RUNTIME_GENERATIVE_LAYER.md

systems/RUNTIME_GENERATIVE_LAYER.md

Runtime Generative Layer — Local-LLM Life Inside Deterministic Scaffolding

0. Thesis (the continuo lesson, ported to runtime)

Josh's frame: a local LLM is dumb and current-tech-limited. The studio already proved the fix at build time — the /dev/continuo lesson (ROADMAP §8, docs/START_HERE.md wiring doctrine): a dumb 14B model hit 0.965 truth-recall not by being smart but by being wrapped in deterministic code that encoded every failure/reward pattern and gave it perfect-precision recall over a bounded, structured truth store. Continuo did this for untrusted audio extraction; we do it for canon.

The build-time version already exists in this repo: harness/canon_graph.json (3,118 nodes, 11,974 edges) + the planned harness/recall.py give Opus perfect-precision recall so it never re-derives canon (docs/CANON_INTEGRITY_ARCHITECTURE.md §B, §D). This spec ports that exact architecture to RUNTIME. The local model that voices a boss, an animal, or an NPC at 60fps is the dumb 14B. The canon graph is the bounded truth store. A runtime context-pack is perfect-precision recall. A post-generation validator is the deterministic gate. Authored fallback is the reward-pattern floor. The model never touches lore it could get wrong; it only ever performs surface texture over facts the deterministic layer already proved.

The one governing move, stated once and specialized everywhere below. Josh's hard constraint restated as the architecture's first law:

The world is a deterministic simulation. The local LLM is a strategy oracle the sim consults on a slow tick — never a mechanic, never per-frame, never on the render thread, never with a write path into sim state. The LLM never emits actions; it emits a small, schema-constrained, canon-validated STRATEGY TOKEN — a bundle of {goal, disposition, plan-selector, a few knobs, a bounded line} — and a deterministic controller (state machine / GOAP / utility AI / behavior tree) executes that token at 60 Hz. The token is a latent variable that conditions deterministic policy; it is validated against the canon graph before it can bind; on validation failure or a latency miss, an authored fallback token binds instead. The game is always running a valid token. The LLM only ever changes *which* valid token, on a slow tick.

This is the strongest idea in the 2025–26 hierarchical-control literature (an LLM emits a compact latent/symbolic plan; a fast deterministic executor runs it — SayCan / Voyager-style skill libraries, LLM-strategist-over-symbolic-executor) hardened for a shipping console frame budget. The entire taxonomy in §1 is that one idea specialized per entity class: *what is the strategy token for this entity, how often is it refreshed, what deterministic system consumes it, and how does the player manipulate it.*

Design rule inherited verbatim from build_canon_graph.py: never trust the model with a fact it could hallucinate; never drop a constraint silently; on any violation, fall back, log, and stay shippable. The runtime layer fails the way the harness fails — loudly to the log, invisibly to the player.

The cardinal rule from CLAUDE.md still binds at runtime: the local LLM does not invent canon. It has no authority over any fact in §1's deterministic column. It reallocates and re-postures *existing* canon entities within *existing* rules; anything it "wants" to create routes to [DECISION NEEDED - JOSH], never self-canonizes.

---

1. The generative/deterministic split (the load-bearing table)

The single most important decision. Anything the model could get *wrong in a way a player notices* is deterministic. The model only gets what is safe to vary and cheap to be wrong about — and even those pass the §4 validator.

1.0 — The distinction stated once

The rule that assigns any capability to a column: **if getting it wrong changes what is *true* in the world or breaks a rule, it is deterministic; if getting it wrong only changes *how* a true thing is pursued or said, it is strategic — and the validator still checks it.**

1.1 — DETERMINISTIC (code owns it; the model never emits it)

1.2 — GENERATIVE (local LLM STRATEGIC layer, always §4-validated, always fallback-guarded)

The rule that separates the columns: the model performs; it never adjudicates. If getting it wrong changes what is *true* in the world or breaks a rule, it is in 1.1. If getting it wrong only changes *how a true thing is said or pursued* — and the sim still validates and deterministically executes that choice — it is in 1.2, and §4 still checks it.

---

A. Entity taxonomy — the six classes and their strategy tokens

Six entity classes. For each: the strategic tick (how often the LLM is consulted), the token the LLM emits, the deterministic executor that consumes it, and the manipulation mechanic (how the player changes/exploits the entity). Efficiency for every class is gated by §B; canon-safety by §D. The cadence ladder is the efficiency spine — *the more populous or hot-path an entity, the slower and more pooled/cached its LLM contact.*

A.1 — Class 1: Ambient NPCs (crowds, vendors, villagers, background townsfolk)

High-population, low-stakes. Efficiency is the whole game: a market square has 40 of them and the model must not be consulted 40× a frame — or even 40× a second.

• Strategic tick — SLOW + POOLED + SPECULATIVE. A single shared crowd-director tick at ~0.05–0.1 Hz (every 10–20 s) refreshes the *mood/rumor pool* for a whole zone, not per-NPC. Per-NPC dialogue is event-triggered and speculatively pre-warmed during idle, cached per (persona_bucket, worldstate_bucket). A crowd of 40 sharing 6 persona buckets and one worldstate bucket is 6 cache entries, not 40 live calls. Ambient NPCs never generate on the combat/hot path; uncached at request time → authored bark, generate-in-background for next time.
• LLM emits: ambient_mood (zone), rumor_topic_id (a retrieval key into the fact whitelist, never a fact), and on probe a bounded line (≤40 tokens).
• Deterministic executor owns: schedules/routines (day-night FSM/GOAP), pathfinding, collision, the vendor's actual inventory/prices (economy is T0-owned, never generated), crowd flow, and the RNG-picked (Sigma-bounded) selection of which cached line plays.
• Interface: the crowd-director token sets two globals (zone_mood, active_rumor_id) the bark-selector reads; per-NPC persona differences come entirely from the frozen context pack.
• **Manipulation mechanic — *the crowd reads your worldstate.*** The player edits ambient NPCs indirectly and legibly: integrity band, chapters cleared, and recent deeds are the only worldstate deltas the crowd-director may see. Walk in at the Corrupted band → mood shifts to wary, rumor surfaces "they say the one who did *that* is here"; at Luminous the same square generates gratitude. The player never edits an NPC directly — they edit the world, and the crowd's reaction is a mirror of their authored self. A Ch 10 villager physically cannot leak a Ch 76 reveal (fact-whitelist; §17.5).

A.2 — Class 2: Named characters (T0_Character_Index 118, T0_Antagonist_Network_Registry 62)

Canon fidelity is highest-stakes here — these are people Josh wrote. The LLM voices them; it owns zero of their facts.

• Strategic tick — EVENT-DRIVEN, bounded. On meaningful interaction only (player probes, a plot beat fires, the character reacts to a witnessed deed), ~700 ms budget (the player is waiting; a "thinking" beat is allowed). Between interactions a named character runs on a deterministic schedule + the last-set disposition scalar.
• LLM emits: disposition_delta (±-clamped), a persona-bounded free response (≤80 tokens) drawn only from a whitelist of facts *this specific character* may know (off-whitelist → the persona deflects, which is itself characterful), and for antagonist operatives a pursuit_disposition inherited from Class 5.
• Deterministic executor owns: every canonical fact (name, relations, era, arc, biography, voice identity §17.12/§17.5); schedule/navigation/scene-presence; and the dialogue tree structure where a canonical one exists (Ch 13 journal activation, Ch 38 handoff, Ch 57 public release) — the LLM colors leaves' phrasing, never reorders or invents a beat.
• **Manipulation mechanic — *earned disposition + bounded probing.*** (1) Worldstate accretion — integrity band and deeds move disposition, generated fresh each time, so a companion/quest-giver *notices* who you've become. (2) Conversational probing — the player's input is intent-classified to a topic id (raw text quarantined as untrusted → prompt-injection defense), the topic selects a whitelist slice. A skilled player manipulates dispositions and asks the right questions; they can never jailbreak canon out of a persona.

[DECISION NEEDED - JOSH] Which named characters ship with runtime-generated probe responses ON vs authored-only. Recommendation (§6): main antagonists + companions ON; culturally-high-care community figures (Aboriginal Elders, Sámi noaidi, Vodou priests, indigenous shamans — the §17.1 / CVD L265 inviolable set) authored-only at launch — the model assists *authoring* their lines, not runtime speech, given HL_0002 (every cultural claim traces to a primary source, which the model cannot do).

A.3 — Class 3: Fauna / creatures (33 legendary species; open-ended regional fauna)

Canon: 33 legendary species = 21 mortal (7 Ground/7 Flight/7 Water) + 12 elven; 22 familiar slots; T0_Creature_Roster carries folklore_behavior_substrate + folklore_attribution_source. The LLM performs the *read* over deterministic behavior; it never picks behavior.

• Strategic tick — RARE / STATE-CHANGE-TRIGGERED. Behavior is 100% deterministic (BT/utility AI). The LLM is consulted only on a behavior *state transition* (idle→alert, alert→threat, threat→bond), ~0.1–0.5 Hz at most, to render the *flavor* of the state the sim already entered. Legendary/familiar bonding beats fire at the chapter_bonding_window.
• LLM emits: behavior_flavor (vocalization/descriptive beats generated from folklore_behavior_substrate + attribution — the §17.1 discipline is what keeps it off generic-monster slop) and a temperament_read coloring *how* the deterministic bonding minigame reads, never its outcome.
• Deterministic executor owns: all mechanics — spawn/territory/aggro/flee thresholds, chapter_bonding_window, trade_8_tameable, the binding-stone mechanic, familiar-slot assignment, person-to-animal combat, the Ch-73 familiar-combo system. Bonding *success* is deterministic (skill + item + window), never generated.
• **Manipulation mechanic — *tame, bond, provoke, exploit territory.*** Approach within the window with the binding stone + the right Trade-8 skill → the sim bonds it (into one of 22 slots; the childhood familiar reunion is authored at Ch 58 Antarctica). Provoke a territorial beast → hostile sub-boss. The generated read is the diegetic hint layer over the deterministic aggro state; taming is a learnable skill, not dice-with-an-LLM. (Note: Ch 57 fauna combat is permitted per Ruling 5, but the live T4 contradiction gates any Ch 57 fauna authoring.)

