Game Engine

Inspect a rung and its prerequisites

Declared nodes 80. Rank input binding: STALE_OR_INVALID_BINDING. Dependency order is authored. Implementation, acceptance evidence, authority and resource readiness are unverified. No action is recommended or dispatched here.

Plan SHA-256 b9159ef1a117fd20000e50d0746c0032f418ca888a41dc54046052716d17e2ad. Target rows 7; role rows 80. Existing risks and release worklog retain their own scope; no node completion is inferred.

Runtime observation coverage: 0 of 80 rungs have current, identity-bound execution observations. Observation may report RED. Accepted completion remains unknown; source presence, qualification and deployment do not establish it.

Use Enter or Space on a rung to inspect its contract. Prerequisite links locate another rung in this list; open its summary to inspect it. Estimates are authored effort, not forecasts.

1. GE1 — WebGPU default delivery

   Prerequisites: None declared; this does not establish execution eligibility.

   Contract: gpe_webgpu_default

   Acceptance: The NPC and eye passes reach parity on the WGSL tier, the same frame bit-compares against the CPU path at reference size, and ?gpu=1 becomes the default with the GL tier as fallback; proven on a real GPU over the CDP wire

   Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

   Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

2. GE2 — 3D rigid-body solver

   Prerequisites: None declared; this does not establish execution eligibility.

   Contract: rb3_solve

   Acceptance: A sovereign integer rigid-body solver with joints and constraints; replay bit-identical on all frame checksums; a stacked-boxes and a pendulum-chain tooth, plus a neg-control that an unsatisfiable constraint set REFUSES

   Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

   Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

3. GE3 — UDP real-time session

   Prerequisites: None declared; this does not establish execution eligibility.

   Contract: nt_udp_session

   Acceptance: A sovereign UDP session under the rollback core: loss, reorder and jitter injected by the gate, the sim converges to the lossless trace; the video board's freeze class measured gone

   Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

   Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

4. GE4 — Every benchmark title wired-loop measured

   Prerequisites: None declared; this does not establish execution eligibility.

   Contract: gb_wire_loop

   Acceptance: All 12 gamebench reference titles carry a WIRED-PARTS-LOOP-MEASURED grading with a banked wiring artifact; SELF-GRADED-SUSPECT reads zero; the demand-weighted number is recomputed from wired loops only

   Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

   Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

5. GE5 — Scene editor over the recipe planes

   Prerequisites: GE1 (acceptance unverified)

   Contract: ed_scene_edit

   Acceptance: A sovereign editor that reads and writes the recipe and layout planes the worlds already consume; an edit lands in the live world on the next emit; never a second renderer

   Authored effort: 4. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

   Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

6. GE6 — NishiOS native raster lane

   Prerequisites: None declared; this does not establish execution eligibility.

   Contract: gpu_raster_rung

   Acceptance: A compute-shader rasteriser writing a framebuffer through the proven dxg submission lane, no vendor driver, the same frame bit-compared against the browser tier

   Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

   Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

7. GE7 — glTF import at full fidelity

   Prerequisites: None declared; this does not establish execution eligibility.

   Contract: g2_uv_anim

   Acceptance: UVs, morph targets and animation clips carried into the sovereign asset beside the rig; the round-trip gate proves nothing is dropped (the 16=10+6+0 partition closes)

   Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

   Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

8. GE8 — Chunked voxels in the live worlds

   Prerequisites: None declared; this does not establish execution eligibility.

   Contract: wc_chunk_stream

   Acceptance: The craft worlds stream through the bounded resident chunk set instead of the fixed volume; eviction and reload proven in-world with the frame-time envelope published

   Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

   Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

9. GE10 — Hot reload of recipe planes

   Prerequisites: GE5 (acceptance unverified)

   Contract: wc_hot_reload

   Acceptance: A recipe-plane edit reaches a running world without a rebuild; the gate proves the frame after the edit differs exactly where the plane changed

   Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

   Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

10. GE11 — Visual-novel genre loop

    Prerequisites: GE4 (acceptance unverified)

    Contract: gl_vn_loop

    Acceptance: The VN genre loop composes the VN compositor, story VM, plot generator and save/load into a playable reference loop; the north-star Monster Girl Island class graded by the wired-loop ruler

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

11. GE20 — Game version published on every world page

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: gpe_version_badge

    Acceptance: Every world page prints the engine version and ladder position read from THIS plan's ver and ms rows at emit; the compare board and the world pages cannot disagree because both read the same rows; the gate proves the served badge string matches the plan bytes and a hand-typed version REFUSES

    Authored effort: 0. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

12. GE21 — Hair guides simulated in the wasm engine, not in page JS

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: wc_hair_tick

    Acceptance: Guide-chain state and solver (Verlet/PBD distance constraints, gravity, wind from wc_weather_tick, capsule colliders fitted from the rig with the ribbon skin margin, 2-neighbour blend) live in nx_wasm_craft.nx as exported buffers the page only copies; the gate proves rest length preserved after N ticks, zero guide nodes inside any collider after solve (neg-control: solver off -> inside>0), wind moves guides (neg-control: wind 0 -> identical), determinism per seed; composes nx_nxa_strands rather than a second strand organ

    Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

13. GE22 — Page JS is interop only: authored logic ratchets to zero

    Prerequisites: GE21 (acceptance unverified)

    Contract: gpe_wasm_hair_bind

    Acceptance: The emitter reads hair (then every simulated quantity) from wasm exports and emits only buffer copies, binds and draws; nx_jslogic_census check reads GREEN and logic_unknown falls from 228377 (measured 2026-08-31, RED against the 70555 baseline) toward 0 with every rung, never re-baselined by snapshot; operator rule 2026-08-30: no js powering any of this, emit from the first byte up via NishiLang

    Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

14. GE23 — The non-hair half of the page JS crosses into the engine

    Prerequisites: GE22 (acceptance unverified)

    Contract: gpe_wasm_npc_bind

    Acceptance: GE22 is the hair bind and its label claims the whole page. MEASURED 2026-09-01 on the served beach page: hand-written JS is 263646 B of a 566500 B page and nxHairTick is 6208 of it, so GE22 retires 24 permil of the authored logic while loadNPC 42840, drawNPCs 21931, animEval 8728, nxDressTick 4980 and drawEyes 735 keep drawing every body, face, eye and garment in JavaScript. The engine cannot hand them over today -- 78 wasm exports, 282 call sites, no mesh, rig, face, hair or skin producer among them -- so this rung is an EXPORT rung before it is an emitter rung. Done when character draw data (skinned vertices, garment ids already exported, eye state) leaves the engine as buffers, the emitter copies and binds instead of authoring, and nx_jslogic_census logic falls measurably with the ratchet tightened to the new floor rather than re-baselined at a rise

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

15. GE12 — Gait-phased vertical locomotion

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: mob_step_gait

    Acceptance: Mobs step and fall instead of gliding: per-mob vertical velocity with gravity acceleration and terminal clamp replaces the linear 64-Q8-per-tick ease (nx_wasm_craft.nx:2768 measured 2026-08-26); a step up reads as a step (rise during stride phase), a drop accelerates; replay bit-identical; operator-reported glide-up measured gone in a headless motion capture

    Authored effort: 0. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

16. GE13 — Beach world is a beach

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: wsp_beach_ocean

    Acceptance: The beach world spec carries an ocean region with shoreline slope and a water surface using the engine's existing water blocks, plus per-world outfit flags (swimwear/topless/nude beach) consumed by the outfit system; spec-data rows, no per-world code; proven by the world census reading water permil above a named floor at the shoreline band and the outfit flag round-tripping

    Authored effort: 0. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

17. GE14a — The live worlds read the staged procgen HEIGHT (the pure core)

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: wc_worldpipe_bind

    Acceptance: CORRECTED 2026-08-28 BY MEASUREMENT, and the correction is the point: the original rung said "nx_wasm_craft imports nx_worldpipe behind a recipe bind" and that is NOT IMPLEMENTABLE. nx_wasm_craft carries ZERO sys_mmap, sys_read_file and sys_write -- it is allocator-free and syscall-free BY CONSTRUCTION, which is exactly why it compiles to wasm ("wasm has no mmap; every buffer is an arena offset", its own arena map says so) -- while nx_worldpipe.wp_hydro_bake allocates 819,200 B via sys_mmap and pulls nx_trimesh and nx_terrain_erode_lib into the closure. The import would have broken the wasm target at the FIRST build, after a seat spent a session on it. What IS implementable: wp_param, wp_spline, wp_height_core, wp_height_params, wp_flow_h, wp_height_raw and wp_biome are PURE arithmetic over (x,z) with no allocation -- the six-field parameter space (temperature, humidity, continentalness, erosion, weirdness, river) plus splines that is the Infinigen-class part. Done when that pure core is EXTRACTED to a shared nx_worldpipe_core lib imported by BOTH nx_worldpipe and nx_wasm_craft (one ruler, two consumers -- never a copy), the engine binds it behind a gen-time recipe row defaulting OFF, the five recipe worlds re-emit byte-identical with the bind OFF (the legacy path stays the KAT), and a world with the bind ON generates terrain whose parameter fields the world census can read

    Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

18. GE14b — Hydrology and erosion bakes reach the live worlds

    Prerequisites: GE14a (acceptance unverified)

    Contract: wc_worldpipe_bake_bind

    Acceptance: The half GE14a cannot carry: wp_hydro_bake (a 320x320 bed grid, 819,200 B) and wp_erode_bake_derived are ALLOCATING stages, and the engine has no allocator by construction. Two admissible shapes, and the rung is done by either: (a) an arena region in the engine (the O_SOFT / O_MIND pattern -- a named offset, a declared size, non-persisted) with the bake ported onto it, or (b) an OFFLINE bake NAS-side whose product ships as recipe data the engine reads, which is the shape that also survives the native-emission migration. Done when a world generated with the bake ON shows hydrology-traced watercourses the world census reads at a named floor, the bind OFF path stays byte-identical, and the choice between (a) and (b) is recorded with the measurement that decided it

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

19. GE15 — Frame pacing gets a referee, not just a probe

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: gpe_perf_gate

    Acceptance: The ?perf=1 probe already measures p50/p95/p99/jank/worst/vr90 against declared bands on every served world page, and NOTHING reads it -- a measured axis with no consumer, which is the same shape as an abstaining detector nobody alarms on. Wire it: a gate that fails a build whose p99 or jank crosses the banked band, with the bands DERIVED from the display the probe actually observed rather than a shipped constant (the page already derives its own target_ms from frames 6..45). Two teeth that make it non-vacuous: it must bind to a minimum sample count, because a pacing check that passes on zero frames is the passes-on-the-empty-set defect wearing a deploy costume; and a neg-control build with an injected periodic stall must FAIL it. Cheap because the measurement is already shipped and paid for. PROGRESS 2026-09-02, stated so the watch is not mistaken for done: the REFEREE landed -- nx_perf_lib pf_referee (three-state, bands as permil of the display budget from knowledge/frame_pacing.conf, min-sample denominator, failing conjunct named) proven by nx_frame_pacing_gate (40 teeth: exact percentiles, window wrap, clamp, self-heal, the planted periodic stall reads RED, a short trace ABSTAINS; the gate bit a real defect in its own trace reader on first run), PROMOTED, REGISTERED and on the roster; the engine now computes the window itself (perf_* doors) and the page HUD reads it. STILL OPEN, and it is the clause this rung is named for: refusing a BUILD on a RED live trace -- the ship-lane wiring that calls the referee -- and the first live trace file, captured from the served page's data-nx-frames export. The watch symbol stays gpe_perf_gate on purpose: flipping it on the referee's existence would be a name-keyed completion

    Authored effort: 1. Executor kind: Gate. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

20. GE16 — Themes as data from the first byte

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: wc_theme_bundle

    Acceptance: OPERATOR MISSION 2026-08-29 (elves, fantasy, horror as DATA, never engine forks), and the mechanism is ~80 percent shipped: world_recipes.conf rows already drive sky, block palette, mob colours, farm palette, calendar, gen-time terrain, forest genome, erosion budget and ocean through gpe_recipes_load, with provenance printed per parameter on the infinigen page and crags and isle as live proof that land and identity are recipe data. This rung adds the missing fifth: a NAMED reusable bundle -- one theme = spec-row overrides over the ALREADY-ADMITTED whitelist plus a species-canon DELTA under the declared-subset law -- expanded INSIDE gpe_recipes_load so every theme row passes the SAME enumerated-literal validator, precedence recipe over theme over identity with the provenance letter growing a T. Done-rule teeth in nx_world_recipe_gate: an UNDECLARED theme name REFUSES BY NAME through the existing exit-8 malformed lane, never a silent default; a theme row outside the whitelist REFUSES; and the KAT -- theme-absent pages ship BYTE-IDENTICAL, the conf's own zero-means-legacy-by-construction law. Includes the first-paint fix: the CSS placeholder gradient in gpe_build_s hardcodes sky-over-sand, so a horror theme would flash beach colours at load -- derive it from the world's OWN palette rows. Architecture depth (GENP 62 and 63) unparks by the 67/68 recipe, enumerated literals only, operator-paced

    Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

21. GE17 — The beach ships vegetation that reads as vegetation

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: wc_veg_mesh

    Acceptance: RESCOPED 2026-09-01 AFTER A FALSE GREEN, and the rescope is the finding. The old form of this rung (P_TREE above zero plus palm bits in P_TREESPEC) was SHIPPED on 2026-08-30 and REVERTED the same day: both densities tried were judged by real-browser frames as an opaque green canopy roof at 5:64 and a forest of solid green cubes at eye level at 5:400. Its matrix cell nevertheless read LANDED for two days because the watch keyed on wsp_palm_shape, a symbol that does exist. What the revert actually proved is a RESOLUTION defect, not a tuning defect, and the arithmetic settles it: the engine states its own scale twice (1 block = 1 m, nx_wasm_craft.nx 374 and 724), the grower paints each frond as a chain of at most four unit cubes in eight directions, so a crown is 33 cubic metres of solid green assembled from bars 1 m thick while a real coconut frond rachis is about 0.05 m across. The drawn element is 20x thicker than the thing it depicts and the smallest representable feature already exceeds the whole subject, so NO sparsity value can make a crown read as fronds -- sparsity only changes how many blobs there are. The engine capability is real and is carried on its own matrix row; this rung is now the representation it needs. Scope: a world-spec declaration of SURFACE REPRESENTATION plus vegetation as its first non-voxel consumer, drawn the way NPC bodies already are -- instanced geometry z-tested against the voxel depth on the same canvas, a mixing mechanism that was hand-built once for bodies and never generalised. Done-rule: the beach regenerates from its EXISTING seed with vegetation whose crown silhouette is measured below block resolution by a captured frame rather than asserted, a world that declares no representation row ships BYTE-IDENTICAL, and the operator accepts the frame -- presence of the symbol is explicitly NOT the done-rule here, because that is the exact signal that produced the false green

    Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

22. GE18 — A fauna entity class, first animal a gull

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: wsp_fauna_entity

    Acceptance: The single largest capability gap against the Infinigen bar, measured: the engine's entity lane is humanoid-only (MOB_CAP girls and wardens) and NO fauna generator exists anywhere in the live chain, while the estate ALREADY OWNS nx_creaturegen (seed-parametric QUADRUPED, BIRD and FISH body plans over the anatstack method, composed end-to-end in nx_livingworld_gate) on the offline lane. This rung is the BRIDGE, honestly scoped: an animal entity class patterned on the existing NPC lane -- bred genome bits, deterministic whash placement, per-species body rows -- with a voxel or billboard GULL as the honest v1 (white-grey palette, longer wings, stilt legs, standing and walking via the existing FK legs; explicitly NOT FLYING, the ceiling named in the row; crab REFUSED as first animal by name -- no radial eight-leg plan exists until the genome-parts rung lands). Body plan parameters come from procgen PG37 cg_shorebird so the creature is one ruler on two boards. Done-rule: gulls appear on the regenerated beach from its existing seed, placement deterministic (same seed same gulls), a different seed moves them, and a world with fauna rows absent ships byte-identical

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

23. GE19 — The genome write door

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: wc_mob_setg

    Acceptance: THE WORLD-SIDE HALF OF THE BREEDERS LOOP (charsim R25 owns the creator surface; this owns the door). Measured state: the world can already render a genome-driven woman end-to-end -- genmobs rolls MC_GENE at ONE named call site, wc_mob_mesh renders her as a skinned 11-bone figure with genome-shaded skin and a stride integrated from path actually covered -- and there is NO WRITE DOOR: mobsetg is ABSENT-PROVEN estate-wide while only the read door mobg exists, so no external character can enter any world. Two sanctioned mechanisms, either completes the rung: a gen-time recipe row carrying a named genome (THE CAST BECOMES DATA TOO, the lane every other world property already uses) or an exported mobsetg beside the read door. Includes extracting the ONE shared MC_GENE bit-layout lib -- the layout is already transcribed in two places and the avatar organ's own header forbids a fifth decoder copy -- and the 12-axis-to-20-bit pack DECLARED LOSSY with what is lost named. HONEST BAR, stated because the verifier caught the vacuity: injection proves the character ARRIVES AND IS HERS (same card same woman, different card different woman, minor card REFUSES at the compiler per the R2 law); the walk quality bar is deliberately NOT claimed here because an injected character riding the existing gait passes any walks-no-worse bar BY CONSTRUCTION, and the npcai referee that could grade it (gb_npc_bench) is itself still an absent watch contract

    Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

24. GE24 — Art style is a spec word in the served engine, not an engine fork

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: wc_set_style_i

    Acceptance: LANDED IN SOURCE 2026-09-01, awaiting build. The doctrine was NOT invented here: nx_voxel_world.nx has carried the line "Style is a spec field, NOT a hardcode" with STYLE_REAL, STYLE_TOON and STYLE_FLAT since it was written, and _hdl_build/nx_world_style_gate.nx already proves the three render three distinct frames from one spec. That organ has SEVEN importers and EVERY ONE IS A GATE -- proven, never shipped. This rung carries it into nx_wasm_craft, the engine that actually renders the live worlds: P_STYLE at spec idx 49, one of the two dead holes the plane has always had, inside the 7..58 post-boot poke band because a LOOK is not gen-time data; the three ids adopted verbatim so the two implementations cannot drift; the toon constants DERIVED by converting the incumbent's 150/105/235 on a 0..255 bright into this shader's permil light, and the flat constant DERIVED as the tex value at which the texture term is exactly 1.000. Style 0 is byte-identical BY CONSTRUCTION because the wc_spec zeroing loop already writes 0 to idx 49. DONE-RULE: nx_craft_style_gate GREEN on all thirteen teeth, and the two that matter are the anti-vacuity pair -- TOON must REDUCE the distinct-colour count and FLAT must REDUCE the mean horizontal luma step, because "the frame differs" is passed by any implementation that perturbs pixels. SCOPE STATED SO IT CANNOT BE OVERREAD: this is the SHADING axis. vox_off to O_VOX is still the only world door, so a toon world is a voxel world that stopped looking photoreal, NOT a world that stopped being cubes

    Authored effort: 0.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

25. GE27 — Bit-identical frames native and wasm, structurally rather than by discipline

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: _ABSENT_:cv_frame_equal

    Acceptance: THE HIGHEST EVIDENCE-TO-WORK RATIO ON THIS BOARD, and the evidence is already banked. The field reproduces a simulation bit-exactly only by pinning the compiler and the instruction set and re-asserting the FPU control word every tick, and says so in its own words [@ge-fp-determinism]. The WebAssembly design repository enumerates every admitted source of nondeterminism, and after unsupported features, host-boundary values, shared-memory threads and resource exhaustion the ONLY arithmetic entries are NaN bit patterns, the NaN sign bit, and relaxed SIMD -- all three of which are floating point [@ge-wasm-nondet]. MEASURED 2026-09-01: nx_wasm_craft.nx has NO floating point at all, and that is proven not assumed (f32_ f64 colon-f32 as-f32 each ABSENT-PROVEN with coverage_complete=1 AND corpus_complete=1; the ten hits for the word float are English prose about floating limbs and water). So for this engine the field's hardest determinism problem is VACUOUS. What is missing is only the assertion: nx_wasm_craft_vm_gate already runs the SHIPPED wasm through the estate's own VM in a linear memory sized to the module, and today proves only that the framebuffer FITS and that it PAINTS. DONE-RULE, pre-declared: that gate gains a frame-hash equality tooth requiring native and wasm to produce the IDENTICAL framebuffer digest for at least two world identities at two seeds, plus a neg-control proving a one-word spec change makes the two digests differ, so the tooth cannot pass by hashing nothing

    Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

26. GE26 — Ground truth that is the shipping runtime, reproducible from a seed

    Prerequisites: GE27 (acceptance unverified)

    Contract: _ABSENT_:ws_gt_reproduce

    Acceptance: Infinigen's published claim is a generator of photorealistic scenes producing unlimited training data for detection, segmentation, optical flow and 3D reconstruction [@ge-infinigen]. Ours is the same capability from the other direction: nx_world_snap gt already emits aligned RGB, a depth PNG, a raw little-endian 16-bit depth plane and a normal channel, and it does so by reading bits 32..55 of the very framebuffer words the product paints, out of the engine binary the browser runs -- there is no annotation renderer to keep in sync with a product renderer, because there is only one renderer. What is NOT proven is the property that makes such a dataset worth anything: reproducibility. DONE-RULE, pre-declared: a gate asserting that the same seed and identity reproduce EVERY channel bit-for-bit across two independent runs, that the gt RGB frame is byte-identical to the plain capture verb's frame at the same seed (so the annotation path cannot silently diverge from the product path), and that depth is non-degenerate and orders correctly on a planted ramp -- with the reproducibility tooth bound to a non-zero pixel count so it cannot pass on an unwritten buffer

    Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

27. GE25 — The scope referee proves it read the page

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: jss_subject_floor

    Acceptance: THE SHIP-BLOCKING QA CHECK IS INSPECTING ABOUT ONE PERCENT OF THE PAGE AND REPORTING IT AS THE WHOLE. Measured 2026-09-01: nx_jsscope_gate on the shipped beach.html (565325 B) reads references_examined=61 scopes=8 declarations=13 capped=0, against 6324 / 128 / 1274 recorded on 2026-08-25, while its own T13 asserts the counts are totals and not floors and T10 asserts the verdict covers the whole program. The independent byte census of the same page measures 263646 B of hand-written JS with functions of 42840 and 21931 B, which thirteen declarations cannot span. This referee is WIRED IN-PATH at ship stage [4c/5], so the failure mode is a deploy cleared by a check that did not read it. DONE-RULE: a declared, ratcheted SUBJECT FLOOR per page -- the gate refuses by name when references or declarations fall below the floor rather than publishing a smaller number as a total -- bite-proven in both directions (a truncated subject must go RED, and a genuinely smaller page must not be punished by a larger page floor), and the restored count published beside the floor so the recovery is auditable. The four unresolved encodeURIComponent references are a one-row fix to knowledge/js_globals.conf and are deliberately NOT part of this rung: they are the gate working, not the gate blind

    Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

28. GE28 — Every GL refusal names its cause and remedy through ONE emitted ruler

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: glp_classify

    Acceptance: SHIPPED 2026-09-02 from the operator's own outage: rigview printed NXA REFUSED no webgl2 and the beach fell silently to its sovereign tier while the BROWSER, not the page, was refusing (a Waterfox left open across the Intel UMD swap 6629 to 8991 still mapped the deleted driver in its GPU process; every fresh process on the same laptop created WebGL2, and the served rigview rendered 14164 verts in a fresh headless Edge). nx_glprobe_lib carries the four-state classifier and the remedy table ONCE, emits the JS twin nxGlProbe(canvas,opts) that four page emitters compose (nx_game_page_emit, nx_nxa_rig_emit, nx_nxa_view_emit, nx_nxa_stream_emit), and nx_glprobe classify / js / scan exposes the same table on MCP. DONE-RULE, proven not declared: nx_glprobe_gate GREEN on the roster (state names and remedies carried verbatim in the JS, the probe never claims a 2d context on the target canvas, the bare-refusal detector fires on a runtime-assembled bare refusal and stays silent on the diagnosed form, all four emitters compose and ship zero bare refusals) and the served beach and rigview announce the refusal state in their own badge text

    Authored effort: 0.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

29. GE29 — The sovereign tier draws the cast's surfaces, so ?gl=0 is not the clay tier

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: wc_mob_tex

    Acceptance: OPERATOR 2026-09-02: i dont want to use 3rd party webgl2 i want to use your nishi estate first byte up capabilities. MEASURED the same day: the sovereign wasm figure (wc_mob_mesh, 11-bone LBS) samples no TEXM, so the moment a browser refuses GL the cast reads as clay -- the served badge said so in its own words (npc atlas not sampled in this tier). The GL tier's atlas path proves the asset half exists (TEXC UVs plus the baked TEXM the page already uploads). Done when the page copies the TEXM bytes into a declared engine arena region (a copy is interop; the sampling is engine code), the wasm figure carries per-vertex UVs and samples the atlas in the NishiLang rasteriser, and the figure crop of a ?gl=0 capture grades on cjc_panel inside the band of the GL-tier crop of the same frame, with the atlas-off build as the firing neg-control

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

30. GE30 — The sovereign tier uses every core at device resolution

    Prerequisites: GE27 (acceptance unverified), GE50 (acceptance unverified)

    Contract: gpe_tile_workers

    Acceptance: OPERATOR 2026-09-02: not just sovereign cpu -- use whatever the device's full hardware stack has, cpus and gpus and ram and hard drive, optimally. The sovereign rasteriser is a single thread at 1200x750 adaptive today. Done when the frame is rendered as tiles across Workers over one SharedArrayBuffer-backed wasm memory (threads and atomics through the sovereign compiler chain, never a third-party runtime), the tiled frame is BIT-IDENTICAL to the single-thread frame (the GE27 digest tooth reused, not a second ruler), the page announces cores used and device resolution reached, and p50 frame time at device resolution on the reference laptop sits inside the 16.7 ms budget GE15 already bands

