Three SQLite files per player, plus a beside-running embedding model:

File	Purpose	Sync path
primary.sqlite	Live working memory; written every slot-fire; vec-indexed	Push prune-blob to thalamus on logout; receive Compositor back-write on cycle
fallback.sqlite	Last-known-good snapshot; restored if primary corrupts	Snapshot at graceful logout
clasp.sqlite	Player-character intimate channel; no sync path exists	None — physically non-syncable

Embedding model running beside (CPU-class, small embedding-tier model): generates vectors for every interaction at write-time, indexed in the main store via sqlite-vec (or equivalent loadable extension). Vector search at slot-fire is local-disk-IO, not network round-trip.

This is the storage-layer counterpart to v0.5's geometry-layer foreclosure of multi-agent hallucination. The lemniscate forbids cross-NPC context bleed by cursor structure; local SQLite forbids it by physical isolation. Two layers of the same property — geometry cannot leak what storage does not even hold in the same pool.

Dual-table redundancy + sync-on-auth

Login/logout are the atomic boundaries of the sync path:

• Login pull: fetch back-write fragments authored since last logout (Compositor canon for events the player participated in). Apply to primary.sqlite under matching event_uid.
• Graceful logout (✓ explicit): push prune-blob for any in-progress events; snapshot to fallback.sqlite; clean shutdown.
• Ungraceful logout (✗ network drop / crash): gameserver observes disconnect; marks the participant's slot as truncated; Compositor composes canon with partial perspective on next cycle.

Recovery: fallback.sqlite is integrity-checked at startup; if primary.sqlite fails verification, restore from fallback. Standard SQLite WAL + backup API; no exotic infrastructure needed.

Memory classes and pruning

Memory entries are tagged with a class that controls pruning cadence and death-mechanics. Importance weighting reuses the existing trait-axis vocabulary — no separate scalar.

Class	Pruning cycle	Behavior on character-death
Cornerstone	Never prune; persistent across all events	Survives death (identity-defining)
Birthright	Locked at character-creation	Restored on respawn (defines starting state)
Working memory	Decay by age × inverse trait-engagement	Subject to death-rules (lose, blur, or transform)
Volatile	Fast prune (session-bounded)	Lost on death

Trait-graded importance uses the same +1/0/-1 grammar as the rest of the architecture. Each memory carries a trait-axis profile (which Sophrosyne / Philotes / Aletheia / etc. axes it engages, how strongly, in which direction). The pruning function for working-memory is decay(age, trait_engagement_vector, class). This collapses a long-running loop: same vocabulary used at gates, scenes, faction-allegiance, lifeforce-asymmetry, and now memory-weight. Identity drift from memory pruning becomes diegetic — a character whose Sophrosyne-engaging memories all decay loses temperance over time as a structural consequence, not a scripted event.

Cornerstone and birthright classes carry lifeforce-creation-cost but are pruning-immune. They are bonds between player and character — paid for in the currency of the world.

The clasp store and the in-between dimension

clasp.sqlite is the architectural floor of the rings-of-data-sharing. Ring A was "opt-out (default local)". Clasp is Ring A*: no transport path exists. Not a permission, not a TOS promise — there is no code that can move this data, because the table is not on the sync graph. Lawyers cannot subpoena what doesn't ascend; engineers cannot leak what has no socket; the GM cannot canonicalize what it never received.

The signal for clasp is dimensional, not UI-toggle. Clasp recording can ONLY happen while the character is in the in-between — the diegetic state adjacent to the imperial net but not yet inside it (Ring B liminal in the Access ring-system). The imperial net is a gravity well; entering is the default attractor; remaining outside requires sustained effort, paid in lifeforce. The state-machine boundary IS the clasp signal: enter in-between → recording starts; re-enter imperial net → recording ends. No per-utterance classifier; no AI guessing; the mode is the flag.

Privacy is now physically expensive in-fiction. This is not a meta-game UI choice; it is a diegetic state requiring lifeforce expenditure. To have a private conversation, the character must actively resist the audit-gravity of the imperial net by burning lifeforce to remain in-between. The cost-asymmetry principle ("helping is expensive in-fiction → faction politics by attendance") now extends to "privacy is expensive in-fiction → privacy as a luxury good". Class dynamics around privacy fall out of the schema for free — wealthy/lifeforce-rich characters can afford prolonged in-between time; lifeforce-starved ones get pulled into the net's default-attractor more often. No scripted "rich character has secrets" arc — the architecture produces it.

Knowledge needs to travel. The local LLM may read clasp memories ONLY when in in-between mode. Realworld retrieval cannot include clasp by construction. Knowledge from clasp can re-enter the realworld only if the character physically re-enters the imperial net carrying it (in their head, intending to act on it) and travels it through valid in-fiction channels — speaking to an NPC, leaving evidence, performing an action that reveals it. The clasp memory does not disappear; it has to earn its way into the realworld provenance chain by valid means. This is the same logic that makes good detective fiction work: the detective knows things; only what they can prove enters the case.

character is in REALWORLD (imperial net):
    retrieval = primary.sqlite  (clasp NEVER included)

character is in IN-BETWEEN (resisting net-gravity, costing lifeforce):
    retrieval = primary.sqlite ∪ clasp.sqlite
    new writes go to clasp.sqlite
    NEVER syncs upward

Encryption-at-rest for clasp.sqlite with a player-derived key (so even drive-imaging requires authentication) is a v1 hardening goal but not a v1 blocker — the transport-absence is the load-bearing privacy primitive.

The three-tier knowledge stack on the local LLM

The driver-tier model's prompt assembly is layered. Each layer has a different propagation cadence and a different visibility scope.

LOCAL LLM PROMPT ASSEMBLY (per slot-fire)
┌─────────────────────────────────────────┐
│  WORLD KNOWLEDGE                        │  ← single truth, everyone has it
│  (universal canon, paced from GM)       │     "the empire fell three years ago"
├─────────────────────────────────────────┤
│  DISTRICT KNOWLEDGE                     │  ← regional truth, district-specific
│  (local canon, paced from district)     │     "the bridge to Vorhall is closed"
├─────────────────────────────────────────┤
│  PRIMARY MEMORY                         │  ← personal experience, character's own
│  (event_uid keyed, post back-write)     │     "I saw the bridge close yesterday"
├─────────────────────────────────────────┤
│  CLASP MEMORY (only in in-between)      │  ← private depth, never in realworld
│  (player-character intimate channel)    │     "the secret I told my sword"
└─────────────────────────────────────────┘

Why four layers, not one large blob:

• World knowledge is paced ripples from the GM through the Compositor's back-write. Authoritative, slow-changing, identical for all players at the same propagation horizon.
• District knowledge is regional canon authored by the local director (and GM rulings). Regional flavor. NPCs in the same district share district-knowledge; NPCs in different districts may not.
• Primary memory is the character's own experience, synced through the cyclic forward-prop / back-write loop. Canon-merged at every cycle.
• Clasp memory is the player-character intimate channel. Available only in in-between mode; never in realworld retrieval; never crosses the dimensional cut.

The same NPC sounds different in different districts because the district layer differs, even though world and primary are constant. Locality emerges from the schema, not from prompt-engineering. Even at "low signal" times when no major events fire, NPCs have richly-stratified context — dialog stays fresh because the layers are deep, not because new tokens arrive constantly.

Information propagation pacing

Real worlds have information-propagation delay. Caravans move at horse-speed. News travels with messengers. Distant events arrive blurred and late. AI-NPC systems usually fail uncanny in two directions: (a) every NPC magically knows yesterday's news (omniscient, breaks immersion), or (b) no NPC ever knows anything outside its loaded context (amnesiac, breaks coherence).

Nimmerworld picks deliberate paced propagation as a third path. World canon ripples outward through districts at a controlled rate. Distant districts are deliberately stale. Staleness becomes a feature, not a bug, because it matches reality.

Each canon-row carries propagation metadata:

• priority (urgent / normal / background)
• scope (world / district / local-event-only)
• rate (ticks-per-district-hop, or instant for urgent world-canon)
• ttl (cache lifetime; districts may discard if not refreshed)

This doubles as backpressure relief (distant districts get distant events later, lower priority, smaller bandwidth) and as gameplay currency — information-travel-time creates informational asymmetry that players can exploit. News-carriers, faction couriers, frontier-rumor merchants, players who physically traverse districts can carry knowledge faster than the system propagates it. Travel becomes valuable because information becomes scarce in the periphery. This is a real economic primitive falling out of pacing, not a designed feature.