A.4 — Class 4: Partners / teammates / familiars (bonded party companions)

The class the player spends the most continuous time beside — so the "feels alive" vs "never on the hot path" tension is sharpest. Solved by splitting the companion into a deterministic combat/traversal agent and a slow strategic personality tick.

• Strategic tick — TWO CLOCKS. *Combat/traversal:* zero LLM — in a fight the companion/familiar is a GOAP/utility agent at 60 Hz (target selection, ability use, positioning, the Ch-73 paired-operation combo). The LLM is never in this loop. *Personality/relationship:* event + slow-idle tick (~0.03 Hz, every ~30 s of relevant activity) — a reaction, a banter line, or a shifted disposition, off the render thread, pre-warmed.
• LLM emits: combat_disposition — a *utility-weight bias* the deterministic combat AI reads (protective/aggressive/cautious). This is the core §0 move made literal: the LLM sets *style*, the utility AI executes *actions*, refreshed on the slow tick, never mid-swing. Plus banter lines and a ±-clamped relationship_delta.
• Deterministic executor owns: the entire combat loop, ability cooldowns/vril costs, pathfinding, the familiar combo system, and the relationship state machine (thresholds, locked beats). The disposition bias only shifts utility weights within authored bounds — it can never make a companion do something out-of-character or mechanically illegal (Sigma-bounded so it *nudges*, never frame-perfect-controls).
• **Manipulation mechanic — *cultivate the relationship; it changes how they fight beside you.*** High trust → generated combat_disposition trends protective, banter warms; betrayal/Corrupted-band drift → trends wary, banter cools, and at authored thresholds the deterministic relationship SM can lock a companion out entirely. You don't configure your teammate in a menu — you earn how they show up for you, legible in both their words (generated) and their combat behavior (deterministic bias shift).

A.5 — Class 5: Societies / factions (the Velheim antagonist network + protected communities)

The strategic heart — where the LLM earns its place (faction-level intent is the "slow, high-level, why-not-what" decision the model is good at and the sim is bad at hand-authoring across 30M words) and where canon binds hardest. Full simulation layer in §7.

• Strategic tick — SLOWEST (the "director" tick, ~0.005–0.02 Hz, every 1–3 minutes of play, or on major world events). Factions think in campaigns, not frames. The Velheim network director re-evaluates its posture rarely: after the player crosses a threat threshold (the canon Aggro Magnet), clears a chapter, or shifts integrity band.
• LLM emits: faction_intent ∈ authored enum {surveil, pressure, intercept, entrench, retreat, negotiate…}; operative_assignment_bias (weighting over already-canonical operatives, never inventing one); escalation_reason (surfaced through operative dialogue, Class 2 voices it).
• Deterministic executor owns: the actual spawning/patrols/encounters — faction_intent = intercept spawns nothing itself; it *raises a weight* the deterministic encounter system (confined to the three declared systems) reads when *it* decides, on its own Sigma-bounded timers, to spawn a Velheim hunter. The LLM sets *pressure*; the sim decides *events*. Cassius Velheim's Ch 76 three-phase boss and the Ch 75 fight are authored, deterministic — the director never touches the antagonist-arc payoff. The protected-community hard line is a deterministic wall, not a generated policy (HL_0003 / CVD L265, L835, L923): protected communities have no faction_intent that can target the player as combat; where combat reaches a protected space it is Velheim intrusion. **Ch 57 is the extreme case — the only chapter with no antagonist-family presence (CVD L905) — its faction director is *disabled*;** combat arrives via environmental + astral mode only. The validator (§4) hard-fails any token that would provoke combat against a protected community (F5).
• **Manipulation mechanic — *heat, alignment, and playing factions against each other.*** Exceed the regional threat threshold (Aggro Magnet) → the director shifts to pressure/intercept → the hunter-spawn weight rises; lie low → it decays to surveil. An Corrupted-band player is *read* differently than a Luminous one. Protected communities are manipulated only by *defending* them (you cannot turn them hostile — the hard line forbids it); you earn their trust by repelling Velheim intrusion.

A.6 — Class 6: Environments / world-state (weather, vril density, arena cycles, the environmental-boss protocol)

The world itself as an entity — almost entirely deterministic, plus a thin strategic layer of *atmospheric intent* and the *diegetic read* of the environmental-boss protocol (canon's non-damage-win layer).

• Strategic tick — VERY SLOW / SCENE-SCOPED (~0.01 Hz or on scene entry). A scene-director tick on zone/arena entry sets an atmospheric intent; the environmental-boss read is generated at the protocol's state transitions (a handful per encounter).
• LLM emits: atmosphere_intent (a mood/weather *bias*, drawn from region substrate, never overriding the deterministic weather sim — only biasing within authored ranges) and env_boss_read (the diegetic perception layer over the deterministic protocol — descriptive beats distinguishing the genuine_echo from the negative_manifestation, rendered faithfully from region substrate per HL_0002; it *describes*, never adjudicates the polarity-match minigame).
• Deterministic executor owns: vril_density (the single global difficulty float — the LLM never touches the difficulty dial), every arena cycle clock (tide/geyser/sandstorm/vril-tide), the Withdrawal clock, the entire environmental-boss protocol (Perception → Vril-management → Restraint → Purgation), the graduated-failure states (feeding the negative → strengthening the Ch-39+ revisit — the canon Hades seed), and all worldstate variables/flags. Multi-channel vril-polarity readability is a non-negotiable L1 requirement and deterministic-owned — the perception verb must be legible without color, so it cannot depend on generated text.
• **Manipulation mechanic — *read and time the world; run the protocol.*** Time offense to the arena cycle, weaponize env-trap nodes, and for environmental bosses run the 4-step protocol (perceive the genuine echo → resonate without feeding the negative → hold the restraint budget → purge). The generated read makes the world feel perceptive; the deterministic protocol guarantees the "you cannot DPS this" encounter is a real, learnable, L1-playable system (Josh's ruling that L1 stays action-packed everywhere). The vril_density dial is the player's meta-manipulation of the whole world's generosity — deterministic to the last decimal.

A.7 — The taxonomy at a glance

Cadence ladder (the efficiency spine): ambient crowds share a zone tick; combat companions get zero LLM in-fight; factions think in minutes. At no tick does the LLM run per-frame or on the render thread. One shared 3–8B quantized model, prefix-cached persona preambles, priority-batched (combat-relevant reads > player-facing > ambient), speculative pre-warm during idle. The frame budget belongs to the sim; the LLM lives in the gaps.

---

2. Guardrail architecture — the truth-guardrail loop

Every generation is a four-stage deterministic sandwich around one model call. The model is the meat; it never touches the outside world directly. Generalized from "generate a line" to "generate a strategy token":

  [1] CONTEXT PACK      deterministic: recall.py builds a per-entity, canon-true pack
        |                (persona/disposition prior + hard-line rule vector + fact/goal
        v                whitelist + care band + action vocabulary for strategic entities)
  [2] CONSTRAINED GEN   local LLM: grammar/JSON-schema-constrained decode of a STRATEGY
        |                TOKEN (goal ∈ enum, plan ∈ legal set, knobs ∈ ranges, line ≤ N tok)
        v                — malformed impossible, out-of-vocabulary name unsampleable
  [3] POST-GEN VALIDATE deterministic: check token vs the canon graph + rule vector +
        |                legal-transition set. PASS -> bind;  FAIL -> [4]
        v
  [4] AUTHORED FALLBACK deterministic: bind the authored default token for (entity,
                         state_bucket); log the miss; the sim never stalls, never sees
                         an invalid token

The strategy token is the ONLY thing that crosses from LLM to sim. It is small (a few enums + floats + short strings), schema-constrained so it cannot be malformed, and validated so it cannot be canon-false, before any deterministic system reads it. §D is the full spine; §2.1–2.4 are the summary each class in §A inherits.

2.1 — Stage 1: the context pack (perfect-precision recall, runtime edition)

recall.py (docs/CANON_INTEGRITY_ARCHITECTURE.md §D) run at runtime instead of cascade time. The build-time recall node CH_34 "all-canon-for-a-node" query becomes a precomputed context pack baked per entity at load, not per frame. A pack is a small frozen struct assembled offline by walking the canon graph outward from the entity node:

• Persona/disposition card — NPCs/bosses from T0_Voice_Registry substrate + T0_Character_Index/T0_Antagonist_Network_Registry; fauna from T0_Creature_Roster.folklore_behavior_substrate + folklore_attribution_source; factions from sector identity + awareness tier. 4–8 terse traits, a speech register, 3–5 authored few-shot exemplar lines.
• Hard-line rule vector — the resolved set of T0_Hard_Lines rows whose applies_to_chapter_range / applies_to_high_care_chapter / applies_to_pipeline touch this entity's chapter+region. Compiled to (a) a prompt preamble and (b) a machine-checkable rule vector for stage 3.
• Fact whitelist — the *only* worldstate/lore facts this entity may reference. Everything not on the whitelist is unknowable to this entity → the persona deflects. This is how a Ch 10 villager cannot leak a Ch 76 reveal: the fact isn't in its pack.
• Action vocabulary (strategic entities — Classes 4/5/6) — the closed, authored legal-goal menu + action-ID library this entity may select from. The emergence lives in *ordering/emphasis*; the *vocabulary* is closed.
• Cultural-care band — high_care/elevated_care flag. Raises fallback bias and tightens the lexical denylist.