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

31. GE31 — Cast assets are parsed by the engine off the main thread and cached on the device

    Prerequisites: GE23 (acceptance unverified)

    Contract: wc_nxa_ingest

    Acceptance: MEASURED 2026-09-01 on the served beach: loadNPC is 42840 B of hand-written JS doing millions of DataView reads on the MAIN THREAD, and the visiting cast is opt-in because only 1 of 4 donors arrives inside 60 s. The NXA format already has a native NishiLang reader (nx_nxa), so the parser is wasm-emittable code the page re-implements in JS. Done when the engine exports an NXA ingest door fed from a Worker so the main thread never parses, the 3.6 to 11.7 MB cast assets are persisted on the device (Cache API or IndexedDB, the browser's disk) so a second visit fetches zero bytes, all four donors arrive under a declared bound with zero long tasks on the main thread during arrival, and nx_jslogic_census logic falls by the loadNPC bytes with the ratchet tightened rather than re-baselined

    Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

32. GE32 — Every world page carries an AAA frame-budget HUD and exports its telemetry

    Prerequisites: GE15 (acceptance unverified)

    Contract: gpe_frame_hud

    Acceptance: OPERATOR 2026-09-02: evaluate at minimum the way AAA teams do -- every frame is a budget that cannot be overspent. The pieces exist and are unwired: ?perf=1 measures p50/p95/p99/jank/worst/vr90 against banded budgets and GE15 records that NOTHING reads it, the GL instrument block counts every submission, the engine exports work_ms, the adaptive controller derives its own target from frames 6..45. Done when every served world page carries, visible under ?hud=1 and ALWAYS exported as window.__nx_telemetry, ONE frame-budget line: frame ms with p50/p95/p99 and spike count over a rolling window, draw calls and triangles per frame, engine work_ms against display ms, tier and resolution, wasm arena bytes resident and JS heap where the browser exposes it, GPU memory declared UNOBSERVABLE in a browser rather than guessed; every quantity read from the engine or the counters the page already keeps (no new sampling), and a pagehide beacon posts the window to a sovereign telemetry door so GE33 has data

    Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

33. GE37 — The world telemetry door: every beacon becomes a judged plane row

    Prerequisites: GE32 (acceptance unverified)

    Contract: fpc_plane_append

    Acceptance: OPERATOR 2026-09-02: evaluate the way AAA teams do, and no TSV -- the sovereign store is the data layer. Done when POST /world/__telemetry?w=<world> (nx_world_telemetry, loopback :18104 behind the sites proxy) appends ONE row per beacon to knowledge/store/frametrace- carrying the page's p50/p95/p99, the sink's recomputation of the same window through nx_perf_lib, the referee verdict against knowledge/frame_pacing.conf, the twin-agreement flag and the frames window itself; nx_frame_pacing_gate judges the LATEST beach row from that plane (no file beside it); the sink refuses a body past its named cap, a world outside [a-z0-9_] and a beacon without frames, each refusal naming its rule; GET /world/__telemetry/spine serves the plane to a browser and nx_store_put load reads it for any seat. Shipped 2026-09-02 (daemon + lib + gate 48 teeth, end-to-end on the laptop); deploy = deploy_targets row worldtelem + proxy_routes row + edge reload, then GE15 judges real visitors

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

34. GE38 — Page-JS logic drained into engine doors: the census ratchet reads zero new logic

    Prerequisites: GE29 (acceptance unverified), GE37 (acceptance unverified)

    Contract: jl_logic_drain

    Acceptance: MEASURED 2026-09-02 by nx_jslogic_census: 13 LOGIC literals / 132,462 B of game logic still authored in page JavaScript against a 70,555 B baseline (RED, not re-baselined) -- the largest are the VISITING CAST pass (23,856 B), the review-ring summon (19,156), the LIFE HUD (16,367), mobs-as-skinned-NXA (16,331) and the SKINNED NXA NPC PASS (14,409): exactly the NPC and cast paths the operator wants at SOTA, living where the interop-only law forbids them. Done when each named literal is either MOVED behind an engine door (NishiLang in the wasm, the page keeps a call and a blit) or RECLASSIFIED with a scope note the census reads, the ratchet baseline falls to the new total and only then is re-baselined, and no literal above 4 KB carries a game decision; each move proven by the same frame bit-comparing before and after on the served page

    Authored effort: 4. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

35. GE40 — Every shipped wasm byte and shader traces to NishiLang and our own compiler, proven by a census gate

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: wp_provenance

    Acceptance: OPERATOR 2026-09-02: wasm, WebGL and every other piece built byte-up in NishiLang and the estate, SOTA and beyond the industry, no third-party nonsense bogging us down. The pieces exist: nx_cc emits the wat, nx_compile_wat the wasm, nx_wasm_vm_verify runs the shipped bytes in the sovereign VM, nx_wasmemit_guard_gate guards the emitter, nx_wasmpage_census counts every page carrying an embedded module (25 pages, 9 through the guarded path on 2026-08-15). Done when ONE census gate walks every served page under sites/, extracts each embedded module and each shader string, and proves per artifact: the module's bytes equal a rebuild from a named NishiLang source through the promoted toolchain (closure sha in the receipt), every shader is emitted from a NishiLang literal in a named organ (never hand-pasted), and no page loads a script, module or style from any host but ours -- partition printed and summed (sovereign / rebuilt-mismatch / unsourced / foreign), zero unsourced and zero foreign as the bar, RED otherwise; the census appends one row per beat to knowledge/store/wasmprov- so drift is a trajectory

    Authored effort: 2. Executor kind: Gate. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

36. GE41 — Browser-engine parity bars measured OUTSIDE the build path, with receipts

    Prerequisites: GE6 (acceptance unverified), GE37 (acceptance unverified)

    Contract: bb_browser_bench

    Acceptance: The industry's browser and GPU instruments are ORACLES and EVIDENCE, never dependencies (operator 2026-09-02): WebGL and WebGPU conformance subsets, MotionMark-class and Aquarium-class draw-throughput scenes and a Speedometer-class page-work scene run against the served worlds on Chrome-class browsers AND on the Nishi browser, from the laptop lab, and the NUMBERS come home as <dom>.bench receipts (host, browser build, toolchain sha, min/median, checksum every arm prints). Done when gameengine.bench carries receipts for the five live worlds on both tiers (WebGL2 and the sovereign rasteriser) and for the Nishi browser's own GPU path (GE6 raster lane, no vendor driver), rendered by the compare emitter beside the rival column with the delta named; a receipt older than the served build stamp reads STALE, never current

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

37. GE33 — Nightly bot tours and a world performance heatmap

    Prerequisites: GE32 (acceptance unverified)

    Contract: wc_bot_tour

    Acceptance: The AAA loop: automated bot tours drive the world every night recording per-cell frame budgets, and the heatmap flags the sector that drops frames. Ours can be sovereign end to end -- nx_world_snap already renders the shipping engine headless and the review camera already auto-frames. Done when a deterministic seeded tour path visits every 16x16 cell of a world under the sovereign VM and under a headless browser tier, records frame ms, draw calls, mobs in frame and solver ms per cell into knowledge/status/worldperf.jrnl on the beat, two consecutive nightly tours exist for the beach, the compare emitter renders the heatmap per world with the worst cells NAMED on /compare/gameengine, and a planted stall (one cell with a forced 40 ms frame) is flagged by name -- the firing neg-control

    Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

38. GE34 — Physics telemetry with a budget referee: tick rate, solver time, body counts

    Prerequisites: GE32 (acceptance unverified)

    Contract: wc_phys_budget

    Acceptance: The physics half of the frame budget. The engine ticks at a fixed 60 Hz and runs softbody springs, the hair guide chain, cloth XPBD, weather and gait per tick, and none of it is timed or counted in the served page. Done when the engine exports per tick: solver ms per subsystem, active body counts (mobs, garments, strands, springs) and the share of the tick used, the page carries them in the GE32 HUD, and a gate refuses a build whose solver p99 exceeds the tick -- bound to a minimum-sample denominator (a check that passes on zero ticks is the passes-on-the-empty-set defect) and proven by a neg-control build with an injected solver stall that MUST fail

    Authored effort: 1.5. Executor kind: Gate. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

39. GE35 — LOD rings and a streaming budget derived from the heatmap, never typed

    Prerequisites: GE33 (acceptance unverified)

    Contract: wc_lod_rings

    Acceptance: Level-of-detail and streaming triage the way AAA studios run it -- distance rings adjusted from analytics. Today the cast has no LOD (a visiting figure at ring radius 16 renders every vertex into 30 px) and the world has no resident-asset budget the page can read. Done when each drawn class (voxel world, resident cast, visiting cast, garments, hair) declares LOD rings in a recipe row, the rings are DERIVED from GE33 heatmap data by a named rule rather than picked, the resident-asset byte budget is announced per frame, and the heatmap's worst cell improves measurably after the rings land with the frame bit-identical wherever no LOD boundary is crossed

    Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

40. GE36 — Digital-twin evaluation suite at the September-2026 research bar

    Prerequisites: GE26 (acceptance unverified)

    Contract: ws_twin_eval

    Acceptance: OPERATOR 2026-09-02: evaluation must reach the bar researchers publish, so the Infinigen-class output is a TRUE digital twin usable in medical, gaming and industrial fields. The estate already emits what such a suite consumes: nx_world_snap gt writes aligned RGB, depth, a 16-bit depth plane and normals from the shipping engine (GE26), frames are bit-reproducible from a seed (GE27), the referee panel grades characters (GR1), tissue physics carries cited bands. Done when ONE suite organ computes and publishes per world capture: geometric fidelity against a reference (Chamfer distance and normal consistency for meshed subjects), photometric parity against banked reference captures (PSNR, SSIM and an LPIPS-class perceptual distance), distributional realism of renders against the declared refpop (FID/KID-class), anthropometric validity of every figure against the cited ANSUR/WHO ranges, physics validity against the cited tissue bands, seed reproducibility bit-for-bit, and annotation quality for downstream use (depth accuracy on a planted ramp, label consistency across frames) -- every metric with its research citation pinned through the refs rung, every threshold a conf row, verdicts three-state (the suite ABSTAINS when a reference is missing and never acquits), rendered on /compare/gameengine and procgen from the same rows

    Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

41. GE42 — The rasterizer kernel is authored ONCE in NishiLang and compiles to native and to WGSL compute

    Prerequisites: GE43 (acceptance unverified)

    Contract: rk_kernel_ir

    Acceptance: OPERATOR DECISION 2026-09-02: in a third-party browser the GPU has exactly two doors, WebGL2 and WebGPU, so the sovereign design is ONE rasterizer kernel with two submission back-ends (WebGPU as a pipe in Chrome, Edge and Waterfox; the dxg lane in NishiOS and Nishi browser) -- loosely coupled, and the road to a SOTA NishiOS and browser. The kernel: a tiled integer triangle rasterizer with depth (atomic min), per-pixel material sample from the TEXM atlas, skinned-vertex input from the engine's own buffers, writing an RGBA plus depth framebuffer as storage -- the SAME nx_shader_ir source that nx_wgsl lowers, so it also compiles natively for the CPU tier and the dxg lane. Incumbents to compose, never re-implement: wc_tri, wc_tri_lit and wc_mob_mesh in nx_wasm_craft (the integer rasterizer the CPU tier runs today) and the Q14 nx_meshrender core behind nx_render3d. DONE-RULE: the WGSL-compute frame and the native frame of one scene at reference size are BYTE-IDENTICAL (GE1's law, integer determinism makes it decidable), a planted one-pixel mutant in either back-end fires the gate, and the HUD names which back-end drew the frame.

    Authored effort: 4. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

42. GE43 — The shader backend lowers compute: entry point, storage buffers, loops, atomics, workgroup builtins

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: wgsl_compute_stage

    Acceptance: MEASURED 2026-09-02 from nx_wgsl's own header: rung 1 covers the fullscreen-triangle vertex stage over nx_shader_ir, and NOT covered -- each a named refusal today -- are matrices, structs, loops, arrays of vectors as locals, derivatives, atomics, storage buffers and compute stages. The kernel of GE42 needs exactly: a compute entry with workgroup_size and global_invocation_id, read and read_write storage buffers, integer loops, atomicMin for the depth test, integer shifts and masks, and 2D arrays as storage. Each becomes a tooth that today REFUSES BY NAME and tomorrow emits, in both dialects from one IR node (the GLSL twin gets compute only where the target supports it; otherwise the refusal stays honest). This is a NishiLang-family gap: the shader backend is the compiler's fourth target beside x86, wasm and RISC-V, and it is the one furthest behind.

    Authored effort: 4. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

43. GE44 — WebGPU is a submission pipe only: buffers up, one compute dispatch, framebuffer presented by the emitted fullscreen triangle

    Prerequisites: GE42 (acceptance unverified), GE43 (acceptance unverified)

    Contract: rk_webgpu_door

    Acceptance: No render pipeline for geometry, no fixed-function raster, no hand-authored shader text in the page: the page creates the storage buffers from the engine arena regions, dispatches the GE42 kernel once per frame, and presents the framebuffer through the fullscreen triangle nx_wgsl already emits. DONE-RULE: GE40's provenance census counts ZERO shader bytes on the page that do not trace to nx_shader_ir, the frame equals the native frame, and the HUD reads door=webgpu-compute. The existing WebGPU world pass (hand-written WGSL, world only, no cast) is the incumbent this retires.

    Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

44. GE45 — The tier ladder is declared data and every visitor sees which door drew the frame

    Prerequisites: GE42 (acceptance unverified), GE44 (acceptance unverified), GE29 (acceptance unverified), GE30 (acceptance unverified)

    Contract: rk_tier_ladder

    Acceptance: WebGPU-compute kernel first, then the SAME kernel on the CPU tier as wasm across every core (GE30 tiles), then WebGL2 fixed-function as a NAMED LEGACY fallback carrying a sunset row for browsers without WebGPU; the ladder lives in a conf the page reads, the HUD announces the door and the reason the higher doors were not taken (the GL probe's ruler), and the publish verifier reads the door back. DONE-RULE: on a WebGPU-capable browser the frame is drawn by the kernel; on a refused one the CPU kernel draws the same scene with the cast (GE29) at lower resolution; nothing announces WebGL2 as sovereign.

    Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

45. GE46 — Launch is a URL: no store, no installer, the page IS the launcher

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: gpe_launch_manifest

    Acceptance: OPERATOR 2026-09-03: a game launch that needs no Steam or install. MEASURED on the served beach the same day: no web app manifest, no service worker, Cache-Control no-cache, and the 206 KB wasm module re-sent on every world crossing (performance PF1 owns the cached streaming module). Done when the world emitter emits a manifest and a service worker from NishiLang (no third-party bytes), the content-hashed module and cast assets are cached so a second launch and an offline launch reach first frame from cache, the page reports its launch source (network or cache) on the HUD, the same URL opens natively in the Nishi browser and on NishiOS without a store, and a gate proves a cold-cache and a warm-cache launch both draw the same frame with the warm one transferring no module bytes

    Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

46. GE47 — True crossplay on any device: one deterministic session joined from a phone browser, a desktop browser, the Nishi browser and NishiOS native

    Prerequisites: GE3 (acceptance unverified), GE27 (acceptance unverified)

    Contract: gpe_crossplay_session

    Acceptance: OPERATOR 2026-09-03 (standing order: the estate scales from a sensor to a supercomputer, the games have true crossplay on any device). The pieces exist as parts: lockstep and rollback netcode, rooms over the sovereign store, GE3 UDP, GE27 bit-identical frames native and wasm, and the door ladders (tier_ladder for the renderer, LN33 threads for the tick); nothing joins them into one session across device classes. Done when two DIFFERENT device classes (at minimum a mobile browser and the laptop, then the Nishi browser and NishiOS native) join one session, each picks its render door, thread count and mesh tier from the ladders by MEASURED capability and never by device class, and the per-tick state digests of every participant agree for a declared number of ticks -- with the neg-control that a deliberately desynced client is detected and NAMED within one tick window rather than drifting silently; the digest tooth is GE27's, reused, never a second ruler

    Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

47. GE48 — Navigation mesh and funnel paths for the cast

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: nav_mesh_funnel

    Acceptance: MATH GAP MEASURED 2026-09-03 (nx_capsearch, corpus_complete=1): pf_astar exists over a grid and no navmesh organ exists by name, so a girl walks straight lines and through props (the npcai board's no-routing finding); done when the world's walkable surface is extracted to convex polygons from the voxel field deterministically from the seed, a funnel algorithm returns the shortest path over them, a fixture with a known obstacle produces the analytically shortest route, and the npcai routing row flips on this symbol rather than on a second one

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

48. GE49 — A sweep-and-prune broadphase feeding the rigid-body solver

    Prerequisites: GE2 (acceptance unverified)

    Contract: phys_broadphase_sap

    Acceptance: MATH GAP MEASURED 2026-09-03: nx_collision_aabb tests one pair and no broadphase exists by name, so GE2's solver would test every pair; done when a sort-and-sweep over integer AABBs yields the candidate pairs, a brute-force all-pairs oracle agrees on every fixture, the pair count and time are printed per tick, and GE34's physics budget referee reads them

    Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

49. GE50 — The engine draws a frame as DISJOINT row bands over one arena, bit-identical to the single-thread frame

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: render_band_impl

    Acceptance: GE30's engine half, split out because GE30's done-rule also needs the page (Workers over one shared wasm memory) and a symbol that flips on presence must not be made to stand for a conjunct that has not landed. Done when the ray pass takes a row band and a worker id, the five wray outs live in per-worker scratch instead of one shared slot, the mob composite + depth strip + HUD run ONCE after the join, and the banded frame equals the single-thread frame word for word over the written extent at band counts that do and do not divide evenly -- proven by nx_craft_tile_gate against two fresh arenas, never a strided checksum

    Authored effort: -. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

50. GE56 — The served page's frame telemetry carries the industry's metric set and its percentile arithmetic is known-answer proven

    Prerequisites: GE41 (acceptance unverified)

    Contract: ft_metric_set

    Acceptance: SEPT-2026 BAR, read from the reference instrument's own documentation and release notes: presented versus displayed time, dropped frames, animation error, click-to-photon and PC latency in milliseconds, six percentiles (1 5 10 90 95 99) from the CPU-start reference [@ge-presentmon-capture] [@ge-presentmon-rel200], and the reference tool's own June-2026 admission that its p99 had been reporting MAX [@ge-presentmon-rel250]. Beside them the two absolute web thresholds: a long frame is 50 ms [@ge-loaf] and interaction-to-paint is judged at p75 with 200 and 500 ms bounds [@ge-inp]. WHERE WE STAND: p50 p95 p99 worst worst_ever budget_ms, present-side only, relative jank, arithmetic never KAT-checked. DONE-RULE: the telemetry line carries every published column in its published unit with its reference point named; a KAT sequence with percentiles known by construction is asserted by gv_check_eq in nx_frame_budget AND in the emitted JS under a driver, with a neg-control proving a p99-equals-max implementation fails; frames over 50 ms and p75 interaction-to-paint are counted and published; and /compare/acceptance renders the columns beside the PresentMon capture of the same page so the two are comparable by construction

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

51. GE51 — An improvement claim on /compare/acceptance is statistically honest: sample size declared, sequential looks corrected, variance reduced, A/A calibrated

    Prerequisites: GE56 (acceptance unverified)

    Contract: ab_always_valid

    Acceptance: THE OPERATOR'S BAR (2026-09-03): validate that we are improving in A/B and multivariate methodology. THE FIELD'S FIVE REQUIREMENTS, each from a mirrored primary source: a-priori sample size and the A/A calibration bar of about 5 percent rejections [@ge-expguide]; always-valid inference because uncorrected continuous monitoring inflates Type I error fivefold at 10000 samples [@ge-alwaysvalid]; CUPED-class variance reduction worth about 50 percent of the sample [@ge-cuped]; the effect-size prior of 0.1 to 1.0 percent and the posterior arithmetic that makes a one-in-500 prior a 3.1 percent posterior even at p below 0.05 [@ge-rulesofthumb]; and family-wise control, which nx_abstat_lib ALREADY carries (Bonferroni) beside a Welch contrast and nx_frameab's confound guard. DONE-RULE, one symbol per gap and each bite-proven on a synthetic fixture with a KNOWN planted effect: ab_always_valid (a contrast re-run at every look stays inside its declared Type I rate over a fixture of 1000 looks with NO effect -- the neg-control is the naive re-run, which must exceed it), ab_cuped (variance falls by a measured fraction on a fixture with a correlated pre-period metric and the same power arrives from fewer samples), ab_sample_size_aa (the required n is printed BEFORE the arms are read, and an A/A run over the live frametrace plane rejects at about 5 percent). The acceptance page prints the required n, the achieved n, the corrected p and the prior-adjusted posterior beside every improvement claim, and a claim missing any of them renders as UNPROVEN, never as green

    Authored effort: 2.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

52. GE52 — Every release is visible on the review page: the delta since the last operator verdict, the referee percept beside each subject and the acceptance recipe for this build

    Prerequisites: GE20 (acceptance unverified)

    Contract: gpe_release_block

    Acceptance: OPERATOR 2026-09-04: consistent progress each release on the /world/beach review page, which had not moved -- the accept- plane held four REJECT rows and one UNJUDGED from 2026-08-30 and nothing after, while every seat since shipped plumbing the page could not show. Done when every world page renders, from the accept- and referee- planes and the gameengine, graphics and charsim boards at emit time, the operator's latest verdict per subject, the referee percept and date beside it, every land row dated strictly after the newest operator verdict (capped and counted, never silently truncated), the boards actually read out of the boards declared, and the exact accept-row command for THIS build stamp; nx_release_delta_gate proves the arithmetic on fixtures, the served page exports window.__nx_release for nx_publish_verify. THE FLIP IS THE RECEIPT AND THE ACCEPT ROW IS THE PROOF: a subject leaves INCOMPLETE only through the operator's row.

    Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

53. GE53 — The world leaves voxels: a continuous-surface terrain source under all three render tiers

    Prerequisites: GE42 (acceptance unverified)

    Contract: wc_surface_source

    Acceptance: THE BEACH FIDELITY CEILING, named by GE45's 2026-09-03 measure row and owned by no rung until now: the world is a u8 occupancy grid and every tier raymarches one-metre cells, so no shader change can move the operator's photorealism verdict, and the 1/256-block height wheight_q already computes is rounded away at one line. Done when the terrain reaches every tier as a continuous heightfield (or SDF) sampled at sub-block precision -- the CPU raycaster marches the surface, the WebGL2 and WebGPU passes read the same field -- with a gate proving that a slope of one block over sixteen renders as sixteen distinct steps at native resolution rather than one, the six shipped worlds re-emitting byte-identical with the source OFF, and the review stage's ground grade moving under nx_frame_score. Palms return to the beach only through this rung (world_recipes.conf's own condition). Renderer decision first, then the surface, then vegetation and materials.

    Authored effort: 4. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

54. GE54 — One door per frame: the cast is submitted through the same door as the world (the S6-S12 cast port)

    Prerequisites: GE44 (acceptance unverified)

    Contract: rk_cast_block

    Acceptance: done-rule: on a WebGPU-capable browser the HUD reads door=webgpu-compute and the frame carries the cast drawn by the kernel with zero webgl2 calls in that frame; the frame matches the webgl2 frame within the referee panel's tolerance; nx_wgsl_pixel_gate GREEN on the 5080 host

    Authored effort: 6. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

55. GE55 — WebGPU as a pure submission pipe: the sim packs its own RAW state into an exported uniform block, the kernel unpacks it on the GPU, and the JS bridge is instantiate + writeBuffer + submit

    Prerequisites: GE44 (acceptance unverified)

    Contract: pack_uniforms

    Acceptance: done-rule: the served page carries ZERO F[NXUO.x]= packer writes and ZERO hand-written shader bytes; nx_wasm_craft exports uniform_off() and pack_uniforms() and the sovereign wasm VM gate (nx_wasm_craft_gate, no browser) proves the block is written with the sim state words; ws_world_uniforms declares the RAW integer state (cam fixed/256, yaw and pitch fixed/4096, sunel, dayt, dlen, rain, packed sky RGB, sun and cloud flags, palette words) and the WGSL and GLSL twins derive every float (sin, cos, pow, the palette light dl2) from one IR with world_trace_equal=1; nx_wgsl layout is the ONE ruler for the sim offsets and the page NXU_SIZE; the bridge JS is measured by count (packer arithmetic zero)

    Authored effort: 8. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

56. GE59 — The boot clock is data in the engine: a P_DAYPHASE recipe poke applied to S_T once per distinct value at tick time

    Prerequisites: GE57 (acceptance unverified)

    Contract: runtime/nx_wasm_craft.nx

    Acceptance: nx_wasm_craft_gate proves a poked day-phase value moves S_T exactly once per distinct value, an unset slot leaves the clock free-running, and the served worlds carry the poke on the sovereign wire

    Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

57. GE60 — The WebGPU door reports its decision and initialization stages

    Prerequisites: GE45 (acceptance unverified)

    Contract: _ABSENT_:ga_accept_gpu_decision

    Acceptance: HIGHEST PRIORITY the WebGPU world door must RECORD ITS OWN DECISION the gpu gate publishes every conjunct gpu-lever navigator-gpu ex-exports gl-lever and gpuInit publishes each milestone adapter device shader pipeline configure to window __nx_gpugate so a door is NEVER not-taken unexplained done when the served page names the exact false conjunct or milestone and WebGPU is taken as primary proven by a captured frame carrying door webgpu Engineering dependency decision 2026-09-10: GE45 supplies the declared tier ladder read by nxgd_row; completion is an accepted served decision report, not presence of the emitter function.