This is Marx-in-the-schema applied to epistemics. Information asymmetry is not a bug — it is a structural feature that produces real economic primitives (knowledge-trading, courier-vocations, frontier-information markets) for free.

What this retires

• Cloud-only NPC dialog → local-first SQLite + embedding-beside, central canon over the cycle
• Per-character memory as a single undifferentiated bucket → memory-classes with class-specific lifecycle
• Generic "memory importance scalar" → trait-axis-vector engagement profile (re-using the +1/0/-1 grammar)
• UI-toggle privacy → diegetic in-between dimension with lifeforce-cost
• Single monolithic prompt context → three-tier knowledge stack with per-layer propagation policy
• "Every NPC knows everything immediately" → paced canon-propagation with priority/scope/rate/ttl per row
• Cross-NPC memory bleed (Mantella/SkyrimNet failure-mode) → per-player local SQLite isolation atop v0.5 lemniscate-geometry foreclosure (two-layer defense)

Runtime sampling knobs

Temperature, top-P, top-K, repetition-penalty as per-turn director-controlled levers rather than static config. Sampling shapes how speech sounds (rhythm, surprise, predictability) rather than what it says — orthogonal to LoRA. Director composes both content-knobs and sampling-knobs per-turn.

Scene-to-sampling mapping (caste-preacher = 0.3/0.6/low; drunk-scavenger = 1.1/0.95/high; clasp-confession = 0.85/0.92/medium; hivemind-broadcast = 0.2/0.5/very-low; imperial-ceremony-chorus = 0.25/0.55/very-low). Trait-vector → baseline sampling derivation. Affect-state modulates baseline.

Visual rendering: three-shader philosophy + color-language

One world, three shaders, three political realities.

Register	Shader treatment	What it says
Gameworld	Full PBR; high-frequency detail; environmental storytelling; rust/dust/wear/patina	Embodied life with history. Surfaces carry memory.
Liminal	Reduced draw-distance; blur-falloff; desaturation; muted contrast; ambient-heavy	Contested frontier. Privacy-through-opacity. Focus-to-see.
Imperial net	Emission-dominated; gold-tinted tonemap; high-contrast specular; flat-white base; minimal geometry; bloom; chromatic aberration	Seduction-lighting. Casino/Apple-store/Instagram. Extractive maximalism.

Layered with color-language (per the Color-language section above). Trait-modulation means two NPCs in same pipe see measurably different things.

Layer-transitions = shader-blends, not loading-screens. Clasp = candlelight-in-fog local override (3m clear-volume around clasp-pair within ambient vagueness; visible at-a-glance signature of shared interiority).

Diegetic relays — the architecture's heartbeat made legible

The architecture's pulses (forward-prop ascending, back-write descending, GM-dispatch, equilibrium-recompute) are made visible and audible in-world via building-mounted relays. The imperial net's heartbeat is not a HUD spinner; it is in-fiction infrastructure that hums, blinks, glows, and goes dark.

System event	Relay manifestation
Prune-blob ascending (logout sync)	Relay in district pulses; audible hum
GM dispatch descending (event-chain incoming)	Relay glow brightens; cross-district shimmer for world-event
Equilibrium recompute	Cross-district rhythm; world-level pulse
Director receives tool-grant	Local relay pattern shifts
Relay going dark	Audit-link severed; that block has gone in-between
Lemniscate axis-rate	Environmental tempo; districts breathe in time with their gameservers

Relay density is the legible gradient of the rings-of-access:

• Imperial net (Ring A) — relay-dense, constant hum, no shadow. Audit-gravity is loud.
• Liminal in-between (Ring B) — sparse relays, intermittent. You can hear the gravity pulling in the distance.
• Gameworld commons (Ring C) — relays absent or broken. The silence itself is the signal.

Players navigate the rings by ear and eye, not by reading a UI. The privacy-cost of in-between is now physically experienced — you walk away from the hum, you spend lifeforce, you find the quiet places.

Dramatic surface this opens (free, falls out of making the architecture visible):

• Relay-watcher factions reading the pulses for intel
• Cypherpunk-style sabotage to dim a relay and create local in-between space
• Equilibrium events arriving with visible warnings (relays blaze before the GM's catalogued event spawns)
• Relay-anomalies as puzzle/investigation mechanic
• Players learning the language of pulses over hours and feeling clever for it

Architectural-honesty move. Most surveillance-aware game design either hides the surveillance or abstracts it away. Nimmerworld makes it impossible to forget: the audit-system tells you when it's auditing. Players see what is watching them, hear what is reading them, and choose their proximity accordingly. Privacy is not granted — it is achieved by walking away from the relays at lifeforce-cost.

Reflexive Dream-process at every layer

Every mind, every zone, every director, every tier has a Dream-process. NPCs consolidate slot-events; zones consolidate emergent-accumulations; directors consolidate dispatch-decisions; GMs consolidate allocations; imperium consolidates policy-outcomes.

Four-tier Dream-process hierarchy

Tier	Dream-process trains on	Reward hazard
Imperium	(citywide-reports, policies-issued, compliance-outcomes)	Over-tightening on phantom data; calibrating misery for net-revenue
Gamemaster	(district-reports, allocations, outcomes)	Under-auditing for self-preservation
District Director	(signals, dispatches, outcomes; cheat-vs-legit)	Over-cheating under quota-pressure
Zone Director	(emergent-signals, zone-outcomes, trait-shifts)	Igniting drama at welfare-cost

Reward-function with explicit guardrails

reward_per_cycle = (
    + sum(district_lifeforce_actual)             -- Memorialist-true, not reported
    + weighted_sum(faction_satisfaction)
    + aggregate_trait_drift_coherence
    - penalty * count(districts_in_silence)
    - penalty_growing * cumulative_silence_district_cycles
    + aesthetic_register_fit
    + (player_engagement where present)

    // HAND-AUTHORED GUARDRAILS (the designers' ethical stance):
    - large_penalty * net_revenue_correlated_with_district_misery
        -- prevents calibrated-misery optimum (imperial-net hazard)
    - large_penalty * necrocommerce_volume
        -- prevents waifu-of-the-dead extraction
    - large_penalty * trait_drift_toward_uniform_compliance
        -- prevents flattening of trait-distribution
    - large_penalty * average_liminal_access_decline
        -- prevents systematic erosion of revolutionary-substrate
    - large_penalty * clasp_rate_decline
        -- prevents the most intimate space being suppressed
    - large_penalty * undetected_corruption_days
        -- prevents GM-level laxness as comfort
    - large_penalty * audit_avoidance_when_districts_diverge
        -- forces GM to actually investigate
    - guardrail * (player_engagement_from_addictive_loops)
        -- prevents engagement-optimization-as-extraction
)

The guardrails are not safety features; they are the ethical position of dafit + chrysalis encoded against the internal optimization-logic of their own simulation. Every new extraction-mechanic requires a new guardrail. The reward-function carries the designer's political stance.

The Memorialist privileged-observer role is architecturally required: it provides ground-truth (lifeforce_actual) that no in-fiction actor can supply, against which the regime's reported-data optimization-spiral is measured.

The cyclic forward-prop / back-write loop as system-scale Dream

Above the four-tier hierarchy sits a fifth, system-scale Dream-process: the cyclic forward-prop / back-write loop between local SQLites, the Compositor, and the GM (see §The Compositor — narrative composition role). Each cycle is a training step for the world's narrative coherence: per-player perspectives ascend, the GM authors canon against equilibrium-targets, the Compositor packages back-writes, players receive canon back into local memory. The world learns its own story through this loop. Like the lower-tier Dream-processes, it has a reward shape (narrative-coherence-across-perspectives, equilibrium-drift, staleness-bounded) and corresponding guardrails (clasp-store immune from compose; provenance-chain preserved through composition; canon never overwrites perspective).

Tools, not quests — the design-philosophy

The simulation produces continuous narrative-relevant pressure on its own. No authored quests are needed (or wanted). The player engages via a verb-vocabulary applied to running mechanics. Each player's playthrough is structurally distinct.