Because the pack is precomputed and frozen at entity load, per-frame cost is zero graph work — just prompt assembly from a cached struct whose KV-prefix is cached once. This is the continuo move: do the expensive, must-be-perfect recall once, deterministically, and hand the dumb model a bounded, pre-verified truth slice.

2.2 — Stage 2: constrained generation

• Grammar-constrained decoding (XGrammar on the vLLM/SGLang/TensorRT path; GBNF on llama.cpp) — output *structure* is guaranteed by the decoder: the model cannot emit malformed JSON, an out-of-enum goal/emotion tag, a plan action-ID the sim doesn't implement, or a line over N tokens. This removes an entire failure class (F8) before it can happen, and at <40 µs/token it is now a near-free correctness win (the "constrained decoding is slow" concern is obsolete). Novel improvement over SOTA (§D.2): a per-entity *dynamic canon-vocabulary logit mask* driven by the graph, so two adjacent NPCs decode against different legal-name universes and a hallucinated/retired name is *unsampleable*, not merely validated after the fact.
• Tight token cap — barks 12–20 tokens; ambient ≤40; probe responses ≤80; strategy tokens are a handful of enums + floats. Keep the schema loose on the free-text line field (length-capped only) and strict on structural/enum fields, so the model stays fluent where it performs and is caged only where it must not stray (the "constraint tax" mitigation).
• The prompt is assembled, never player-authored. Player text is a retrieval key + a classified intent, never raw prompt injection: intent-classified to a topic id (small classifier/keyword map) that selects a whitelist slice; raw player text quarantined behind a delimiter, system prompt states it is untrusted.

2.3 — Stage 3: post-generation validation (the deterministic gate — where continuo lives)

lint_canon_graph.py's spirit at runtime: a battery of cheap deterministic checks, ordered fast-and-common first, one fail → fallback. Full V1–V5 + strategy checks in §D.4; the dialogue summary:

1. Denylist / cultural filter — regex + phrase set over the §17.1 forbidden-framing corpus (HL_0005: Vodou-as-zombie, shaman-as-mystical-other, temple-as-trap; joik/songline misuse; slurs). Hard fail, runs first.

2. Hard-line rule-vector check — the machine-readable form of this entity's hard lines (a protected-community line must carry no combat-provocation intent; a pre-Ch-76 entity must not reference Grand-Sage tokens). Hard fail.

3. Canon-graph fact check — every proper noun/named entity must resolve to a node in the entity's whitelist, including the retired-alias reverse index so a hallucinated "Agartha" is caught even though canon says Maatherion. Hard fail.

4. Persona/register check — output language matches language_primary; register keywords present/absent; length in band. Soft fail.

5. Repetition / anti-slop check — reject within edit-distance ε of the last K lines or matching the global slop-phrase set. Soft fail.

For strategic entities, add the §D.4 plan checks (legality, resource-feasibility, lock-state, awareness-consistency). Checks 1–3 (+ legality/lock/awareness) are correctness gates (hard fail → fallback); 4–5 (+ resource/framing) are quality gates (one cheap retry → fallback). Every fail writes {entity, state, prompt_hash, output, failed_check} to the rotating reward corpus (§5).

2.4 — Stage 4: authored fallback (the reward floor)

Every generative slot has a deterministic authored fallback keyed by (entity_id, state_bucket) — for dialogue, a hand-written line bank (3–6 lines, RNG-picked); for strategic entities, the authored default behavior tree/policy for that state bucket. Fallback triggers on any hard-fail, retry-budget exhaustion, or a latency-budget miss. The player never sees a hole, a hang, or a slop line. This is the shippable floor: the local LLM is upside, never a dependency. The sim is already coherent on the authored defaults alone; the LLM is pure upside layered on top.

---

B. On-device inference architecture — sizing, quantization, scheduling, budgets

This section answers the orthogonal engineering question: how the model physically runs — sized, quantized, scheduled, budgeted — alongside a AAA renderer on a player's own PC / Xbox Series / PS5, fully offline. The governing principle is inherited: the local LLM is upside, never a dependency, so every budget below is allowed to *fail its own latency targets* without the player ever seeing a stall — that freedom is what makes an aggressive on-device design shippable.

The continuo §4.2 lesson — *write-time-structured, read-time-cheap* — is also the inference strategy: the largest per-call cost is re-processing a long context prompt every time, so the persona card / hard-line preamble / fact whitelist are frozen per entity at load and their KV-cache prefix computed once, leaving the runtime call to decode only a 12–80 token variable tail. Every technique below specializes that one move: *do the expensive thing once, off the critical path; make the per-frame thing small, bounded, and interruptible.*

B.1 — Model sizing (the tier ladder)

Bigger is a frame-time and VRAM tax the renderer refuses to pay. *Humanity*'s outputs are short, persona-conditioned, and heavily scaffolded by the context pack — a regime where sub-4B models are near-indistinguishable from 8B once the pack carries the persona and the §D validator catches the misses (the ≤4B class closed the quality gap in 2025–26: Qwen3-3B / Phi-4-mini lead the under-4B benchmarks).

Recommendation: ship the 3–4B Q4_K_M as the single canonical target. Author every context pack, fallback, and eval fixture against it. The 0.5–1B is co-loaded as the speculative draft (earns its VRAM twice). The 8B is a PC-only graphics option, never a content dependency — a Series S or base PS5 plays the whole game on the 3–4B tier and loses nothing but prose polish, because the *facts* are all deterministic. Sub-1B fails the anti-slop gate too often to be the baseline; it is the right size for the *draft* role and the low-end ambient floor.

B.2 — Quantization (int4 weights)

Weights: 4-bit, K-quant mixed precision (Q4_K_M) as the shipping default — ~75% memory reduction vs FP16, ~18× CPU throughput, minimal quality loss on short generations; Q5_K_M is the fallback if a specific persona's eval pass-rate regresses at Q4. Use AWQ (activation-aware) for the int4 export — it protects the salient weight channels that carry persona/register, exactly what short style-sensitive outputs are sensitive to.

Format by platform (the console reality forces two packaging paths from one trained model):

• PC (llama.cpp / GGUF): ship GGUF Q4_K_M — mature grammar sampler, trivial prefix-cache control, widest hardware coverage. Reference runtime.
• Xbox Series X/S (Windows ML / DirectML): the console has hardware int8/int4 acceleration (Series X ~49 TOPS int8 / ~97 TOPS int4). Package the same model as an ONNX graph run through Windows ML with a block-int4 (AWQ-style) layout so the int4 units are used — a genuine second export, not a rename.
• PS5 (compute-shader): no dedicated NPU/tensor units — general-purpose RDNA2 GPU compute, which exposes int8 dot-product (V_DOT). Package an int8 (or int4-dequant-to-int8) GEMV compute-shader kernel; PS5 runs closer to the memory-bandwidth wall, so default the PS5 model down to the 1–3B tier and lean harder on precompute/caching. *(Assumption flagged: exact PS5 int4/int8 ML throughput is not publicly specified — validate on devkit.)*

B.3 — The compute reality (memory is the whole game)

An LLM co-resident with a AAA renderer is memory-bandwidth-bound, not FLOP-bound — inference speed is gated by how fast weights stream from VRAM, and the renderer is saturating the same bus. This drives every other decision (small model, int4 weights, prefix cache, off-thread scheduling, batching). Consoles are unified-memory: Series X 16 GB GDDR6 (10 GB @ 560 GB/s + 6 GB @ 336 GB/s); PS5 16 GB @ 448 GB/s — shared across CPU/GPU/LLM, no separate pool to hide in.

Proposed inference-layer memory budget (16 GB shared console class):

Compute placement: NPU (Copilot+ PCs, Ryzen AI, future consoles) is ideal — runs the LLM without touching the GPU's bandwidth; treat as a bonus, never a requirement. Xbox ML units via Windows ML (the int4 TOPS are real). Otherwise the LLM shares the GPU with the renderer and the mitigation is entirely in scheduling (§4-sched): a low-priority async compute queue in the gaps, never holding the queue during the render-critical window.

B.4 — The strategic tick (scheduling off the render critical path)

The LLM lives on its own async worker, decoupled from the render/sim tick, on a slow clock. This is what physically enforces Josh's hard line.

 RENDER/SIM THREAD (16.6 ms @ 60fps)  ── owns all mechanics, deterministic
        │  posts request  │ polls result mailbox (non-blocking)
        ▼                 ▲
 STRATEGIC TICK (async worker, ~2–10 Hz, low-prio async-compute queue)
        │  builds prompt from frozen pack → constrained decode → validate
        ▼
   result mailbox (double-buffered; render thread reads last completed only)

The render thread never blocks on the LLM — it posts and polls; if the answer isn't ready, it uses last frame's token or the authored fallback. Generated output is a pure output leaf with no write path into the sim, so a late or dropped generation *cannot* stall a mechanic, by construction. On GPU-shared platforms, submit inference on a low-priority async compute queue so the graphics queue preempts it; a strategic tick spilling across several frames is fine (the mailbox tolerates it).

Latency budgets by output class (soft P99 → hard cap → action on miss):

B.5 — Latency & throughput budget (the arithmetic)

The budget must survive a worst-case moment — a boss + several adds + an ambient crowd all wanting lines in the same second — via two levers: short outputs and batching. Per-call (3B Q4, GPU-shared, illustrative): prefill ~0 (persona preamble prefix-cached) + the small variable head; decode of a 12–20-token bark at a conservative 40 tok/s shared-GPU is ~300–500 ms single-stream — *over* the 120 ms soft target, which is why single-stream is never the runtime path. Batching (§B.7) + speculative decode (§B.6) pull the *effective* per-line latency under budget; anything that still misses hits the authored floor, invisibly.