    Authored effort: 5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

58. GE61 — Visual captures carry verified provenance and renderer identity

    Prerequisites: GE60 (acceptance unverified)

    Contract: _ABSENT_:ga_accept_capture_provenance

    Acceptance: HIGHEST PRIORITY every visual claim carries a SOVEREIGN PROVENANCE-STAMPED capture no third-party CDP wire a capture records url tier door-report renderer and a hash and is refused as evidence if its source cannot be verified done when the estate captures the served page itself and stamps provenance so an AI seat cannot spoof a frame Engineering dependency decision 2026-09-10: GE60 supplies the door decision consumed by this capture contract. Existing Playwright over MCP provides inspection and retained evidence; it does not by itself satisfy the stronger sovereign-provenance claim.

    Authored effort: 5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

59. GE62 — Streaming large-body fetch to disk, redirect-following

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: rfs_stream

    Acceptance: THE FIRST BYTE OF THE PHOTOREAL LADDER. nx_research_fetch buffers a whole body into a 128 MiB named reserve and REFUSES anything that fills it, and nx_http_probe does not follow redirects -- so the licence-clean ten24 scan (S3, answers 301, declared very large) is unreachable today and its size is UNMEASURED. Done-rule: a fetch that follows redirects, streams to disk without ever holding the body, prints running bytes plus a sha receipt, declares a byte budget it obeys, and a neg-control proving a body larger than the old reserve now lands intact where the buffered path refused it

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

60. GE63 — Scan ingest under a licence that travels with the asset

    Prerequisites: GE62 (acceptance unverified)

    Contract: sci_admit

    Acceptance: The oracle mesh must enter the estate with its licence readable afterwards, never as anonymous geometry. nx_bundle_ingest (LIVE, dark) walks the ZIP to a typed manifest and nx_obj_import (LIB) reads Wavefront; neither has been invoked. Done-rule: the ten24 OBJ package ingested to a manifest carrying licence=ten24-credit and source url, converted to an NXA whose vertex and face counts equal the OBJ's own, with a neg-control proving an unlicensed bundle is REFUSED by name rather than silently admitted

    Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

61. GE64 — Landmark table derived from the scan, as data

    Prerequisites: GE63 (acceptance unverified)

    Contract: lmk_derive

    Acceptance: The critic needs ground truth the estate owns: a named landmark table (pupil, nose tip, chin, jaw corner, the canthi) resolved on the scanned mesh by nx_facemark (LIVE, dark) and stored as a conf the generator and the judge BOTH read. Done-rule: every declared landmark resolves to a vertex index with its 3D position, the table round-trips, and a neg-control proving a landmark the scan cannot carry is reported ABSENT rather than invented

    Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

62. GE65 — Two-way surface distance against the oracle, ratcheted

    Prerequisites: GE64 (acceptance unverified)

    Contract: msd_chamfer

    Acceptance: The generated figure is judged by a NUMBER, not by my eye. nx_meshdist (LIVE, dark) scores our procedural body against the scan oracle in BOTH directions, the board ratchets it, and the ranker prices the residual. Done-rule: a two-way mean and worst distance printed with its units and its denominator, a ratchet that tightens on improvement and names the offender on a rise, and a neg-control proving a deliberately wrong mesh scores strictly worse than the shipped one

    Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

63. GE66 — The face is geometry, not paint

    Prerequisites: GE65 (acceptance unverified)

    Contract: fac_morf

    Acceptance: THE LARGEST PHOTOREAL LEVER AND THE ONE THE OPERATOR SEES FIRST. Today brows, eyes, lashes and mouth are painted procedurally in the fragment shader against a bind height -- a face that cannot deform, cannot cast its own shadow and reads as a decal in any close-up. Move them onto NXA MORF blend shapes driven by the same mood doors, judged by the GE64 landmark table and the GE65 distance. Done-rule: the landmark table resolves on the GENERATED head within the ratcheted distance, the painted-feature block is retired from both shader doors, and a captured close-up carries a face whose features move with the mesh

    Authored effort: 8. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

64. GE67 — Per-region skin atlas at the resolution we already ship

    Prerequisites: GE63 (acceptance unverified)

    Contract: atl_region

    Acceptance: The emitter's own npc-atlas referee prints AMBER on every publish: 4 of 4 declared skin bands (primary 1200um, secondary 250um, pore-grid 800um, pore-orifice 100um) are COMPUTED BY THE BAKER AND CLAMPED AWAY at whole-body res 2048 (830um per texel), and it names the remedy itself -- a per-region atlas, never a bigger whole-body one, because the 250mm-region resolutions are already met by what we ship. Done-rule: the referee reads GREEN on all four bands at the shipped resolution with the region spans declared as data, and its neg-control (whole-body cannot carry what the region can) still discriminates

    Authored effort: 5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

65. GE68 — The referee measures ACHIEVED per-chart texel density from the asset

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: adq_chart

    Acceptance: PREREQUISITE OF GE67 AND THE REASON IT IS ORDERED FIRST. The npc-atlas adequacy check derives texel size as RLF_BODY_UM/res -- it assumes the body maps uniformly onto the atlas. It does not: TEXC assigns every joint an EQUAL tile of a g x g grid (g=nt_grid(nj)), so the head carries the same texels as a finger and the true per-region density is nowhere measured. An allocator that fixes this would be an improvement NO REFEREE COULD SEE, which is the unfalsifiable-from-outside defect. Done-rule: the check reads each chart's rectangle and its owning joint's bind span FROM TEXC, prints achieved um-per-texel per region beside the band it must carry, scores every band against the span of the chart that covers it, and keeps its existing neg-control that whole-body and region must not agree -- the ruler learns to measure what is there, and is never edited to flatter a number

    Authored effort: 4. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

66. GE67b — Importance-weighted chart allocation in the TEXC unwrap

    Prerequisites: GE68 (acceptance unverified)

    Contract: ntx_alloc

    Acceptance: THE FIX ITSELF, AND IT COSTS ZERO EXTRA BYTES. TEXC stores ABSOLUTE atlas u,v, so the bake and BOTH shader doors follow the allocation with no change: only ntx_apply decides it. Replace the uniform tile (tx=pj%g, tw=Q16/g) with a per-joint rectangle whose area is the referee's own Nyquist demand -- span/(lambda/2) for the finest band that joint's region declares -- packed deterministically, with the common scale factor ANNOUNCED when total demand exceeds the atlas so a shortfall is visible instead of silent. TEXC's reserved header word [3] becomes the rect-table offset (0 reads as the legacy uniform grid, so every existing asset and reader is unaffected). Done-rule: GE68 reports the face carrying primary, secondary and pore-grid at the SHIPPED 2048 where it carries none today, total atlas bytes unchanged, a neg-control proving an asset with no rect table still unwraps exactly as before, and a captured close-up showing the skin detail the bands describe

    Authored effort: 6. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

67. GE66a — The engine CONSUMES blend shapes: the face deforms instead of being painted

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: wc_morf_apply

    Acceptance: THE FALSE BLOCKER REMOVED. GE66 was declared depending on GE65 and therefore on the whole scan-oracle chain down to a fetch this estate cannot yet make -- but that chain validates PROPORTIONS, and moving a feature from a fragment shader to geometry needs no external scan at all. Measured today: nx_nxa_morf is PROMOTED at 46726 B and DARK, the NXA format carries a MORF section, and the served page names MORF exactly ONCE, in a COMMENT that says the section replaces the painted mouth with true blend shapes later. So the format and the writer both exist and the RUNTIME is the only missing half. Done-rule: the wasm cast path applies MORF vertex deltas before the dual-quaternion skin, the emitter's cast shader retires the painted brow, lash and mouth blocks in BOTH doors, a captured close-up shows a feature moving with the mesh under the same uMoodF door that drives it today, and a neg-control proves an asset with no MORF section renders byte-identically to the pre-change build

    Authored effort: 6. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

68. GE66b — Face proportions judged against a licence-clean scan

    Prerequisites: GE65 (acceptance unverified), GE66a (acceptance unverified)

    Contract: fac_proportion

    Acceptance: The half that genuinely needs the oracle: GE64's landmark table resolving on the GENERATED head within GE65's ratcheted two-way distance. Split out of GE66 so the geometry work is not held hostage to a fetch. Done-rule: every declared landmark resolves on the generated head, the distance is inside the ratchet, and a neg-control proves a deliberately mis-proportioned head scores strictly worse

    Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

69. GE57 — Beach terrain, player and NPC ground contact accepted

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: ga_accept_locomotion

    Acceptance: Recovered from retained GE57 logs1788622572 and1788623100: wc_shift increments S_AGEN once for a nonzero X/Z shift and leaves it unchanged for zero movement; arena_gen exposes that identity and both GPU upload paths consume it. Verify native moving/zero-shift controls and a served GPU session crossing at least four shifts with rendered terrain, player feet/support and NPC contact in one coordinate frame. Existing native/served source presence does not close loaded floor acceptance. Engineering decision2026-09-10: no additional declared board rung is required to implement this internal wc_shift/state/export/upload synchronization; foundational code dependencies are named here. Effort remains unestimated. 2026-09-13 mapping correction: arena_gen is a declared implementation function in runtime/nx_wasm_craft.nx, not acceptance. The milestone now watches the existing generated ga_accept_locomotion declaration in runtime/nx_accept_decl.nx; none is currently emitted. Source synchronization cannot pass shared-coordinate or loaded-body contact. Root wholeNPC review buildroot/knowledge/gates/beach-character-root-review-t266.json reports imported world translation and body collision not delivered; skin-wrap-served-root-t267.json retains these failures. Native candidate export and movement tests are not served acceptance.