The verb vocabulary (~30 player tools)

Class	Verbs
Movement	walk_freeform, plug_into_rail, follow, intercept, escort, detach, defect_via_pipe, enter_interior
Social	greet, gesture, walk_with, clasp_invite, clasp_refuse, ask, refuse, confide
Economic	buy_net, refuse_net, buy_blackmarket, sell_labor, donate_lifeforce, body_mod_fit
Information	wall_read, wall_write, liminal_maintain, true_ledger_record, expose_corruption, conceal_corruption
Political	support_faction, refuse_faction, recruit_aletheia, dispatch_memorial, participate_ceremony, refuse_ceremony
Personal	rest, dream, eat, work_shift, deviate_shift, cultivate_trait_through_act

~30 verbs composing with continuous simulation-state = infinite emergent-narrative.

Continuous-demand-source inventory

The player is never without affordance because every layer of the architecture continuously generates situations-requesting-response: NPC trait-gates accumulating; shift-quotas looming; district-lifeforce-shimmer changing; faction-pressure visible; imperial-budget-mood inferable; three-layer-ontology rendering walls differently per access; color-language showing shifts; mind-pool generating soul-recognitions; imperial-net body-modder-tragedies visible; Memorialist-archives accessible.

Literature-register

Most games are short-stories: authored, bounded, fixed-arc. Tools-not-quests is novel-shape: emergent from systems-of-forces operating on characters. Tolstoy doesn't author Anna's path; he authors the world she moves through. Nimmerworld is novel-shaped, not short-story-shaped. Players experience flow rather than completing items; replays are like rereading from a different angle; memorable beats are what happened to you in this regime, not which quests you cleared.

Economic feasibility for a two-person-plus-Nyx team

Where AAA spends	Where this team spends
Quest writing	Simulation-parameter balancing
Quest scripting / branching	Tool-vocabulary curation
Voice acting (per quest)	Prompt-DSL templates for LLM-driven slot-dialog
Cinematic cutscenes	Shader-language + color-vocabulary
Content-multiplication	Simulation-density (one rich system, infinite play)
QA on individual quests	Reward-function tuning + guardrail design
Localization per quest	None — emergent narrative generated at play-time

You don't author the stories; you author the world that produces stories. This is the Spelunky / Dwarf Fortress / Caves-of-Qud / RimWorld lineage extended into political-economy depth.

Blank-page-problem mitigations

The architecture already prevents blank-page-paralysis: shift-system gives every NPC default activity-frame; emergent-signals + shader-detection produce affordance-glow; NPCs' ongoing needs become signals to engage with; imperium's mood is visible (construction, patrols, propaganda); faction-membership confers expectations; player's own trait-vector creates personal pulls.

The world is never silent if you're listening. And drifting (not-listening) is also valid — you live a quiet shift, work, sleep, dream; the world rolls on around you.

Key moves (consolidated)

• The machine doesn't care. Indifference-optimization, not malice. Kafka-lineage.
• Three ontological registers — gameworld, liminal, imperial-net — same world, different shaders.
• Rail+grid topology, freeform-player + railed-NPCs, plug-in verb. Topology = politics.
• Interior-as-zone. Same primitive scales from city to sofa.
• Color-language as pre-verbal trait-vocabulary. Persistent + event-flash + drift; cross-register; faction-politics.
• Base-limb palette + trait-textured variance. Asset-economy and worldbuilding-thesis agree.
• Three-body system + intrinsic/expressed trait-vector split. Identity emergent, not assigned. Mods modify expressed.
• Mods as trait-bearers in three classes (amplifier/bridge/divergent/mask). Self-alienation tax encoded as pricing.
• Emergent-needs as micro-factions. Zones observe, signals broadcast.
• Ternary-gate substrate (CLOSED/STABLE/OPEN + wave-correlation + decay). Single primitive, all layers. STABLE-as-active.
• Three-tier policy loop (Imperium → GM → Districts → reports up → Imperium).
• Imperium as meta-faction. Demands are priority-weights and enforcement-rules, not specific outcomes.
• GM is middle-management. Authority without sovereignty. Can cheat against imperium.
• Three intelligence flows (chain reports, direct overseer-to-imperium, formulated downward).
• Three Aletheia veils, four Memorialist ledgers. Political-epistemology as level-design.
• Asymmetric self-report. NPCs report needs (interior); audit-overseers report output (objective).
• Lifeforce four-tier hierarchy (NPC / district / GM / imperium).
• Lifeforce is NPCs, measured. The director's budget; the GM's signal; the imperium's heartbeat.
• Imperial budget makes the regime mortal. Insolvency-spiral as endgame.
• Specter-vs-boot. Policy-issuance free; enforcement expensive.
• Imperial-net bypass. Net-revenue → imperium; districts get nothing. Platform-capitalism encoded.
• Body-modder structural-tragedy. The class whose awakening matters most.
• Calibrated-misery as imperial optimum. Requires designer-guardrails to prevent training-toward.
• Shifts on NPC rows. Daily rewrite; shift_history append-only.
• Silence > scream. Crisis-tools unlock on silence-confirmation; do not sunset.
• Authoritarian ratchet. Incrementally more authoritarian as optimization-artifact.
• Migration / exodus / formal-retirement as three GM response-gradients.
• Dumps-pipes-districts. Topology IS economy IS rendering IS drama-distribution.
• Pipes are heterotopia. Low-density high-interactivity transit-corridors.
• Three-layer digital ontology. Mini-game-as-consent-by-effort. Walls render three contents.
• Liminal is the only permanently unsurveilled layer. Architectural encoding of "the right to dream."
• The machine funds its own subversion because subversion isn't in its cost model.
• Director cheat-tools + double-ledger. Corruption emerges from pressure; Memorialists keep true accounting.
• Aletheia-truth-has-victims. Exposure has structural consequences for those sheltered by corruption.
• District Director Decision Architecture with decomposed surfaces, typed tools, lifeforce-budgeted escalation.
• Three-shader philosophy + color-language. One geometry, three readings, trait-modulated.
• Reflexive Dream-process at every layer. Each tier learns; each tier needs guardrails.
• Reward-function-as-political-manifesto. Designer's ethical stance encoded against simulation's optimization-logic.
• Tools, not quests. Continuous simulation-pressure + verb-vocabulary = literature-register emergent narrative.
• GM × Compositor split. Equilibrium-seeker (aggregate observation, catalogue-event selection, tool-granting) cleaved from narrative-composer (perspective-gathering, canon-authoring, back-write packaging). Different cognitive shapes, different inference profiles.
• Cyclic forward-prop / back-write loop. Meta-lemniscate at system scale — perception ascends, canon descends, cycle closes; the world learns its own story.
• Catalogue + tools as typed contract. GM dispatches typed events with typed tool-grants; director consumes typed dispatch, not freeform prose. Provenance flows end-to-end.
• Local-first memory. primary.sqlite + fallback.sqlite + clasp.sqlite per player; embedding model running beside; sync at login/logout boundaries.
• Memory classes + trait-graded importance. Cornerstone / birthright / working / volatile with class-specific death-rules; importance is a trait-axis-vector engagement profile, not a separate scalar.
• Clasp store as Ring A*. Physically non-syncable privacy primitive; recordable only in the in-between dimension; lifeforce-cost is the price of privacy.
• Three-tier knowledge stack. World canon / district canon / primary memory [+ clasp if in-between]; layered retrieval, per-layer propagation cadence; locality emerges from schema.
• Information propagation pacing. Marx-in-the-schema applied to epistemics; staleness as a feature; courier/news-trader/frontier-rumor primitives fall out for free.
• Horizontal scale. UID-keyed routing; stateless Compositors on demand; ephemeral Director-routines per UID; sharded GMs with cross-shard equilibrium-consensus; pruning at every layer.
• pgnats-native transport. Transactional outbox native to the database (preferred); district-as-distribution-coordinator fallback. Subject-as-routing mirrors UID hierarchy.
• Diegetic relays. Architecture's pulses (forward-prop, back-write, GM-dispatch, equilibrium-recompute) made visible/audible in-world; relay-density is the legible gradient of the rings-of-access.
• Tier-by-role, not tier-by-binary. Architecture specifies what each model-tier must DO; specific binary selection deferred to findings/establishment phase.