Throughput target: sustain the aggregate line rate of a busy scene, not minimize any single call. Design target: ~8–15 completed generations/second across all entities on the baseline console tier, via micro-batching concurrent requests into one forward pass + pre-warming ambient during idle. The architecture wins by (a) making most calls free (cache hits), (b) batching the rest so the fixed weight-streaming cost amortizes across many entities, (c) having a floor. Remove any one and the budget breaks.

B.6 — Speculative / draft-model decoding

The single highest-leverage latency technique for this workload — short, grammar-constrained outputs are exactly the regime where a tiny draft model's guesses are accepted at a high rate (2025 production spec-decode: 2–3× decode speedup, quality unchanged). Draft = the 0.5–1B tier model; target = the 3B. On our short grammar-shaped outputs, acceptance is high → the 3B often emits a full bark in ~2–3 verification passes instead of 15–20 sequential decodes. Prefix-injected drafting (DFlash-style) composes with our precomputed prefix cache; grammar-aware speculation prunes the draft's proposals to structurally-valid tokens before verification, raising acceptance further. On the tightest PS5 tier where the draft's extra ~0.4 GB is too costly, drop speculation and rely on the 1–3B model's raw speed + heavier caching — speculation is an accelerator, not a dependency.

B.7 — Batching + KV/prefix caching (the continuo core, in silicon)

One shared model instance serves every entity; persona differences come entirely from the context pack — that single decision is what makes batching possible: a boss, its adds, and the ambient crowd are the same model with different prompts, so their requests batch into one forward pass and the bandwidth-bound weight-streaming cost is paid once for the whole batch. Priority micro-batch queue (combat bark > player probe > ambient > background disposition); continuous batching (entities finishing early release their slot mid-batch); selective operation batching to handle the ragged-tensor caveat from speculative decode.

Three cache layers, most-to-least precomputed: (1) frozen persona prefix cache — each entity's persona card + hard-line preamble + few-shots is a fixed prefix whose KV cache is computed once at entity load and frozen, dropping prefill to near-zero (the biggest single lever); (2) response cache per (entity, state_bucket) — ambient/idle lines pre-generated during low load, so a crowd draws pre-warmed lines from cache, capped + LRU-evicted; (3) live KV pool — paged (PagedAttention-style), capped at the §B.3 budget, evicted the instant a generation completes. Seed the sampler from (worldseed, entity_id, event_counter) so a replay/speedrun reproduces the exact lines and the response cache is content-addressed by that seed — a cache hit *is* deterministic reproduction.

B.8 — LoRA / adapters (personas from the pack, not per-character fine-tunes)

Do NOT ship a LoRA per persona at launch — persona differences come entirely from the context pack; per-character adapters would be an unmanageable authoring/QA surface, and the pack + few-shots already carry persona at this output length (continuo §4.5 M5: data over code). Where a small LoRA *is* justified: a single always-on game-voice LoRA trained on the 30M-word prose corpus so the base model's default register *is* the game's literary voice (strengthening the anti-slop gate at the model level); optionally 3–5 broad register adapters (archaic/formal, folk/vernacular, antagonist-menace) selected by the pack's speech_register. If per-persona adapters are ever wanted ([DECISION NEEDED - JOSH]), 2025 multi-LoRA serving (S-LoRA / Punica SGMV) hot-swaps adapters in ms during active batching, so it would not break the single-instance/batching architecture — but it is explicitly not the launch design.

B.9 — Graceful degradation (the authored floor as a hardware tier)

The architecture is safe to run aggressively *because* it degrades to authored content, never to a stall. A declared, tiered ladder auto-detected at launch by a VRAM/NPU probe:

Key property: because the model owns zero facts, *every* tier plays the identical, canon-correct game. Degradation removes only prose variety, never content, correctness, or a single point of progression. A Series S player and an RTX-4090 player fight the same boss with the same tells and the same win condition; one just hears more varied taunts. This is the design's core safety guarantee restated as a hardware policy.

B.10 — Recommended baseline configuration (the one-line pin)

Ship a single 3–4B model (Qwen3-3B / Phi-4-mini class), Q4_K_M on the GGUF/PC path and block-int4 ONNX via Windows ML on Xbox, int8 compute-shader on PS5 (PS5 defaulting down to 1–3B pending devkit profiling). One shared instance, personas as context-pack data (plus one always-on game-voice register LoRA), no per-character adapters. A 0.5–1B draft model for speculative decode. XGrammar/GBNF constrained decoding for guaranteed-valid short JSON. Frozen per-entity persona prefix-cache + (entity, state_bucket) response cache filled speculatively at idle. Priority micro-batching on a 2–10 Hz strategic-tick async worker on a low-priority compute queue, off the render critical path, double-buffered mailbox to the render thread. Budget ~3.0–3.6 GB of the shared 16 GB console pool. Every output class has an authored fallback; a latency miss, hard-fail, or low-end hardware degrades to authored content, never to a stall. Seedable sampler for replay/speedrun determinism; fully offline, no network, no telemetry required.

---

3. AAA runtime constraints (the budget the design lives inside)

The layer must be invisible, offline, deterministic-where-needed, and never the reason a frame drops. (Superseded in engineering detail by §B; retained here as the top-level contract.)

• Latency budget per class. Barks/reactions ≤120 ms P99 soft, hard cap 250 ms → fallback; ambient ≤300 ms (pre-generatable during idle); probe ≤700 ms with a "thinking" beat. Combat generation runs off the render thread; a missed bark drops to authored, never stalls combat.
• Model size / VRAM. 3–8B quantized, 2–5 GB VRAM, co-resident, one shared instance; persona differences from the context pack, not per-character fine-tunes.
• Batching + scheduling. Single inference server batches concurrent requests; priority queue combat > probe > ambient; ambient speculative/pre-warmed and cached; KV-cache the frozen persona preamble (prefix caching).
• Determinism where needed. The sim is fully deterministic (§1.1); generative output is cosmetic and seedable from (worldseed, entity_id, event_counter); a "deterministic text" / accessibility mode forces authored-fallback-only. Generated output never feeds back into sim state — a pure output leaf.
• No game-breaking outputs. Grammar decode + the §2.3 gate + authored fallback means the worst reachable output is a safe authored token/line. Generated output has no write path into the sim (enforced by API surface, not policy).
• Fully offline. Model, graph, packs, validator, fallback bank ship with the game. No network, no cloud, no telemetry required; the runtime log is local-only.

---

4. How this makes them feel ALIVE and novel (without slop)

The novelty is not "an LLM is in the game." It is generative texture rendered over a deterministic truth spine the player can trust — the model reacts to the *actual* fight/world state so it feels aware, and it can never lie, so the world stays coherent.

• Bosses that read you. The bark generator is fed the deterministic AI's *real* next-move intent and your recent death-cause. A boss can needle the exact mistake you keep making — "you always roll left" — because the sim *told* the model you roll left. Genuine adaptivity, safe because the tactical fact came from the sim, not the model's imagination. No two players hear the same boss.
• Fauna with a folklore-true inner life. A creature's flavor is generated from its primary-sourced substrate (HL_0002) over the behavior-tree state the sim already chose. It behaves deterministically but *reads* differently every encounter, always faithful to the culture it's drawn from.
• Partners you earn, not configure. A companion's fighting *style* (a bounded utility bias) and banter shift with your integrity trajectory and shared-scene choices — legible in both words (generated) and combat behavior (deterministic bias).
• A world that schemes. Factions ally, betray, propagandize, and harden against your tactics (§7), while being provably incapable of contradicting a canon fact, hard line, or protected-community discipline.
• Anti-slop as a first-class gate, not a hope. §2.3 check 5 + authored few-shot exemplars set the game's actual 30M-word literary register, pulling the model *toward* the game's voice and *away* from generic-assistant voice.

The difference from typical "AI NPC" demos: those let the model own facts and hope it's right, so they hallucinate and break canon. Here the model owns *zero* facts and the deterministic layer owns *all* of them. The life is real; the lies are impossible.

---

5. Failure/reward-pattern encoding (the continuo core, made concrete)

Continuo's real lesson: enumerate the specific ways the dumb model fails, encode each as a deterministic check, and turn every caught failure into a reward signal that hardens the system. Mapped failure → deterministic catcher → reward:

The reward loop closes exactly like continuo's: every caught failure is written to a local corpus (runtime_generation_log) that (a) grows the authored-fallback bank, (b) grows the denylist/slop sets, and (c) becomes eval fixtures. A nightly/CI offline job replays the logged prompts against candidate model+prompt versions and scores them with the *same deterministic §2.3 checks* — a truth-recall-style metric (fraction passing all gates first-try) directly analogous to continuo's 0.965. You ship a version only when its first-try pass rate clears the bar; the authored fallback guarantees the floor never drops. The system is correct on day one because the deterministic scaffolding — not the model — guarantees canon.

---

C. The living-world simulation layer — deterministic society/environment evolution, LLM-directed strategy

The runtime layer above puts a guardrailed model behind an entity's *speech*; this section extends the same split up one level, to the world's *behavior*. Josh's line — "even societies and environments can change and manipulate" — is a request for a world that *acts*, not just reacts. The continuo answer holds verbatim: the simulation is deterministic; the LLM only ever proposes strategy over a bounded, pre-verified state slice, and every proposal is validated against the canon graph before it can touch a single world-state variable. The novelty is not "an LLM runs the world" — it is *a fully deterministic world-state machine whose long-horizon strategy is authored at runtime by a model structurally incapable of breaking canon.*

C.1 — State variables (the world's deterministic substrate)

Everything the sim evolves already has canon anchors; this layer adds no world canon. It reads/writes the 25 canonical T0_Worldstate_Variables:

• Player-integrity spine: integrity_score (WS_001), integrity_level (WS_002), world_state_current (WS_003), vril_polarity_signature (WS_023). The master input — the world responds to *integrity as a real property*, never to a reputation meter.
• Per-region society state: community_state_per_region (WS_019: recovery_state, last_visit_chapter, accumulated_integrity_signal); antagonist_operational_state_per_region (WS_020: intact_or_exposed, manifestation_type); faction_standing_per_faction (WS_021: standing_value ∈ [-100,+100]).
• Environment field: atmospheric_vril_density_modifier (WS_024, [0.0,2.0]); protected-site responsiveness derives from integrity.
• Locks & convergence: path_lock_in_state (WS_005), convergence_node_state (WS_022). The sim freezes all faction goal-migration that would move path once WS_005 = LOCKED at Ch 65.