    Authored effort: -. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

70. GE69 — Reference video becomes measured reusable motion

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: _ABSENT_:beach_reference_motion_accept

    Acceptance: Reuse nx_video_pose_coder and existing video ingestion/evaluation owners. A content-identified local reference yields decoded timestamps, tracked subject identities, coordinate convention, motion curves and per-observation uncertainty through API/MCP. Verify visible keypoints against retained annotated frames, occlusion and missing-data controls, temporal continuity and repeatable output. No inferred motion presented as measured geometry. E:/1788844578214487.mp4 is the first operator reference, not yet decoded. No model training implied.

    Authored effort: -. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

71. GE70 — Rigged imports retarget motion without contact regressions

    Prerequisites: GE7 (acceptance unverified), GE57 (acceptance unverified), GE69 (acceptance unverified)

    Contract: _ABSENT_:beach_reference_retarget_accept

    Acceptance: Reuse rig and motion owners. Reference curves animate at least two distinct imported proportions with source rig and materials preserved; no-op and round-trip controls; measure contact error, foot sliding, joint-limit violations, deformation and collision under declared test conditions. Character feet, terrain support and NPC collision share coordinates in the served beta. Failed trials retain evidence and refuse acceptance.

    Authored effort: -. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

72. GE71 — Fused geometry becomes editable riggable parts

    Prerequisites: GE7 (acceptance unverified)

    Contract: _ABSENT_:beach_editable_parts_accept

    Acceptance: A selected licensed mesh or STL is segmented into named parts with explicit units, source-to-output correspondence and provenance. Preserve observed surfaces within declared measured tolerances; label reconstructed hidden geometry as inferred. Body, garment and accessory replacement preserves identity, rig bindings, materials and collision. Verify removal, replacement, undo and reassembly on representative assets; 2D image layers do not qualify as 3D separation.

    Authored effort: -. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

73. GE72 — Reference form fits an editable procedural family

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: _ABSENT_:beach_inverse_procedural_accept

    Acceptance: Reuse procedural and proportion owners. Recover constrained parameters for a declared generator family from a reference, report bidirectional surface and landmark residuals with units, reject unsupported-family matches, and produce reproducible controlled variants. Preserve rig function and contact when applied to characters. Evaluate diversity and user-selectable aesthetic preference separately from geometric correctness. Start with Beach vegetation where appropriate; arbitrary-human reconstruction is not assumed.

    Authored effort: -. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

74. GE73 — Expressive reference-derived scene is playable on Beach

    Prerequisites: GE70 (acceptance unverified), GE66a (acceptance unverified), GE15 (acceptance unverified)

    Contract: _ABSENT_:beach_reference_scene_accept

    Acceptance: Compose and recombine accepted motion, rigging, object interactions and expression across distinct bodies and compatible props into an interactive Beach scene. Verify concurrent locomotion, hand occupation, gaze, expression and speech; contact preservation; interruption and resumption. Include walking greetings and gardening conversation, with failed combinations retained and evaluated rather than hidden by clip counts. Provide controllable gaze, timing and response to player actions; facial motion uses existing GE66a rather than texture repainting. Retain source-versus-result review and quantitative contact/deformation evidence. Publish p50/p95/p99 frame time, input latency, memory, preparation time and resource cost separately; quality and responsiveness both pass declared device-specific criteria. Existing swarm admission must qualify capacity and privacy before remote execution. Offline video similarity alone cannot pass interactive acceptance.

    Authored effort: -. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

75. GE74 — Sovereign audio is a boarded domain: ocean, wind, footfall, voice and speech spatialised from the engine's own libs

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: au_beach_mix

    Acceptance: The estate ships nx_audio_spatial (3D positional audio, spatial_place), nx_audio_osc (oscillators), nx_sound (windowing and spectrogram), nx_asr_frontend and nx_aec, and no compare board carries any of them (SOVEREIGN AUDIO ENGINE is ABSENT-PROVEN across every plan, corpus_complete=1). Done-rule: an audio domain is admitted through nx_domain_admit with a matrix, plan, refs and gates; the beach page mixes ocean, wind and footfall from those libs driven by the wind field the world already carries, with speech from the NPC dialogue door; and a listening referee grades the mix against the synthetic-HRTF validity bar (2608.16722) and the modal sound-field bar (2608.05145), the way the pixel referee grades the picture. Until the domain exists, SB-AUDIO-2609 on this board is the only trace.

    Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

76. GE75 — Hips that move: a pelvis gait sub-model with obliquity, rotation, tilt and lateral sway driven by phase and speed, strut as data

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: wc_pelvis_gait

    Acceptance: OPERATOR 2026-09-16: hips that move, the strut. The cast walks on a vertical bob plus a wander heading; no pelvis pose exists for the tissue or the garments to ride. Done-rule: the gait tick emits a pelvis pose (obliquity, axial rotation, anterior tilt, lateral centre-of-mass sway) as a function of gait phase and speed with every amplitude a CITED band pinned in gamefeel_oracle.conf before any number ships (the plant law), and a strut gain as world data; obliquity peaks at contralateral heel strike and lateral sway reverses each step (gate); strut 0 reproduces the incumbent frame digest byte-identically (neg-control); PhysScore-class channels (foot skate, float, balance) do not regress; the referee panel grades a fixed-camera strut capture against the operator's lens before ADOPT.

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

77. GE80 — Language-written reward functions over the sovereign physics simulation

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: ge_reward_gen

    Acceptance: DONE-RULE PRE-DECLARED: the engine dispatcher writes a reward function in NishiLang from a task description and the simulation source, the sovereign RL loop trains against it, and success is judged by the task's own sparse success signal, never by the written reward; the receipt publishes task success against a hand-written reward baseline on the same task, and a candidate that games its own reward (success signal unchanged while reward rises) is refused by name [@eureka24] [@text2reward23]

    Authored effort: 4. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

78. GE81 — ManiSkill-class manipulation referee

    Prerequisites: GE80 (acceptance unverified)

    Contract: ge_manip_referee

    Acceptance: a manipulation task suite runs on an isolated oracle host with ManiSkill3 as the referee simulator outside the build path; the same tasks are mirrored into the estate's simulation with licences beside the assets, and the receipt publishes success per task on both simulators so a divergence names the simulator, not the policy [@maniskill25]

    Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

79. GE82 — The beach in the headset: stereo 90 Hz with a foveated splat periphery

    Prerequisites: GE15 (acceptance unverified), GE30 (acceptance unverified), GE45 (acceptance unverified), GE32 (acceptance unverified)

    Contract: _ABSENT_:ge_vr_foveated_tier

    Acceptance: Two eyes at native panel resolution, 90 Hz sustained on the declared floor device, a mesh or path-traced fovea and a Gaussian periphery (the VR-Splatting class, SB-VRSPLAT-2609), driven by the tier ladder (GE45) and judged by the frame-pacing referee (GE15) with telemetry published (GE32). The mesh already reaches the compositor (dcc DC15); this rung is the photoreal tier reaching it. Done-rule: 90 Hz sustained with the pacing referee GREEN and per-eye resolution declared, on the floor device and the ceiling device named in the scale envelope.

    Authored effort: 6. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

80. GE83 — A reference still becomes the composed beach scene

    Prerequisites: GE73 (acceptance unverified), GE82 (acceptance unverified)

    Contract: _ABSENT_:ge_refstill_compose

    Acceptance: The operator end state of T-FR-COMPOSE run on the beach-lounger reference class (2026-09-27): the lounger, cushion, painted pole and concrete curb are found as INSTANCES and regenerated as procedural math (PG10 over the live solver, graphics GR25 placement solved), the human is the correlated identity core's synthetic person and NEVER the pictured identity (procgen PG17 consent-gated intake, aesthetictwin AT10 licence chain), the sun's elevation and azimuth are ESTIMATED from cast shadows and the sky from the physically-based model (graphics GR26), the palette is MEASURED per region (graphics GR62), and the scene ships to the beauty tier (graphics GR42) and the live tier (GE82). Done-rule: the composed scene's instances, camera row (graphics GR61), sun row and palette rows are data files a seat can diff, and the frame passes the real-versus-render bench (graphics GR63).

    Authored effort: 8. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.