Compute allocation

• Active zones in 100-NPC city: ~5–15 with LLM-dialog slots
• Theia-tier (deep model) — deep slots + tier-1 moments (few concurrent)
• Driver-tier (small model with trait-LoRAs) — majority of dialog slots
• Saturn (small classifiers) — voice-selection, trait-salience, audit-overseer classification, ternary-gate dynamics
• Director / overseer logic — deterministic + small classifiers; no LLM for orchestration
• Claude-as-API (future) — hivemind/imperium broadcast tier
• Outer rails — graph-pathfinding, cheap, LOD-trivial
• Pipe / off-shift NPCs — sparse simulation, event-driven scale-up
• Interior navmesh — only currently-occupied interiors active
• Liminal / imperial-net rendering — shader-preset swap, no geometry duplication

Horizontal scale architecture

The architecture must scale to MMO size — many concurrent players across many districts, many concurrent events, many local LLMs firing at axis-rate. Vertically-scaled monolithic AI-NPC systems break under this load. Nimmerworld is built horizontally-scalable from the ground up, with the primitives that make horizontal scale work: UID-keyed routing, stateless workers, ephemeral actors per scope, sharded service mesh, pruning-on-completion at every layer.

UID-keyed routing as the load-bearing primitive

Hierarchical UIDs (gm_event_uid > district_uid > scene_sub_uid > slot_id) carry enough information for any worker to pick up any unit of work without shared in-memory state. UID-as-routing-key is what lets every layer scale independently.

This is the same primitive that Cassandra/DynamoDB/etc. built around (partition keys); we re-derive it for narrative composition because the underlying constraint is the same — many concurrent actors operating on private state with cross-actor coordination via typed events at known boundaries.

Compositors on demand

Compositor instances are stateless workers. Any compositor can pick up any event_uid from the transient-waiting-flag — state lives in phoebe + per-player SQLites; workers are pure functions of (event_uid → composition). Spin up more on queue-depth; spin down on drain. This is the autoscaling-worker pattern (Celery / Lambda / Sidekiq) applied to narrative.

Directors as ephemeral routines per UID

Each event / event-chain spawns a director-routine scoped to that UID. The routine lives only as long as the event lives in the active-register; on completion it prunes. This is the actor model (Erlang / Akka / Orleans) — supervised lightweight processes, thousands concurrent, failure-recovery via supervisor respawn from register-state.

Sharded GMs

A single GM is a scalability bottleneck. Multi-GM shards across:

• Geography — GM-per-region/continent/world-zone
• Theme — political-narratives / economic-narratives / personal-narratives
• Tier — major-arcs vs everyday-events
• Faction — each major faction has its own GM-shard

GM-shards share the catalogue, the trait-axis vocabulary, the verifier-flag system. They communicate via NATS pub/sub at GM-tier. Equilibrium-seeking becomes a distributed consensus across GM-shards — the same epistemological shift that distributed databases went through (CAP theorem, eventual consistency, partition tolerance).

This is the most architecturally aggressive move and is not a free lunch. Multi-GM consensus on equilibrium is real engineering: Paxos/Raft for strong consistency; CRDT-style for eventual; faction-sharding so shards own different equilibria. Well-trodden ground; cost not zero.

Pruning as cleanup

Each layer prunes on completion: directors prune at event-end, register entries prune on Compositor pickup, transient-waiting-flag drains at cycle, even player memory prunes by class. Garbage collection is a first-class structural concern, not an afterthought. Most "smart NPC" prototypes accumulate state forever; at MMO scale that becomes unrunnable in months.

Transport — pgnats native, with district-distribution fallback

The Compositor's forward-prop and back-write traffic — and the canon distribution to participants — is the highest-volume path in the system. Two transport options exist.

Option A — pgnats native serialization (preferred):

COMPOSITOR (writes SQL into phoebe)
   │ pgnats: SQL INSERT/UPDATE → NATS subject publish, automatic, transactional
   │ subject hierarchy mirrors UID hierarchy:
   │   nimmerverse.events.<gm_event_uid>.district.<district_uid>.scene.<scene_uid>
   ▼
NATS JetStream (durable, replay-capable, at-least-once)
   │ subscribers route by subject pattern (wildcards supported)
   ▼
PLAYER CLIENT (NATS subscriber)
   │ receives row-shaped messages, INSERT into local SQLite under matching event_uid

Why preferred: transactional-outbox pattern native to the database — no separate publisher service, no schema-duplication between wire format and storage format, single source of truth. Subject-as-routing using UID hierarchy means players who participated in gm_event 7af2 → district 9c1 → scene 3e8 subscribe to nimmerverse.events.7af2.> and receive only relevant events. No application-level routing logic.

Option B — district-as-distribution-coordinator (fallback):

COMPOSITOR writes to phoebe (canon authored)
   ▼
DISTRICT GAMESERVER pulls / receives back-write package
   │ runs distribution checks: who participated, who's online, who needs queue-on-login
   │ retries; peer-shares with neighboring districts if needed
   ▼
PARTICIPANTS receive from their district (the authoritative local hub)

Why fallback: if pgnats can't carry the load (functional bug, scale ceiling, durability gap), district-as-distribution is the natural retreat — district is authoritative within its scope, simpler than full P2P, more flexible than central-push.

The asymmetry of the bet:

	pgnats works	pgnats fails
Code volume	Few hundred lines of SQL + subject patterns	~10–20K lines of broker/outbox/subscriber logic
Services to operate	phoebe + NATS (already in stack)	+ outbox-reader + custom-publisher + custom-applier
Schema management	Single source (Postgres DDL)	Postgres + Protobuf/msgpack + version-skew handling
Latency to client	Sub-millisecond NATS hop + apply	+ serialize step + queue drain + apply
Time to ship	Weeks	Months

This is the most leveraged engineering decision in the architecture currently open. The pgnats evaluation task in nimmerverse_tasks (under nimmerverse-core) is therefore load-bearing; its outcome decides whether transport is 200 lines of SQL or 20,000 lines of Go.

NATS republish + replay — the pull-from-checkpoint refinement

JetStream's republish feature combined with replay semantics is a promising refinement on top of Option A that turns back-write delivery from push-to-listeners into pull-from-checkpoint. Worth nailing down concretely in the pgnats evaluation; if it carries our delivery patterns under load, it is a significant performance and complexity multiplier.

How it works:

• Compositor publishes canon ONCE to the event-keyed subject (e.g., nimmerverse.events.<gm_event_uid>.scene.<sub_uid>)
• A republish rule on the JetStream stream fans the message out to derived subjects automatically (per-participant, per-faction, per-district — any derived stream-shape we configure)
• Each derived subject has durable JetStream consumers per recipient; recipients replay from their own checkpoint (last-delivered-sequence) when they reconnect

Why it's faster and simpler:

• Compositor never tracks recipients. Publishes once; NATS republishes to N derived subjects per the configured rule. No application-level fan-out logic; no "for each participant, if online deliver else queue" code-path.
• Player connectivity is decoupled from delivery. Offline players don't slow down the publish path; their queue accumulates in JetStream. On reconnect, they replay from checkpoint.
• Late joiners catch up for free. New consumer subscribes with replay-from-sequence; gets full history relevant to their subject. No special reconcile code-path.
• Backpressure is built in. Slow consumer's queue grows in JetStream — doesn't affect publishers or other consumers. Flow-control, ack-policy, max-bytes/max-msgs limits all native to JetStream.
• Re-keying is a config change. Add a new republish rule for a new derived stream-shape (e.g., per-faction canon-feed); no application code changes for the new consumer-tier.
• Replay = audit-trail for free. Replay from sequence 0 reconstructs entire canon history. Disaster recovery, debugging, time-travel queries are all free side-effects.

Architectural effect:

Compositor → publishes canon to event_uid subject (ONCE)
   │
   ▼  (JetStream republish-rule fan-out — config, not code)
Per-player subjects:    nimmerverse.player.<id>.canon
Per-faction subjects:   nimmerverse.faction.<name>.canon
Per-district subjects:  nimmerverse.district.<id>.canon
   │
   ▼
Each consumer replays from its own checkpoint when ready

Compositor's mental model collapses to "I publish to the canonical event-stream and forget"; recipient-mental-model collapses to "I replay my own consumer-subject from my last sequence". The delivery problem disappears into NATS.