Faction taxonomy (from canon, not invented): the seven Inner Council sectors (SECTOR_1_BANKING, _2_EXTRACTION, _3_MILITARY_INDUSTRIAL, _4_PHARMACEUTICAL, _5_MEDIA_INFORMATION, _6_POLITICAL_ACCESS, _7_OCCULT_KNOWLEDGE — registry-verbatim these carry the INNER_COUNCIL_ prefix) + VRIL_STANDALONE + ARCHITECT_ROLE, each operative carrying sector_assignment + awareness_tier (UNAWARE → FAMILY_BRIEFED → FULLY_AWARE → INNER_COUNCIL). Non-antagonist factions (communities, guilds, institutions) are the counter-weight side of WS_021. The sim never adds a sector or community; it evolves the state of the ones canon lists.

[EXTENSION] sim-internal variables (labeled, sim-scoped, NOT world canon, flagged for Josh — CK-style bookkeeping no canon doc specifies; each a [DECISION NEEDED - JOSH]): faction_resource_pool[sector], territory_control_graph, inter_faction_relation[a][b], player_strategy_vector (a rolling histogram of *how* the player dismantles operations — combat vs exposure/journalism vs economic vs environmental-protocol vs diplomacy), faction_goal_current/plan_active[sector]. All are fixed-size current-value stores (continuo discipline: no unbounded append-only logs; the only growing log is the rotating reward corpus).

C.2 — The tick model (three clocks, three altitudes)

The load-bearing performance decision and the answer to Josh's hard line: the sim ticks deterministically; the LLM is invoked only at coarse, off-critical-path cadence and never inside a tick — continuo's "write-time-structured, read-time-cheap" reshaped to *decide-time-rare, execute-time-cheap.*

  FRAME  (per render frame)      — NO sim, NO model. Present the current world-state field
                                   (vril VFX, NPC posture, community recovery visuals). Read-only.

  SIM TICK (coarse: per in-world  — DETERMINISTIC ONLY. Advance economy/territory ledgers, apply
   day / per chapter-beat)          active faction plans one step, resolve consequences, recompute
                                     WS_019/020, update WS_021, couple integrity→WS_024. Fixed-cost,
                                     seedable, no model call.

  STRATEGY TICK (rare: per         — LLM STRATEGIC layer, off-thread, budgeted, §D-validated. For each
   region-arrival / era-shift /      faction whose situation changed materially: propose goal + disposition
   material-pressure event)          + plan sketch + negotiation/propaganda stance + alliance/betrayal
                                     intent. Validate. Commit or fall back to the deterministic default.

The strategy tick fires on events, not a wall clock (region entry, era boundary, an operation exposed past threshold, a material shift in player_strategy_vector). Between ticks — tens of minutes of play apart — the world runs on the last committed plans, fully deterministically. On consumer hardware the shared 3–8B instance is idle during play and wakes only at a region transition or loading beat, where a ≤700 ms budget is invisible; a strategy tick is a handful of short constrained decodes (1–4 factions, not all nine), prefix-cached per sector. Seed from (worldseed, sector_id, strategy_tick_counter) so a save reproduces the world's trajectory; a "deterministic world" mode forces default-policy-only.

C.3 — Canon-safety at world altitude

The strategy-tick loop is the §2/§D sandwich at world scale (SITUATION PACK → STRATEGY GEN → PLAN VALIDATE → DEFAULT POLICY). Stage 2 uses schema-and-enum-constrained decoding: the model emits a goal chosen from an enumerated legal menu and a plan as an ordered list of pre-existing action IDs — it literally cannot name a faction that doesn't exist or an action the sim doesn't implement. The plan validator (§D.4, world edition) adds: legality check, hard-line rule-vector check (Ch 57: no antagonist-family presence → any plan projecting a sector operation into Ch 57 is rejected outright; protected communities: a plan may target the community's *oppressors* per Ruling 5 but never re-frame the protected people as a combat/erasure target), canon-graph entity check (+ alias reverse index), lock-state check (post-Ch-65: no goal migration that re-opens path), awareness-consistency check (an UNAWARE operative cannot plan on knowing the Grand-Sage reveal — the world-scale fact-whitelist), resource-feasibility, framing/tone check (Cassius is *sophisticated, not monstrous*; the Corrupted-path world is *hollowed, not cartoonish*).

The write-path guarantee (structural, not policy): the LLM's output has no direct write access to any world-state variable. It emits a proposal struct; only the validator, on PASS, calls the sim's commit_plan() API; only the deterministic sim tick mutates WS_0xx. A faction cannot set integrity_score, flip a path lock, or expose an operation by *saying* so; it can only propose a plan whose *validated deterministic execution* moves the ledgers.

C.4 — How the player manipulates factions and environments

Five real levers, each grounded in a canon coupling:

• Integrity as the master lever. Sustained generative/corrosive patterns move integrity_score → world_state_current; the world-state matrix then deterministically sets the baseline (Luminous → operations trend exposed, communities recover; Corrupted → operations strengthen, communities damage).
• Tactic choice steers faction adaptation. *How* you dismantle an operation feeds player_strategy_vector. Expose everything through journalism → SECTOR_5_MEDIA counter-propagandizes and extraction sectors go quiet; fight everything → sectors push toward SECTOR_3_MILITARY_INDUSTRIAL hardening. The LLM proposes the re-posture; the sim executes it.
• Economic/territorial attrition. Degrading operations (WS_020) drains faction_resource_pool, shrinking affordable plans, cascading into rivals per inter_faction_relation. Starve SECTOR_2_EXTRACTION → the LLM may propose an *alliance* with SECTOR_1_BANKING, or a rival's *betrayal* moving on the vacuum — emergent, but every actor pre-exists in canon.
• Faction standing & diplomacy. WS_021 is locally real and asymmetric (helping one group can cost you with rivals); it gates NPC reactions, pricing, quest access, and the disposition the LLM may voice.
• Environmental manipulation. (a) Integrity → atmospheric_vril_density_modifier (WS_024) → recharge responsiveness and protected-site response → re-tunes the difficulty dial (density *is* difficulty). (b) The environmental-boss protocol's graduated failure: under-managing a vril-state *feeds the negative manifestation, strengthening it for the Ch 39+ revisit* — persistent world-state the sim carries forward. The environment is a manipulable actor with memory.

Across the arc the accumulation is the payoff: the Ch 59–65 continental revisits let the player *see* the society/environment they shaped — communities recovered or traceably damaged by their own ancient-world choices — earned state, not an authored slideshow.

C.5 — Emergent-but-bounded

CK-grade emergence inside a canon cage, achieved by four structural properties, none relying on the model behaving: (1) the action space is a closed authored library (sequencing/emphasis is open — the emergence; vocabulary is closed — the cage); (2) every proposal is validated before it acts, so the worst reachable outcome is a faction running its deterministic default behavior tree (the sim is already shippable on defaults alone); (3) convergence discipline caps branching (goal-migration is free Ch 2–64, frozen against path-moving change at the Ch 65 lock); (4) emergence is texture, never truth — faction scheming modulates *how intact/exposed/recovering* a region reads and *what a faction tries next*, never a canonical beat or hard-line state (the Architect still contacts at Ch 17; Cassius still resolves at Ch 76). The sim colors the space between the canon anchors; it never moves an anchor.

---

D. The canon-graph guardrail spine (context-pack → constrained-decode → validate → fallback)

This is the safety spine that makes a dumb local model reliable, specified in build-ready detail. It is the same four stages as §2, drawn as the shared machinery every entity class and the world sim run through.

D.1 — Context pack (perfect-precision recall, baked per entity)

Built by recall node <id> at bake time, frozen at load: persona/disposition prior + hard-line rule vector + fact/goal whitelist + retired-alias index + care band, plus action_vocabulary for strategic entities. One shared model, N personas in the packs; per-frame graph work is zero; the pack's KV-prefix is cached once (§B.7). (See §2.1 for the field-by-field composition.)

D.2 — Constrained decoding (three layers, tightest-first) + the novel improvement

Three layers, from strongest guarantee to loosest: (a) JSON-schema/grammar structure (XGrammar/GBNF) — malformed output impossible; (b) enum/ID constraints — goals ∈ the legal menu, plan actions ∈ the existing action library, emotion ∈ enum; (c) length caps per output class. The novel improvement over SOTA (§E claim 1): a per-entity dynamic canon-vocabulary logit mask driven by the graph — the decoder's legal-name universe is the entity's fact whitelist, so two adjacent NPCs decode against *different* name universes and a hallucinated or retired name is unsampleable at the token level, not merely rejected after the fact. This welds the "boss reads you" adaptivity to deterministic truth at the decoder: the model cannot name a tell the sim didn't hand it, or an operative canon doesn't list.

