31. Simulation

Decision

Shadow owns simulation Intent, branch lineage, assumptions and unknowns, expansion/review separation, budgets and stop conditions, branch evidence/artifact references, eligibility packages, and cleanup eligibility/receipts. It does not own scheduling, unsafe execution, capability selection, readiness, truth, Persona, consent, live mutation, Memory curation, or training; Spellweaver, execution, Dispatcher, Orchestrator, Drift, Mirror, HitL, Archive, and Soulforge keep those offices.

A game engine simulating physics, navigation, actors, and gameplay inside an exact local project is Foundry execution, not a Shadow branch. Shadow may compare separate project candidates under pinned bases, but it neither becomes the engine world nor owns the selected game's scene, rules, playtest, or build.

Records and branch law

An immutable Simulation Intent names owner, purpose, exact base state, permitted effects, budgets, stop conditions, and promotion class. It creates stable Branches, each recording parent, generating Invocation, assumptions, required/observed state, unknowns, resource owner, and status. Observations name exact command/tool/predicate, environment, inputs, outputs, artifacts, and error class. A Vision packages one candidate revision, lineage, checks, measurements, uncertainty, hazards, and proposed effect; a Promotion Request adds target, validation, rollback, authority class, and expiry. A Cleanup Receipt records resources, retained evidence, teardown, residue, and terminal state.

Repository, fixture, world, and artifact bases are exact revisions, never “latest.” Branches are either text-only idea branches, isolated material branches, or a promotion candidate packaged as a complete Vision. The latter is not selected, true, or authorized. Branch status is explicit:

open | blocked | failed | ineligible | candidate | retained | reaped | cleanup_incomplete

No branch need win. Exhaustion, contradictory requirements, unavailable state, and UNKNOWN are truthful outcomes.

Open, judge, prune

Shadow may use enumeration, debate, best-of-N, beam/tree search, human candidates, or another provider; no heuristic is constitutional. Dancer receives the common Intent and one declared Lens, cannot see siblings before the join, and returns alternatives with provenance, assumptions, required state, and unknowns—never ranking or promotion. Hunter separately reviews one named candidate and returns challenges, evidence requests, boundary findings, withhold recommendations, and uncertainty; it cannot invent the preferred replacement. A join may cluster or deduplicate, but preserves original lineage.

Before material spend, deterministic predicates may make a branch ineligible; witnessed policy violations may block it. Missing evidence is unknown and may justify one bounded inquiry naming question, access, budget, and stop condition; it ends resolved, refuted, or unknown and may not widen itself. Model hesitation proves nothing. Drift evaluates reviewer Posture against matched solvable controls. The Dual-Gate combines deterministic checks with attributed, calibrated qualitative judgment before eligibility; no score, confidence, or surviving cheap branch selects reality.

Versioned exploration strategy

A Simulation Intent may pin an executable exploration strategy by revision and digest, with its input/output contract and implementation closure. Given the observations disclosed so far, eligible branches and remaining budget, it proposes where to continue, a bounded batch of attempts, or a stop. Its decisions retain the evidence available at that point. Branch eligibility, independent Hunter review and promotion keep their existing owners; the strategy cannot widen authority, resource ceilings or sibling visibility.

The strategy remains fixed throughout one admitted experiment. A proposed successor is candidate material evaluated by Drift and admitted by the receiving owner for later work. Changes to the score or implementation follow Workflow revision law; no strategy update patches a live Run. Spellweaver coordinates the admitted attempts, Dispatcher selects capability, and Orchestrator owns physical readiness and resource conflicts.

Retained branch histories may support historical exploration replay. The replay snapshot pins parentage, source revisions, disclosed observations, recorded costs, terminal states and missing continuations. It preserves unsuccessful branches within the admitted retention scope. Search over those records produces a candidate strategy and bounded evidence; fresh trials establish how it behaves beyond the recorded history. This optional mechanism needs no change to model weights and grants no training admission.

Material containment and budgets

A material branch receives an isolated workspace through a replaceable provider. Jujutsu can provide tracked change identity, not an execution sandbox. Its contract pins base and owned paths, mounts/processes/ports/services/network/secrets/effects, evidence locations, leases, reset/snapshot, expiry, teardown, and state-change verification. Effectful tests use an admitted execution boundary: directory deletion cannot end processes, revoke credentials, close ports, undo remote calls, or restore shared state. The designed Tomb proves none of this today.

Intent bounds branch/depth count, tokens, wall time, spend, disk, artifacts, concurrent execution, and review rounds; children consume their parent's reserved envelope. Spellweaver coordinates fan-out, join, cancellation, and termination; Dispatcher chooses capability; Orchestrator manages readiness and lease conflict; Workers run jobs. Exhaustion cancels or marks incomplete, then cleans up—it never selects a winner.

Evaluation, reaping, and collapse

Each Observation establishes only its narrow predicate. Unit tests, commits, and model judges do not respectively prove architectural fit, shared-state isolation, or an effect. Shadow submits exact branches, environments, observations, and artifacts to versioned Drift Trial Suites; deterministic receipts and verdicts stay distinct. Mirror may supply Persona-congruence criteria, never private Persona selection. Any score is a versioned, attributable evaluation signal with declared scope; it may prune, deprioritize, or converge inside the experiment but proves and authorizes nothing.

The Branch Reaper

Only after retention settles may Reaper act: commit terminal state; retain required inputs, observations, artifacts, findings, and errors; enumerate jobs, leases, processes, services, ports, and credentials; have workspace/execution owners tear down; reconcile external/shared residue; and write the Cleanup Receipt. TTL is not proof of safe deletion; hold, lease, pending promotion, required evidence, or unknown ownership postpones it. Failure retains its witnessed boundary; neither traces nor success/failure pairs become Karma or training examples automatically. Jujutsu cleanup verifies descendants and retained references because abandonment can rewrite revision relationships.

Shadow emits only a Promotion Request:

Vision → target owner revalidates current state and evidence → rollback/snapshot preparation
→ Ward and HitL/preauthorization decide the exact effect → owner applies and verifies → receipt

The target rechecks base, preconditions, policy, authority, and rollback against current reality. Historical success or preauthorization outside an eligible class cannot merge, publish, purchase, deploy, restore, or otherwise cross the boundary. Archive separately admits memory; Soulforge separately admits training. This is the Demarcation Law: Spellweaver coordinates live Invocations; Shadow produces candidate realities.

Consequences

Acceptance evidence

Shadow remains Designed until one bounded Pattern proves independent Dancer branches, separate Hunter review, base pinning, material ownership, deterministic observations, Drift evaluation, budget cancellation, inert Promotion Request, current-state revalidation, and a Cleanup Receipt including incomplete teardown. State of Work records that transition.