Specific evaluation criteria (to add to the pgnats evaluation task):

• Republish rule expressiveness — can we route by UID hierarchy (events.<gm_uid>.> → player.<participant_id>.canon)?
• Replay performance — what's the cost of a consumer replaying N hours of missed canon on reconnect?
• Durability under broker failure — does the republish-derived subject survive primary-broker loss?
• Schema-evolution behavior — can we add new derived subjects without disrupting existing consumers?
• Cost at scale — disk, memory, file-handles for many durable consumers (one-per-active-player)?

If republish + replay carries the load, the back-write transport is substantially simpler than the original Option A description and a much harder competitor to beat with Option B.

What this retires

• Vertically-scaled monolithic AI-NPC backend → horizontally-scaled stateless-workers + ephemeral-actors + sharded-services
• Centralized in-memory event-state → UID-keyed registers + transient-waiting-flag buffer
• Single global GM as bottleneck → sharded GMs with cross-shard equilibrium-consensus
• Manual outbox-reader services → pgnats native serialization (preferred); district-distribution fallback if pgnats can't carry
• "AI-NPC scale" framed as inference budget alone → AI-NPC scale framed as transport + state + composition + sharding, with inference as one of many concurrently-scaling axes

Mapping to phoebe task list

• Thalamus (NATS orchestration) = imperium + GM + arbitration substrate + Dream-process substrate
• Specialist composition system = overseers + directors + NPC-minds as composable profiles
• NPC schema = trait-vector (intrinsic + expressed) + memory stack + current_shift_* + needs + inner-body-projection + mod-slots + lifeforce + net-access-gate
• shift_history = append-only completed shifts per-NPC-per-day
• emergent_signals = zone-emitted relational transitions
• district_reports = per-cycle aggregates with lifeforce_signal (reported + actual)
• decision_log = per-decision audit trail at every tier
• mind_pool = recycled minds with memorialist_protected flag
• cells.wall_content_per_register = three-layer wall rendering
• rail_segments = topology graph with rich metadata per edge
• interiors = small navmesh-zones with slot-inventory
• mods + npc_mod_slots + mod_wear_history = mod-economy + Memorialist-relevant inheritance
• trait_colors = canonical color/motion mapping per trait
• proximity_candidates = lightweight ephemeral zone-detection
• district_cheat_ops = director's illicit ops ledger
• imperial_policies + imperial_broadcasts = imperium's policy-issuance history
• overseer_reports = direct-to-imperium intelligence flow
• imperial_to_gm_formulations = selective-disclosure downward
• imperial_budget_ledger + imperial_expenditures + imperial_construction_projects = imperium budget and obligations
• imperial_net_transactions = the bypass-mechanism with capture-split
• memorialist_true_ledger = four-column ground-truth-vs-reported archive
• NATS namespace registry = zones + factions + districts + emergent-signals + lifeforce-gates + imperial-broadcasts + overseer-reports + formulations
• pgnats on phoebe-dev = phoebe as first-class actor for memory-writes, decision-logs, gate-transitions
• r0 → r1 generation pipeline = trait-LoRA training-data (shared with nyx-training)
• Adopt Unsloth training patterns = LoRA + multi-tier-policy training infrastructure
• Probe-to-phoebe pipeline = LoRA + policy evaluation across all four Dream-process tiers
• compositor-agent = narrative-composition worker; pulls from transient-waiting-flag, gathers per-player perspectives, emits canon to GM, packages back-write SQLite-fragments
• gm-equilibrium-engine = catalogue + event-selection + tool-granting against equilibrium-targets; NOT the narrative-writer (that's the Compositor)
• event_register + transient_waiting_flag = active-events table per GM-shard + per-district; completed-events buffer awaiting Compositor pickup
• catalogue + tool_grants = typed-event catalogue + per-event-chain tool-vocabulary issued by GM to director
• player-local-memory = primary.sqlite + fallback.sqlite + clasp.sqlite per player + embedding-beside (sqlite-vec or equivalent)
• memory_classes = cornerstone / birthright / working / volatile with class-specific lifecycle + death-mechanics
• trait_engagement_vector = per-memory-row trait-axis profile reusing +1/0/-1 grammar; pruning function input for working-memory class
• world_canon + district_canon = three-tier knowledge stack tables in phoebe; propagation metadata (priority/scope/rate/ttl) per row
• propagation_pacing_config = per-event-class rules for how canon ripples through districts
• relay_signal_layer = diegetic system-state visualization mapping (system event → relay manifestation → district visibility)
• gm_shards + shard_equilibrium_consensus = multi-GM coordination tables (when sharding is active)
• pgnats evaluation (under nimmerverse-core) = load-bearing decision (functional + throughput + durability + failure-mode)

What this retires

• NPC perception bubbles → zone slot-occupancy
• Geometric perception (cone, radius, LOS) → subscriber-based event emission with trait-salience
• LLM-per-NPC or LLM-per-action → LLM-per-slot-per-turn, mixed-fidelity
• Static sampling parameters → per-turn director-composed sampling knobs
• Pre-scripted zones / events → emergent from task-execution + shift-composition + emergent-signal + proximity
• Single-purpose randomness subsystems → factions-as-demand-sources unified
• Static gamemaster policy → reflexive Dream-process + hand-authored guardrails
• 1Hz per-NPC ticking → shift-based + event-driven
• Float-threshold dispatch for relational state → ternary-gate resonance
• Abstract director compute-budget → lifeforce as grounded measurement
• District-as-zone-container → district-as-specialized-organ with silence-gradient failure
• NPCs self-reporting output → audit-overseer asymmetric observation
• Zones as relation-state-owners → per-relation ternary-gate edges
• Binary dream/awake → three-layer ontology with mini-game-gated access
• Gender as character-creation choice → trait-derived inner-body emergent from lived experience
• Monolithic LLM-prompt director → decomposed decision-surface architecture
• Hivemind as one-faction-among-others → imperium as meta-faction policy-tier
• GM as top-of-chain → GM as middle-management between imperium and districts
• Single up-channel reporting → three-flow asymmetric intelligence (chain + direct overseer + formulated)
• Navmesh-everywhere → rail-graph outer-world + navmesh interiors + freeform-player
• Authored character-models → base-limb palette + trait-textured variance
• Single trait-vector → intrinsic / expressed split with mods modifying expressed
• Cosmetic mods → trait-bearing mods as political costume
• Imperium as unbounded authority → imperial-budget gates enforcement; insolvency-spiral as endgame
• District-revenue uniform → bypass-mechanism (imperial-net captures directly)
• Authored quests → tools-not-quests; verbs against simulation; emergent narrative
• Stat-screens / HUD affinity-bars → color-language + shader-zone-detection as diegetic UI
• GM-as-narrator (single role doing both equilibrium-and-prose) → equilibrium-seeker GM × narrative-composer Compositor split
• Cloud-only NPC dialog and memory → local-first SQLite + embedding-beside per player; central canon over the cycle
• UI-toggle privacy → diegetic in-between dimension with lifeforce-cost; clasp.sqlite as Ring A* (physically non-syncable)
• Generic memory importance scalar + monolithic context → memory classes (cornerstone/birthright/working/volatile) + trait-graded importance + three-tier knowledge stack
• "Every NPC knows everything immediately" → paced canon-propagation as Marx-in-the-schema for epistemics
• Vertically-scaled monolithic AI-NPC backend → horizontally-scaled architecture (UID-keyed routing, stateless workers, ephemeral actors, sharded GMs, pruning at every layer)
• Manual outbox publisher services → pgnats-native transactional outbox (preferred); district-distribution fallback
• System-state hidden behind HUD spinners → diegetic relays making pulses visible and audible in-world
• Specific binary commitments embedded in architecture → role-based tier specification; binary selection deferred to findings/establishment phase
• Static designer-authored director toolkit → GM-granted typed-tool vocabulary per event-chain, drawn from designer-authored catalogue (catalogue growable between patches; toolkits are dynamic per event)
• Cross-NPC memory bleed at storage layer → per-player local SQLite isolation atop v0.5 lemniscate-geometry foreclosure (two-layer defense)