D.3 — Validate (V-checks mapped to build-time gates)

The runtime cousins of lint_canon_graph.py gates, so build-time and runtime enforce the *same* canon from the *same* sources: V1 denylist/cultural ≈ the §17.1 corpus; V2 hard-line rule-vector ≈ G4 (hard-line resolution); V3 canon-graph entity resolution ≈ G1 (retired-name straggler) + G2 (entity resolution); V4 persona/register; V5 anti-slop. For strategic entities add the plan checks: legality (goal ∈ legal menu, action_id exists), lock-state (Ch 65+ freeze), awareness-consistency (the fact-whitelist wall), resource-feasibility, framing/tone. Correctness gates hard-fail → fallback; quality gates get one retry → fallback.

D.4 — Fallback (the shippable floor)

Authored line bank per (entity, state_bucket) for dialogue; authored default behavior tree/policy per (sector/entity, state_bucket) for strategic output. Triggers on any hard-fail, retry exhaustion, or latency miss; logs the miss to the reward corpus (§5). The floor is AAA-quality authored content — the model is pure upside.

D.5 — The write-path guarantee

Structural, not policy: the model emits a typed strategic token / bounded line over an authored vocabulary; a deterministic executor disposes it; the model has no per-frame or state-mutating API verb (F10 prevented by construction). Strategy is still wrapped in the same four-stage sandwich as dialogue. Making illegal states unrepresentable (continuo M7) is the strongest encoding in the whole design.

---

E. Novelty — state of the art, and where *Humanity* is distinct

E.1 — The prior art and what each does NOT solve

• Shadow of Mordor — Nemesis System. Procedural rival memory over a bounded orc roster (deterministic state machine + stitched pre-recorded VO). *Does not solve:* novel language (VO is pre-recorded), any entity class beyond elite rivals, or world-truth (memory is local to the duel, connected to no lore/plot canon). It is memory without meaning — and it is patented (WB, into the mid-2030s).
• F.E.A.R. — GOAP + utility AI. The canonical deterministic-planning baseline: real-time A\*-search over precondition/effect actions produces flanking, cover-using squads. *Does not solve:* anything generative or linguistic — it plans *physical tactics*, not intent, disposition, or speech; the perfect execution layer, a poor authoring layer.
• The Sims / Dwarf Fortress — emergent social simulation. Deep deterministic multi-agent utility sim; behavior emerges from many small systems. *Does not solve:* language — a dwarf *has* a grudge in its data but cannot *tell* you about it; the rich internal state is mechanically present but narratively mute, and there is no authored canon the agents must respect.
• Stanford Generative Agents (Smallville) — LLM-driven believable agents. Memory stream + reflection + planning; rated more believable than humans. *Does not solve:* real-time budget (orders of magnitude too slow), on-device operation (assumes a frontier cloud model), or canon integrity (agents invent facts freely — the feature in a sandbox, a catastrophe in an authored 30M-word story). Thousands of dollars in API calls for 25 agents over a few days.
• Nvidia ACE / Inworld / Convai — shipping LLM-NPC middleware. Speech-to-text → LLM → TTS → facial animation; ACE now has an on-device path (Nemotron-4 4B INT4, ~2 GB) shipped in inZOI. *Does not solve:* canon/hallucination (they give the model authority over what it says, so it drifts — which is why shipping games confine them to ambient/side characters and hand-author plot dialogue); ACE is NVIDIA-locked (breaks Xbox/PS5/AMD), Inworld/Convai are cloud-metered (1–3 s latency, compounding cost). They solve *mouth*, not *mind* and not *truth*.
• Newest on-device / hybrid research (2025–26). On-device SLMs are now viable (Phi-4-mini ~3 GB Q4, Gemma 3, Nemotron-4 4B); the "SLMs for agentic subtasks" thesis; XGrammar constrained decoding (<40 µs/token, schema-valid output guaranteed); and the emerging "LLM-strategist over deterministic-executor" pattern (Real-Time World Crafting's JSON-DSL-into-ECS with harmless fallbacks; hierarchical LLM-meta-controller-over-RL-skills; Vox Deorum's orchestration bus). *What even the newest work does not combine:* pairing on-device SLMs with a formal world-canon truth store as the guardrail (the hybrid papers sandbox the LLM's *structure*, not its *facts*), proven on narrative canon fidelity across a 30M-word corpus, and extended pervasively across every entity class on consumer console hardware, fully offline.

E.2 — The novelty claims *Humanity* can stand behind

1. The world-canon truth-guardrail. The first entity-generation system whose LLM is checked, per output, against a formal canon graph + fact-whitelist + retired-alias index, making a lore/plot contradiction structurally impossible rather than merely unlikely — and, via §D.2's dynamic canon-vocabulary logit mask, hallucinated/retired names are *unsampleable*, not just caught. *(Flagship claim.)*

2. Inverted trust boundary — "the model performs, it never adjudicates." The field gives the LLM authority over facts and hopes; *Humanity* gives it authority over zero facts and lets deterministic code own all of them. This is what makes an LLM safe for a plot-load-bearing entity, not just side chatter.

3. Plot-critical, not side-character. Because facts are guarded, generative life extends to story-critical NPCs and named bosses — the exact class every shipping LLM-NPC system deliberately avoids. A villager who *can't* know the ending is more real than one who might recite it.

4. Pervasive across every entity class on one shared model. Bosses, fauna, crowds, vendors, plot NPCs, factions, and the environment run the same pack→gen→validate→fallback loop — versus Nemesis (rivals only) and ACE (ambient only).

5. AAA-believable at deterministic-sim cost, fully offline on consumer/console hardware. One 3–8B quantized model, ≤120 ms P99 barks off the render thread, prefix-cached personas, seedable for speedruns — no cloud, no per-query bill, no platform lock-in.

6. Anti-slop as a first-class deterministic gate, not a hope. An edit-distance + slop-phrase rejector plus authored few-shots that pull the model toward the game's 30M-word literary register.

7. A self-hardening, day-one-correct loop (continuo, ported to runtime). Every caught failure grows the fallback bank + denylists and becomes an eval fixture; nightly replay scores model versions on a truth-recall-style first-try-pass metric. The system is correct on day one because deterministic scaffolding guarantees canon, and it improves over time without the model ever being the safety dependency.

The one-sentence synthesis: *Humanity* is the first game to make every entity — boss, animal, crowd, plot NPC, faction, and the world itself — generatively alive on a small on-device model that runs fully offline on consumer and console hardware, while a deterministic canon-graph guardrail makes it structurally incapable of contradicting a 30M-word authored world — life that is real because the sim owns it, and truthful because the model owns nothing.

---

F. Staged build plan (plugging into the canon-integrity system + the 5-chapter milestone pipeline)

This layer is not a separate program; it is a tenth engine that rides the 5-chapter milestone pipeline (docs/MILESTONE_BUILD_PIPELINE.md) and consumes the canon-integrity system (docs/CANON_INTEGRITY_ARCHITECTURE.md). It follows the milestone doctrine: *build and prove the engine on a 5-chapter slice, then roll the same proven loop forward.* Nothing here is greenfield — every stage extends an artifact that already exists or is already planned, and where it needs a canon fact not yet authored it consumes it through recall.py or flags [DECISION NEEDED - JOSH], exactly as the cascade does.

F.0 — Dependency preconditions (must land first, in the canon-integrity system)

• harness/recall.py and the recall packs / recall factions exporters (Stage 4 of CANON_INTEGRITY_ARCHITECTURE.md §D/§E) — planned, not yet on disk. The whole guardrail spine consumes them. harness/canon_graph.json (3,118 nodes / 11,974 edges), build_canon_graph.py, lint_canon_graph.py exist today.
• T0_Hard_Lines gains pipeline enum value Runtime so runtime-relevant lines are selectable by the rule-vector compiler.
• The §C.1 [EXTENSION] sim-internal variables and the per-sector legal-goal menu / action library are ratified by Josh (Claude-proposes-adversarially, Josh-approves per the Batch-1 contract) — the emergence/cage boundary.

F.1 — Stage 0: the exporter + validator skeleton (build-time, no model yet)

Extend the harness: recall packs <entity_id> emits a frozen per-entity context-pack file (persona + hard-line rule vector + fact whitelist + care band); recall factions <sector> emits per-sector strategy packs (legal-goal menu + rule vector + territory slice). Stand up the §D.3 validator as a pure function over (token, pack) reusing lint_canon_graph.py gate logic (V2≈G4, V3≈G1+G2). Gate to advance: the validator passes/fails a hand-written fixture set (valid tokens PASS, injected hallucinations/retired-aliases/hard-line violations FAIL) with zero false-negatives on the correctness gates. No model, no runtime cost — this is the guardrail proven in isolation, the continuo "code first" discipline.

F.2 — Stage 1: prove the loop on the milestone slice (Classes 1–3, dialogue only)

On the first 5-chapter milestone slice, wire the four-stage sandwich (§2) for the three read-only-surface classes — ambient NPCs, named characters, fauna — with the recommended 3–4B baseline (§B.10), grammar-constrained decode (§D.2), and authored fallback banks for every (entity, state_bucket) in the slice. Build the runtime_generation_log + the nightly offline replay harness (§5) so the slice yields a first-try-pass-rate number. Gate to advance: on the slice, first-try pass rate clears a set bar; P99 latency budgets (§B.4) hold on the baseline console tier under a scripted worst-case busy scene; zero canon-fidelity escapes in a critic pass. This is the milestone-pipeline's "prove the engine on a slice" applied to the runtime layer.

F.3 — Stage 2: strategic entities (Classes 4–6) on the same slice

Add the strategy-token path for companions (combat-disposition bias), the environment (atmosphere bias + env-boss read), and — the highest-stakes — the faction director (§C). This requires the ratified action vocabulary (F.0) and the world-sim tick engine (§C.2) running deterministically first. Validate the world-scale plan checks (§C.3): Ch 57 director-disabled, protected-community wall, lock-state freeze, awareness-consistency. Gate to advance: the sim is coherent and shippable on the default policies alone (model off) across the slice; with the model on, every plan either validates or falls back with zero hard-line escapes; the Ch 57 / protected-community walls are proven un-crossable by an adversarial red-team fixture set.