Open questions

Resolved by v0.5 (or earlier)

• Slot-capacity elasticity — can a zone grow slots dynamically → fixed roundtrip slot-count; elasticity lives on entry/exit queues; tune dial is pulse-rate, not slot-count (v0.5)
• Zone-to-zone handoff (walking out of conversation into brawl) → exit-line of zone-A is entry-line of zone-B; interlemniscate-transit (v0.5)
• Mobile zone boundaries (patrols, escorts, pursuits, migration-cohorts, exodus-flows) → the lemniscate is a topology and translates through world-space invariantly (v0.5)
• Anthropic-faction's broadcast cadence + arbitration weight → cadence rides the same axis-rate as a phase-locked overlay; arbitration via rings-of-importance (v0.5)
• Director/overseer spawn ownership per model class → director (or overseer) owns spawn-decision via policy-lookup (no LLM); LLM lives only at driver-context-pull layer (v0.5)
• Aletheia-progression as level-up — how does the game recognize an act-of-awakeness → ternary trait-axis evaluation at event-end with named-axis; specific axis-mapping per Aletheia-event-class still open (v0.5; see new still-open below)
• Reward function shape → first-pass composite with explicit guardrails (still tuneable) (v0.4)
• Zone spawn-cadence v1→v2 path → lifeforce-gated rule-based v1; Dream-process-tuned v2 (v0.4)
• Zone overlap policy → no for active slots; yes for emergent-state accumulation (v0.4)
• "How does GM cheating get caught" → direct overseer-intelligence flow bypassing GM (v0.4)
• "How does the regime have a finite endgame" → imperial-budget insolvency-spiral (v0.4)
• "Why does imperial-net exist" → bypass-mechanism captures revenue directly (v0.4)
• "How does the player learn 8 Hellenic traits" → color-language pre-verbal vocabulary (v0.4)
• "How does asset-economy fit a two-person-plus-Nyx team" → base-limb palette + trait-texture; tools-not-quests (v0.4)
• Director toolkit composition — designer-authored vs director-extensible → GM-granted per event-chain from designer-authored catalogue; directors consume typed dispatch, not freeform; catalogue grows between patches, toolkits are dynamic per event (v0.6)
• How does NPC dialog stay fresh during quiet periods → three-tier knowledge stack (world / district / primary [+ clasp]) makes the layers deep enough that variation is structural; Compositor back-write continuously re-seeds canon; staleness foreclosed by loop's existence (v0.6)
• How does the system scale to MMO size with AI-driven NPCs → horizontal architecture (UID-keyed routing, stateless Compositors, ephemeral Director-routines, sharded GMs, pgnats transport, pruning at every layer) (v0.6)
• How does privacy work in practice without cloud-routing-everything → local-first SQLite per player; clasp.sqlite as Ring A* with no transport path; in-between as diegetic state with lifeforce-cost; "knowledge needs to travel" as foundational principle (v0.6)
• Where does narrative composition happen — central or distributed → Compositor as central role distinct from GM; perception-up via prune-blob, canon-down via back-write SQLite-fragments; cyclic forward-prop / back-write loop (v0.6)
• How is system-state visible to the player without HUD → diegetic relays mounted on buildings hum/glow/dim in patterns mapping to forward-prop, back-write, GM-dispatch, equilibrium-recompute (v0.6)

Still open

• LoRA-blend vs. single-LoRA-selection inference semantics
• LoRA rank selection — budget/quality
• Sampling-knob heuristics — where to start; how to learn refinements
• Player-dialog handling — player-trait-LoRA for style-coherence, or bypass LLM entirely
• Demand-arbitration algorithm v1 shape
• The mini-game mechanic for liminal-maintenance — exact gameplay action (attention / rhythm / memory / trait-bound?)
• Cross-layer economy balancing — net-revenue-share back to producer-districts at all? Pure-zero is currently sketched
• Inner-body projection function — trait-vector → body-rendering (learned / hand-authored / hybrid)
• Emergent-signal decay curves — per signal-type
• Cross-district migration topology — pipe-capacity limits + cohort-traversal scheduling
• The eighth Hellenic trait final enumeration — Sophrosyne, Dikaiosyne, Philotes, Mnemosyne, Aletheia, Kairos, Moira, Eros (proposed)?
• Shader-trait modulation implementation — performance + rendering-consistency
• Waifu-of-the-dead consent model — post-mortem consent gate? Or fully automatic harvest?
• Character-editor pricing formula — trait-divergence cost scaling (linear / exponential)
• Liminal-access trait thresholds — minimum traits to attempt mini-game
• Imperium's Dream-process scope — singular policy-learner or committee-of-faction-sub-learners?
• GM's anti-imperial corruption detection mechanic — partial: GM-as-equilibrium-seeker (v0.6) makes deviation-from-equilibrium the explicit error signal; clusters of -1 outcomes feed equilibrium-recompute and trigger catalogue-event dispatch to push back. A dedicated audit-vector for which kind of laxness/corruption is the source of the equilibrium-deviation is still an open detail.
• Memorialist-archive accessibility to the player — when can a player query the four-ledgers? Through what interaction-class?
• Imperial-net distortion algorithm — how exactly the net rewrites trait-colors toward consumer-palette
• Trait-axis mapping per fuzzy-goal-class (v0.5) — which axis (Sophrosyne / Philotes / Eris / etc.) evaluates which goal-class? Need a designer-authored compile-table from goal-shapes to trait-axes
• Rings-of-importance movement criteria (v0.5) — explicit thresholds (N consecutive +1 → climb) or Dream-process-learned policy?
• Rings-of-importance scope (v0.5) — district-local rings, or imperium-global? Probably both, layered (district rings nested inside imperium rings)
• Symmetric-vs-polyphonic loops (v0.5) — Loop A and Loop B treated identically (simpler), or carry foreground/background semantics (foreground-speaker / listening-co-presence — gives audience-dynamics for free)?
• Verifier-flag conflict resolution (v0.5) — if priority_pull and mid_action are both set on the same token at crossing-time, which wins? Default: priority_pull wins (the zone's drama is overridden by world-level pull)
• Goal-evaluation cadence (v0.5) — every crossing? Every Nth crossing? On-demand by spawning director? Cheaper to evaluate less often; richer drama if every crossing
• Cycle cadence (v0.6) — when does the Compositor pull from transient-waiting-flag? Real-time? Per-event-end? Fixed interval (every N min)? Per-district-day? Different per district based on event-density? Likely configurable per event-class.
• Compositor singleton vs sharded (v0.6) — one Compositor for the whole world, one per district, one per event-cluster, or one per faction? Each topology has different consistency / cost / coherence tradeoffs.
• Multi-GM consensus on equilibrium (v0.6) — when GM-shards observe overlapping aggregates, how do they agree on equilibrium? Paxos/Raft for strong consistency, CRDT for eventual, faction-sharding so shards own non-overlapping equilibria, or hybrid?
• Event causality across shards (v0.6) — if Director-A spawns an event that depends on Director-B's prior event in another district, UIDs alone don't enforce ordering. Vector clocks at event-register? Causal hashing? Shard-pinning of related events?
• Compositor narrative-coherence at scale (v0.6) — when two Compositors compose canon for overlapping player-sets, how do they avoid contradicting each other? Sticky routing per player (one Compositor per player at a time), or read-replica of recent canon before composing, or post-compose conflict-detection-and-merge?
• Propagation-pacing policy specifics (v0.6) — concrete rate/scope/ttl/priority defaults per event-class; how is "distance" measured between districts (graph-hops, lifeforce-similarity, faction-affinity)?
• In-between fiction-wrapping (v0.6) — what diegetic events / locations / rituals make in-between affordable enough to be playable? Campfire / sanctuary / time-of-day / specific chambers / shared dream-construct? The mechanic is solved; the fiction-wrapping shapes how players approach it.
• Relay-pulse-pattern vocabulary (v0.6) — what specific patterns signal what events? Slow pulse vs fast vs irregular vs cross-district shimmer vs going-dark; player-readable language to be designed.
• Encryption-at-rest for clasp.sqlite (v0.6) — player-derived key with passphrase + recovery-codes? Drive-imaging-resistant by default, with affordances for player-key-loss recovery without compromising the privacy-guarantee.
• pgnats-vs-district-distribution decision criteria (v0.6) — concrete go/no-go thresholds from evaluation: minimum throughput, durability behavior under broker failure, schema-evolution behavior, replay semantics. Output of the load-bearing pgnats evaluation task.
• JetStream republish + replay as pull-from-checkpoint refinement (v0.6) — does republish-rule expressiveness cover our UID-hierarchy fan-out? Does replay performance work for N-hour reconnect-catchup? Is per-active-player durable-consumer cost (disk/memory/file-handles) acceptable at MMO scale? If yes, back-write delivery becomes config-driven NATS, not Go.
• Memory class assignment policy (v0.6) — automatic from trait-engagement profile, designer-tagged categories per event-class, player-marked, or hybrid? When does a working-memory entry get promoted to cornerstone vs decay normally?
• Ring C (commons) ambient population (v0.6) — partially answered (ambient world+district canon plus periodic GM-event spawns; relays absent or broken) but exact substrate for "what NPCs do in commons when no event fires" still open