F.4 — Stage 3: on-device hardening + the degradation ladder

Port the reference GGUF runtime to the console export paths (§B.2: block-int4 ONNX/Windows ML on Xbox; int8 compute-shader on PS5) and prove the §B.9 degradation ladder end-to-end (each tier plays the identical canon-correct slice; the floor tier runs authored-only with the model never loaded). Stand up speculative decode (§B.6), prefix + response caching (§B.7), and the seedable-sampler determinism path for replay/speedrun. Gate to advance: the slice runs within the ~3.0–3.6 GB inference carve-out on a 16 GB devkit without regressing the renderer's frame budget; a PS5 devkit profile confirms the tier choice (the flagged assumption resolved); a seeded replay reproduces identical output.

F.5 — Stage 4: roll forward 5 chapters at a time

With the engine proven on the slice, each subsequent milestone re-runs the same loop scoped to its nodes: recall packs regenerates packs for the new entities, authored-fallback banks are written alongside VO authoring, gates run scoped to the slice, cost staggers by milestone (only this slice's packs, fixtures, and eval fixtures). The nightly replay harness accumulates a corpus-wide first-try-pass-rate trend; a model+prompt version ships only when it clears the bar, the authored floor guaranteeing shippability regardless. The layer's build cost is thereby amortized across milestones exactly as the pipeline intends, never front-loaded as one bill.

F.6 — Placement in the repo

Sits in the T99-operational tier under T1_Combat_System_Spec + T1_Integrity_Paths_Worldstates_Master (which own the combat and integrity-faction *frameworks*), beside docs/COMBAT_ENCOUNTER_SYSTEM.md, docs/RUNTIME_GUARDRAIL_ARCHITECTURE.md, docs/MILESTONE_BUILD_PIPELINE.md, and docs/CANON_INTEGRITY_ARCHITECTURE.md. It invents no world canon and does not enroll in the authored-canon lint gate; it *consumes* that gate's graph and reuses its gate logic at runtime.

---

6. Buildability + open items (the do-not-invent rule binds)

• Graph + recall already built for build-time. harness/canon_graph.json + the planned harness/recall.py are the same truth store; the runtime layer adds the recall packs / recall factions exporters.
• Hard lines already machine-addressable. T0_Hard_Lines rows carry applies_to_pipeline, applies_to_chapter_range, applies_to_high_care_chapter, severity, cross_reference_array; add pipeline value Runtime.
• Personas already have substrate. T0_Voice_Registry.voice_substrate + T0_Character_Index + T0_Creature_Roster.folklore_behavior_substrate are the persona-card source; fallback few-shots are authored alongside them.
• Validation reuses gate logic + shares the model instance + reuses determinism discipline (§D.3, §B, §3).

Open items for Josh (flagged, not decided)

• [DECISION NEEDED - JOSH] Launch posture per class: proposed bosses/named-antagonists/fauna/companions/factions ON; culturally-high-care Ch 29/42/57 community figures + protected-space speech authored-only at launch (§17.1 posture call, not technical).
• [DECISION NEEDED - JOSH] The strategy-token enums (faction_intent, combat_disposition, atmosphere_intent) + the per-sector legal-goal menu / action library + the protected-community disabled-director list — author now vs derive-from-canon at pack-build. Recommend derive via recall + Josh sign-off; the director never self-canonizes an operative or faction.
• [DECISION NEEDED - JOSH] Ratify the §C.1 [EXTENSION] sim-internal variables as sim-scoped state, or fold any that should be world canon into T0_Worldstate_Variables.
• [DECISION NEEDED - JOSH] Target local model + quant (3B vs 8B) — a playtest/eval call once the §5 pass-rate harness exists; per-persona LoRA is explicitly deferred (§B.8).
• Do-not-invent reminder: any generated name/fact/faction/alliance the design *wants* to keep routes through Josh as [DECISION NEEDED - JOSH]; the runtime never self-canonizes. All absolute numbers (VRAM carve-outs, tok/s, resource caps, standing deltas, tick coefficients) are illustrative shape deferred to the Phase-5M balance audit; the architecture's correctness never depends on hitting a specific number — the authored floor absorbs any miss.

Assumptions flagged (hardware — validate on devkit)

1. PS5 int4/int8 ML throughput not publicly specified; design assumes bandwidth-bound-before-compute-bound on a 3B model → smaller PS5 tier + heavier caching.

2. The ~3.0–3.6 GB inference carve-out on a 16 GB shared console is proposed, not measured; the real number is negotiated against the renderer's VRAM footprint per title (tolerated by dropping to the 1–3B tier).

3. Per-call decode coefficients (40 tok/s shared-GPU) are illustrative; profile under real render-queue contention. Correctness is floor-guaranteed; the ~8–15 gen/s aggregate target should be validated against a worst-case busy scene.

4. Console Windows ML maturity for LLM-shaped ONNX graphs is evolving — the Xbox export path needs a spike before commit.

---

Companion / source docs (all absolute):

• C:\dev\humanity-forgotten\docs\CANON_INTEGRITY_ARCHITECTURE.md (§B canon graph, §C gates, §D recall — the truth store the packs/prefix-cache are built from; recall.py + exporters planned)
• C:\dev\humanity-forgotten\docs\COMBAT_ENCOUNTER_SYSTEM.md (Part B ~30 clocks; §1.3 env-boss protocol; §1.5 integrity-band damage; §6.2 restraint budget; §4.9 Sigma-bounded adaptation; §9 vril-density dial)
• C:\dev\humanity-forgotten\docs\MILESTONE_BUILD_PIPELINE.md (the 5-chapter milestone model + 9 engines — this layer is the tenth, riding the same slice-then-roll loop)
• C:\dev\humanity-forgotten\docs\RUNTIME_GUARDRAIL_ARCHITECTURE.md (the guardrail-spine companion — this doc fixes *what* the model may emit; that one details the deterministic guardrail)
• C:\dev\humanity-forgotten\_source\01_Tier_1_Foundation\T1_Integrity_Paths_Worldstates_Master [ACTIVE v2.1].md (§2–§9: integrity bands, world-state matrix, faction-standing §8.7, per-region accumulation, protected-site response §8.6, convergence/lock §3.4–3.5)
• C:\dev\humanity-forgotten\docs\proposals\DIFFICULTY_SYSTEM.md (RULED — vril-density dial, never HP inflation; multi-channel readability)
• C:\dev\continuo\CLAUDE.md (§4.2 write-time-structured/read-time-cheap; §4.4 hard budgets; §4.5 data-over-code; §4.6 cite-or-drop; §4.11 self-contained offline; M1/M4/M7 — the dumb-LLM-in-deterministic-code precedent, 0.965 truth-recall)

---

Returned above is the full enhanced document body for docs/RUNTIME_GENERATIVE_LAYER.md. It is the v1 draft (thesis / split / guardrail loop / AAA constraints / F1–F10 / buildability, all preserved) enhanced with six new lettered sections synthesized from the five input streams: A (entity taxonomy + the deterministic/LLM-strategic split for all six classes, with per-class strategy token, tick, executor, and manipulation mechanic + the at-a-glance table), B (on-device inference architecture — sizing ladder, int4/AWQ quant + per-platform packaging, the memory-bound compute reality with a concrete ~3.0–3.6 GB budget, off-critical-path scheduling, latency/throughput arithmetic, speculative decode, batching + prefix/response caching, LoRA posture, the graceful-degradation ladder, and the one-line baseline pin), C (the living-world societies/environments simulation layer — deterministic substrate, three-clock tick model, world-scale canon-safety, five player-manipulation levers, emergent-but-bounded), D (the canon-graph guardrail spine with the novel per-entity dynamic canon-vocabulary logit mask), E (state-of-the-art survey vs Nemesis/F.E.A.R./Sims-DF/Generative-Agents/ACE/newest-research + seven defensible novelty claims), and F (a staged build plan F.0–F.6 that plugs into the canon-integrity system and rides the 5-chapter milestone pipeline as a tenth engine). It is deterministic-first, LLM-strategic-only, consumer-hardware/offline, novel, and canon-safe; it invents no world canon and flags every enum, roster, extension variable, and coefficient as a [DECISION NEEDED - JOSH] proposal shape. Verified on disk: harness/canon_graph.json = 3,118 nodes / 11,974 edges; docs/MILESTONE_BUILD_PIPELINE.md (5-chapter model, 9 engines) and the referenced companion docs all exist.

---

DIRECTIVES FOLDED IN (Josh rulings 2026-07-04, post-dating the design workflow)

These ratify/extend the design above. Where they touch a number the workflow left open, they close it.

Hardware — RULED: on-device only, 2030 next-gen

• NO cloud tier, ever. Works fully offline forever (the /dev/continuo self-contained doctrine).
• Ship window ~2030, next-gen PC/console NPUs. Target a 28-32B local model at low latency (feasible

on 2030 hardware); dev/test on the local 14B now. The strategy-token architecture is model-size-

agnostic — a larger model emits richer tokens through the identical guardrail sandwich, so scaling the

model up is a quality dial, not an architecture change. Tier DOWN to min-spec via smaller distilled models

• a larger authored-fallback surface; the deterministic sim is always fully playable with zero model.

Nemesis-class system — our architecture + patent differentiation (FLAGGED FOR IP COUNSEL)

The WB Nemesis PATENT claims a specific three-part chain: (1) a procedurally-generated enemy HIERARCHY with

promotions, (2) procedural MEMORY of specific player encounters, (3) dynamic RELATIONSHIPS between the

enemies. Bypass games each sacrifice ONE link (XCOM 2 Chosen = handcrafted, not procedural; Warframe Liches

= fixed to player choice, not a dynamic background hierarchy; AC Odyssey mercenaries = infinite hierarchy but

no battle-memory / inter-enemy relationships). **Humanity does not break a link — it replaces the engine

with a different MECHANISM:**

• Hierarchy = a deterministic FACTION/SOCIETY simulation (Velheim network + communities + guilds:

reputation, resources, territory) — not a procedurally-templated combat-orc ladder.

• Memory = the persistent canon/world-state GRAPH (the runtime extension of harness/canon_graph). Every

entity, faction, AND place carries real state + history, semantically (fortresses remember your entrances;

people remember the theft) — not scripted per-orc flags.

• Relationships = LLM-STRATEGY-TOKEN-reasoned grudges/alliances/betrayals, grounded + validated by the

graph — not template-slotted rules.

• Beyond all three: pervasive across ALL entities + societies + environments + ecology; reasons-not-

buffs at higher difficulty.

Posture: same-or-superior experience via a genuinely different technical method (LLM-strategy-token over

a canon/world-state graph vs procedural templates), applied to a far broader system — the strongest IP

footing. **CAVEAT: this documents the differentiation; final patent-infringement clearance is Josh's IP

counsel, not this design.**

Persistent memory + difficulty-as-intelligence — RULED

• Memory is BOTH per-named-individual (Nemesis-style rivals who remember specific encounters) AND per-

settlement/faction aggregate. It persists per playthrough and carries a distilled reputation echo into

NG+ / The Forgotten One (the prestige world remembers the one it forgot).

• Higher difficulty = thinner vril for the player AND smarter antagonists (deeper strategic reasoning,

longer faction memory, better use of the player's tells) — "smarter, not bigger numbers," scaling with the

vril-density tier (Wellspring naive -> The Forgotten One cunning). NEVER stat-buffs.

Living ecology + the immune set — RULED (never soft-lock)

• Over-gathering / over-hunting one area degrades it -> resources/fauna MIGRATE elsewhere -> the area

REGROWS over time (tunable per-resource). The world reacts and feels alive.

• HARD RULE: anything that gates an achievement, progression, or 100% completion is tagged

progression_critical on the canon graph = IMMUNE (never depletes/migrates/vanishes): legendary-weapon

materials, quest-gate resources, unique NPCs. Everything else is simulatable. The sim can never produce

a state where the story is not progressable.

Replayability — RULED first-class

Replayability BECAUSE reactive: persistent memory + ecology + faction sim + LLM-strategy variance make every

playthrough diverge. The 30M-word authored spine is the invariant; the reactive layer varies the texture

around it. This is a design DRIVER, not a bolt-on.

Dev/test path

Validate the strategy-token loop + the 4-stage guardrail NOW on the local 14B (proves the mechanism before

2030 hardware). SHARED-RESOURCE CAUTION: that same 14B runs Continuo's harness simulations — check for a

concurrent Continuo session before launching a local-LLM test run; do not contend for the GPU.

---

STRENGTHENING DIRECTIVES — Opus review, folded 2026-07-04

The architecture STANDS (deterministic-first, model-owns-zero-facts, the F10 structural write-path

guarantee, the dynamic canon-vocab logit mask, the authored floor). These are NOT blockers — each converts

a review finding into a work-item or an evidence gate riding the existing F.0-F.6 milestone structure + the

authored floor. Through-line: the design already guarantees the model can't LIE; these make it measurably

ALIVE, reliable where it matters most, and honest about proven-vs-projected numbers.

RULED — 14B is the reference; model size is a quality dial

Collapse the 3-4B and the 28-32B targets onto one anchor:

• 14B = the reference/ship target — dev-tests on the local 14B today AND runs on 2030 next-gen. 14B

Q4_K_M ~8-9 GB weights: co-resides with a AAA renderer on a high-VRAM PC today + on 2030 next-gen

unified-memory consoles. Does NOT fit a 2024 16 GB base console beside a ~12.5 GB renderer -> min-spec tier.

• Tier ladder anchored on 14B: 3-4B = min-spec degradation tier (2024 base consoles, entry PC);

14B = reference (high-VRAM PC today, next-gen console 2030); 28-32B = optional prestige if 2030 HW

allows, NEVER a content dependency.

• ACTION: re-derive §B's budget (VRAM carve-out, KV pool, tok/s, batch math) for the **14B reference

case** as canonical; relabel the 3-4B numbers as min-spec. Update §B.1/§B.3/§B.9/§B.10 + the hardware

directive. Numbers stay illustrative-shape pending the Phase-5M balance audit.

• Consequence 1 (latency): 14B single-call latency > 3B, so the combat-bark PRE-WARM below is

LOAD-BEARING, not optional — the live-decode path cannot hit the 120 ms combat budget at 14B.

• Consequence 2 (quality): 14B holds literary register better than 3B -> the alive layer more likely

clears its quality bar at the reference tier; the 3-4B min-spec tier leans harder on the authored floor.

ENHANCE §5 — measure ALIVENESS, not just safety (the deepest gap)

§5 scores model versions on first-try pass rate against §2.3 gates — all correctness/safety checks. A model

can pass all of them and be FLAT; optimizing pass-rate alone Goodharts toward safe-and-boring.

• Add a second eval axis: a vividness/quality score distinct from correctness pass-rate. A version ships

only when it clears BOTH the correctness bar AND the quality bar.

• Quality signal, cheap: train a small learned preference model on the graded exemplars

(docs/proposals/exemplars/ Ch 3/42/43) + the authored 30M-word prose as positive class; supplement with

periodic SAMPLED human A/B on slice fixtures (not per-run).

• Plug into F.2: the slice's first-try-pass number gains a paired vividness number; both must clear.
• Frame: continuo gave truth-recall (correctness w/ ground truth); this adds liveliness-recall.

ENHANCE §2.3 + §B.8 — promote the register LoRA; learn the slop gate

§2.3 check 5 (edit-distance + slop-phrase set) catches repetition/known tics but not distributional

"generic-assistant voice." The real lever is the game-voice register LoRA (§B.8), currently deferred.

• Promote the game-voice register LoRA to a Stage-1 (F.2) deliverable. Train on the 30M-word corpus

(seed from the exemplar-graded subset); prove on the slice. Whether 14B + register-LoRA holds literary

voice at 12-80-token outputs is a GO/NO-GO for the whole alive layer — learn it early on the slice.

• Make §2.3 check 5 distributional: add the §5 preference model (inverted) as a learned slop classifier

alongside the phrase-list. One instrument, two uses (vividness score + slop gate).

ENHANCE §A.1 / §B.4 / §B.7 — pre-warm the flagship off the live path (REQUIRED at 14B)

A boss bark that "reads you" is a hot, single, low-latency call fired mid-combat (GPU most contended) — the

marquee moment most likely to fall back to authored exactly when most wanted. At 14B this is guaranteed on

the live path.

• Add combat-bark speculative PRE-WARM. The boss's next-move intent is deterministic + telegraphed

~1-2 s ahead. During the wind-up, pre-generate the intent-conditioned bark(s) keyed on (phase,

likely-next-intent, known player tell) into the (entity, state_bucket) response cache -> CACHE HIT when

the intent fires, not a live decode. Extends the §A.1 ambient speculative-pre-warm primitive to the

hottest class. Add the rule to §A.1's cousin + §B.7 cache layer 2; budget in §B.4/§B.5.

• Gate (F.2): "adaptive combat barks served from cache >= [target]% under the scripted worst-case busy

scene." Moves the flagship off best-effort onto reliable.

ENHANCE §C + F.3 — make the faction director EARN its complexity with evidence

§C is the densest engineering + carries the most validation, yet F.3's gate says the world sim is coherent

• shippable on default policies with the model OFF. Players observe factions at low density; Class 5 may be

highest-canon-risk / lowest-perceived-ROI.

• Gate continued §C investment on a perceptibility A/B at F.3: run the slice with (a) LLM-director ON

vs (b) utility-AI-weights-only; measure whether playtesters perceive a difference. Keep §C sequenced last.

• Contingency: if not perceptible at slice density, ship the deterministic faction sim (F.3 proves it

shippable) + thin/defer the LLM-director, reallocating engineering to the dialogue classes where

aliveness is most felt. The deterministic sim is the floor; the LLM-director is upside that must prove it.

RULED — smaller closes

• Replay/speedrun determinism: replay = cache-hit reproduction OR forced authored-fallback

("deterministic text mode"), NOT bitwise-identical regenerated text (continuous batching + batched-matmul

FP non-associativity make same-seed-same-logits unachievable across batch/HW/driver). Soften the §B.10

claim; deterministic-text-mode is the canonical speedrun/verification mode.

• Platform parity: state the tier PER PLATFORM in §B.9 — PS5-2024 + base consoles run the 3-4B min-spec

tier (no NPU, bandwidth-bound); the 14B reference targets high-VRAM PC + 2030 next-gen. Platform-parity-

of-experience is a conscious devkit-gated decision; the floor guarantees correctness on every tier, only

prose variety differs.

• Offline improvement corpus: offline-forever caps the §5 reward corpus to playtest/QA prompts (no field

telemetry) — deliberate (privacy, no per-query cost, no lock-in), stays default. Compensate by making the

QA corpus deliberately adversarial + broad (red-team fixtures feeding §5). An optional future opt-in

telemetry tier could enrich the loop without breaking the offline default — FLAGGED, not adopted.

Net

2 pure additions (vividness metric, combat pre-warm), 2 evidence gates (register-LoRA go/no-go, faction A/B),

1 number closed (14B ladder), 3 honest re-labels (replay, platform, offline). All ride F.0-F.6 + the

authored floor; none is a blocker — the design ships on defaults regardless.

Generated by harness/site/structure_site.py — the URL path is the repo path. review root