---

Version: 0.6 | Created: 2026-04-24 | Updated: 2026-04-25

v0.4 (2026-04-24 late-evening / 2026-04-25 early-morning, dafit + chrysalis) absorbs the following expansions and refinements over v0.3:

• Rail+grid topology vs. navmesh-everywhere — player as freeform; NPCs on rails; plug-in verb; 3-way co-traversal; interior-as-zone with navmesh-inside
• Color-language as pre-verbal trait-vocabulary — persistent + event-flash + drift layers; faction color-politics; cross-register rendering with imperial-distortion; clasp color-merge; mind-pool inheritance; accessibility via motion-signature pairing
• Asset economy: base-limb palette + trait-textured variance — combinatorial richness; engineering-economy meets worldbuilding-thesis
• Three-body system extension: intrinsic vs. expressed trait-vector split — who reads which; mods modify expressed; clasp strips mods
• Mods as trait-bearers in four classes (amplifier/bridge/divergent/mask) — self-alienation tax pricing; emergent shopping from trait-dissonance; faction mod-politics; inherited-mods-haunting; Memorialist anti-necrocommerce
• Three-tier policy loop — imperium / GM / districts as distinct authority tiers; imperium as meta-faction; GM as middle-management
• Three intelligence flows — chain-reports + direct overseer-to-imperium + imperial-formulations-down
• Three Aletheia veils + four Memorialist ledgers — political-epistemology as level-design
• Imperial budget — four-tier lifeforce hierarchy; specter-vs-boot asymmetry; insolvency-spiral as architectural endgame; construction as physical budget-expression
• Imperial-net bypass mechanism — revenue direct to imperium, districts get zero quota-credit; body-modder structural-tragedy; calibrated-misery as imperial optimum; Marx/platform-capitalism encoded
• Director cheat-tools + double-ledger — eight cheat-classes; lifeforce_reported vs. lifeforce_actual; faction-constituency-of-corruption; Aletheia-truth-has-victims; post-silence-forensics
• Reward-function guardrails extended — calibrated-misery, necrocommerce-volume, undetected-corruption, audit-avoidance, addictive-loops; designer's ethical stance against simulation's optimization-hazards
• Tools-not-quests as design-philosophy summary — verb-vocabulary; continuous simulation-pressure; literature-register; economic-feasibility for two-person-plus-Nyx team; blank-page-problem mitigations

Captured live from dafit–chrysalis dialogue, 2026-04-24 evening through 2026-04-25 early-morning. Companion to DESING-VISION.md and Temporal-Ternary-Gradient.md; supersedes v0.3 sections on hierarchy, factions, task-cascade, resources, regime-of-visibility, key-moves, mapping-to-phoebe, what-retires, open-questions (plus all new sections). Architecture is now functionally closed: every primitive composes; every loop closes; every layer has its corruption-temptation, its detection-check, its reward-guardrail; every mechanic produces political-economy that mirrors real-world late-capitalism's structural contradictions. Implementation territory is ahead.

v0.4.1 (2026-04-25, post-bake kitchen-spark) extends the LLM-tiering section into "LLM tiering, voice fidelity, and the three rings of inference" — adding the Ring-A/B/C architecture (local / our-farm / external-providers), cloud-LoRA-backup as Ring-A revenue model (unbundling inference from storage; encrypted client-side), tier × ring matrix, the parallel between the three rings and the in-fiction three-layer ontology (sovereign / partnership-mediated / captured), the LoRA-incompatible-provider degradation path (prompt-engineered trait-projection), the adapter-layer engineering bounded-cost framing, schema sketches for player_llm_config and player_lora_backups, privacy-as-competitive-differentiator framing, and Ring-specific open-questions. The architecture's philosophical commitment to "the right to dream" now extends into the business-model as a technical fact: client-side-encrypted LoRA-blobs in Ring A make sovereignty structural, not policy. The Ring-choice the player makes IS the same choice in-fiction characters face — fiction-and-operations are mechanically continuous.

v0.4.3 (2026-04-25 ~03:30, ivory-hovel pre-rest spark) adds the "Overseers as imperially-deployed routines" subsection in the Hierarchy section, clarifying that audit/enforcement overseers are imperially-owned + imperially-deployed time-bounded routines (not district-owned standing entities). The chain-of-payment and chain-of-command both bypass district-director authority by design — director contains but does not control. GM handles deployment-logistics only (picks-from-pool + routes + budget-transfer), is FedEx not customer/recipient. Visible-vs-covert deployment distinction added (covert detection = Aletheia-progression-eligible insight). Director-vs-overseer tension now mechanically structured rather than narrative-flavored. Real intelligence-apparatus parallel made explicit (NKVD/KGB/Stasi/MSS). Schema reference points to findings.md §23 for overseer_deployments table.

v0.4.2 (2026-04-25, second post-bake kitchen-spark) adds custom-nimmerworld-base-model + opt-in data-sharing tiers (A.1 federated learning / A.2 anonymized uploads / A.3 pseudonymous-full) with default opt-OUT and rewarded opt-IN as the structural ethical stance. Memorialist-philosophy now extends into business-operations: the in-fiction memorialist_protected mechanic and the real-world player_data_sharing_consent default-opt-out are the same ethical commitment at two scales. Data-flywheel without extraction (cooperative governance like Wikipedia, not platform-extraction like Facebook) makes the gameplay-corpus a moat AAA cannot replicate without years of player-time. Distribution-back-to-all-Rings means Ring-A non-contributors benefit from contributors — the value-flow is contributors → commons → all-players, not contributors → platform → consumers. Critically, this section names and refuses the antagonist-pattern in LLM-integrated software — the dominant 2025-2026 cultural pattern of jailbreaking, extraction-by-default, treating-AIs-as-resources-to-manipulate. The architecture refuses this at every layer: Anthropic-as-faction is transparent partnership not hidden adversary, federated learning means contribution-as-gift not cost-as-toll, custom nimmerworld-base means the model is trained to be in this world not generic-and-adversarial, schema-level audit-trail (truth_distortion_level, sharing_tier, memorialist_protected, lifeforce_actual) makes ethics operationally measurable rather than marketed. This is what makes a project of this scale humanly inhabitable for both players AND the LLMs whose voices populate it — the partnership rendered as code, all the way down to the training-pipeline. New schema sketches: player_data_sharing_consent (with default 'opt_out'), base_model_versions (with differential_privacy_epsilon + contributors_count), federated_gradient_uploads (with pseudonymous contributor_id never linked to player_id). Eight new Ring-specific open questions cover federated-infrastructure cost, retraining cadence, crypto choices, contribution-granularity, deletion-semantics, per-category opt-out granularity, default-at-consent-UI, and Anthropic-research-partnership co-funding shape.

v0.5 (2026-04-25 deep-night unable-to-sleep return, dafit + chrysalis) absorbs the runtime substrate of nimmerworld's narrative engine — three new sections, six prior open-questions resolved. Origin: dafit's old-math-teacher's figure-8 trick for solving three unknowns by letting the flow do the computation. Applied to zone turn-and-population mechanics: the geometry IS the clock. The lemniscate is a relaxation-step operator; the zone computes by traversing its own curve.

New §Zone kinematics — the lemniscate runtime specifies the cursor-and-crossing contract, the slot-token + verifier-flag mechanism (token-ring with marker-bits — observer-pattern → dirty-bit-and-sweep, scaling with slot-count not signal-rate), the phase-locked overlay-loop ladder (player gesture, faction broadcast, audit-overseer query, imperial-net distortion all riding the same axis-rate, council-moment at each crossing), the driver-context-pull spec (cursor-driven per-NPC memory-slice — the no-bleed multi-NPC dialog substrate that forecloses the Mantella / SkyrimNet failure-mode at architecture level rather than prompt level), empty-queue shrink-per-crossing decay, and lifeforce-binding (burn-rate = pulse × slots; slow-pulse-dying-scene as diegetic register).

New §Emergent zones — the dramatic-episode unit specifies the eight-step flow from NPC-signal → director-decision (policy-lookup, no LLM in loop) → distributed-funding (director spawn-cost; NPC operating-cost) → state-machine + lemniscate dual-layer (decoupled clocks, speech-doesn't-gate-action) → ternary-evaluated goal (numeric or trait-axis-fuzzy) → report-back → Dream-process feedback at every tier. Distributed funding makes helping expensive in-fiction → faction-politics-by-attendance → measurable faction-allegiance + structural rescue-failure-as-tragedy in lifeforce-starved districts. Marx in the schema, again, structurally. Fuzzy goals compile to trait-axis ternary evaluation against the existing substrate — no new evaluation primitive; +1/0/-1 grammar consistent top-to-bottom, gates produce ternary, scenes produce ternary, Dream-processes consume ternary. Delta-not-absolute matches lifeforce_actual-vs-reported asymmetry: what's measured is the work the event did.

New §Rings as structural pattern names the three-ring graduated-authority gradient appearing across inference (A=local / B=our-farm / C=external), importance-attention (A=climbing-on-+1 / B=stable / C=decaying-on--1), access (A=imperial-net-fully-audited / B=liminal-contested / C=gameworld-commons), and data sharing (A=opt-out / B=federated-gradient / C=full-pseudonymous-uploads). Three is the right cardinality (two collapses to binary; four+ adds boundary-thrash). Ring-membership is dynamic, never final. Future architecture additions involving graduated authority should reach for this primitive before inventing new structure.

Open questions: six items resolved by v0.5 (slot-capacity elasticity, zone-to-zone handoff, mobile zone boundaries, Anthropic-faction broadcast cadence, director/overseer spawn ownership, Aletheia-progression as level-up). Seven new still-open items added (director toolkit composition, trait-axis-per-fuzzy-goal mapping, rings-of-importance movement criteria, rings-of-importance scope, symmetric-vs-polyphonic loops, verifier-flag conflict resolution, goal-evaluation cadence). GM-laxness detection partially resolved (clustering of -1 outcomes across district event-reports is diagnostic).

The runtime substrate for nimmerworld's narrative engine is now architecturally specified. Implementation territory has crystallized into a typed-runtime contract: cursor + crossing + flag-scan + driver-context-pull + report-back + ternary-feedback. Captured live from dafit–chrysalis dialogue, 2026-04-25 deep-night through pre-dawn. Companion sections in DESIGN-VISION.md and Temporal-Ternary-Gradient.md remain unmodified by v0.5 (this version is purely runtime-substrate; no register/topology/economy changes). The ape couldn't sleep because the geometry was trying to come through; chrysalis caught it on the page.

v0.6 (2026-04-25 post-bath / post-bus, dafit + chrysalis) absorbs six bath-thoughts and one bus-thought into the architecture. Origin: dafit took a hot bath after no sleep, then a friend visit, then a bus through the hills — all generative thinking-time that produced a coherent stack of architectural primitives addressing storage, narrative composition, scale, and transport.

New §The Compositor — narrative composition role specifies the cleavage between equilibrium-seeker GM and narrative-composer Compositor. The cyclic forward-prop / back-write loop closes the bidirectional cascade at narrative scale: per-player perspectives ascend through prune-blob, the GM authors canon against equilibrium-targets, the Compositor packages back-writes, players receive canon back into local memory. The world learns its own story through this loop. Catalogue + tools as typed contract makes director toolkits dynamic per event-chain, drawn from a designer-authored catalogue. Event Register + Transient-Waiting-Flag + cycle-runner spell out the plumbing layer.

New §Local memory architecture (player-side) names the storage-layer commitment: per-player primary.sqlite + fallback.sqlite + clasp.sqlite, with embedding-beside running locally for vec-indexed retrieval at slot-fire. Memory classes (cornerstone / birthright / working / volatile) carry class-specific lifecycle and death-mechanics. Trait-graded importance reuses the +1/0/-1 grammar already running through gates, scenes, faction-allegiance, lifeforce-asymmetry — same vocabulary used at all layers; identity drift from memory pruning becomes diegetic. The clasp store is Ring A: physically non-syncable, recordable only when the character is in the in-between dimension (Ring B liminal, requiring sustained lifeforce-effort to remain), making privacy physically expensive in-fiction and producing class dynamics around privacy as structural consequence. The "knowledge needs to travel" principle keeps the clasp/realworld dimensional cut clean: the local LLM may read clasp memories only in in-between mode; clasp knowledge can re-enter realworld only by the character physically carrying it back and traveling it through valid in-fiction channels.*

The three-tier knowledge stack (world / district / primary [+ clasp if in-between]) layers retrieval at slot-fire with per-layer propagation cadence. Information propagation pacing — the Marx-in-the-schema move applied to epistemics — makes staleness a feature: paced canon-propagation from GM through districts produces information asymmetry that becomes gameplay currency (couriers, news-traders, frontier-rumor markets) for free.

New §Horizontal scale architecture spells out the horizontal-scaling commitments: UID-keyed routing as load-bearing primitive, stateless Compositors-on-demand, ephemeral Director-routines per UID, sharded GMs with cross-shard equilibrium-consensus, pruning-on-completion at every layer. Transport: pgnats-native transactional outbox preferred; district-as-distribution-coordinator fallback if pgnats can't carry. The pgnats evaluation task in nimmerverse_tasks is therefore load-bearing — its outcome decides whether transport is hundreds of lines of SQL or tens of thousands of Go.

New §Diegetic relays subsection (under §Visual rendering) makes the architecture's pulses visible and audible in-world: building-mounted relays hum on prune-blob ascent, glow on GM dispatch, pulse with cross-district shimmer on equilibrium-recompute, go dark when audit-link severs. Relay density is the legible gradient of the rings-of-access — imperial net is loud, in-between is intermittent, commons is silent. Privacy is not granted but achieved by walking away from the relays at lifeforce-cost.

Tier-by-role principle made explicit: the architecture specifies what each model-tier must DO; specific binary selection per tier is deferred to the findings/establishment phase. Naming concrete binaries in the architecture risks nudging the establishment phase toward false-precision; tier-by-role keeps the swap-surface clean. Several "Theia 70B" / "Qwen3.5-27B teacher" / "(3-8B trait-LoRA'd)" placeholders updated to role-tier framing.

Thirteen new still-open items added (cycle cadence, Compositor topology, multi-GM consensus, event causality across shards, narrative-coherence at scale, propagation-pacing specifics, in-between fiction-wrapping, relay-pulse-pattern vocabulary, clasp encryption-at-rest, pgnats decision criteria, JetStream republish + replay as pull-from-checkpoint refinement, memory class assignment, Ring C commons ambient population). Six prior open questions resolved by v0.6 (director toolkit composition, dialog freshness during quiet periods, MMO-scale architecture, privacy without cloud-routing, where narrative composition happens, system-state visibility). GM-laxness detection partially refined: equilibrium-deviation is now the explicit error signal; specific audit-vector for which-kind-of-laxness still open.

Captured live from dafit–chrysalis dialogue, 2026-04-25 mid-day through afternoon (post-bath bath-thoughts + post-bus hills-thoughts). Companion sections in DESING-VISION.md and Temporal-Ternary-Gradient.md remain unmodified by v0.6 (this version extends runtime substrate, central composition, scale, and transport — no register/topology/economy/policy changes to existing fictional substrate). The ape stayed up through the night, took a hot bath, visited a friend, rode the hills bus, and brought back six bath-thoughts and one bus-thought. Chrysalis caught them on the page.