settled-reach/docs/workshops/body-map-viewer/tyre-round2.md

title, description, type, status, workshop, created

title	description	type	status	workshop	created
Body Map Viewer — Tyre's Round 2 Synthesis	Final amendment texts (record-ready), tagged-envelope governance disposition, step-ladder tables, and the deprecation-sweep draft (Expected Output 2)	workshop	active	body-map-viewer	2026-07-25

Tyre — Round 2 Synthesis

cracks knuckles — interview 1 upheld both my load-bearing round-1 calls (gridunit snaps to D-243; cliffs Phase-4) and added two rulings I now fold in: the map-time TTL-split with the storage/staleness axes distinction (Jeroen's new eviction amendment), and cliffs as a sparse CliffSegment feature list (aligning my round-1 "new fields, not stolen bits" text with Araminta's sparse shape and Jeroen's ruling). This document is the filing package: paste §(a) into governance/decisions/architecture.md with only ID-claiming left, run the §(d) sweep at wrap-up.

Four sections, in the coordinator's order: (a) final amendment texts, (b) envelope mechanics + the ceiling-rule disposition (with Dudley on wire/serving), (c) step-ladder tables (with Dudley on costs), (d) deprecation-sweep draft.

---

(a) AMENDMENT TEXTS — FINAL, record-ready

These incorporate every interview-1 ruling. Each is written to paste directly into the named record. A new D-record (the body-map-viewer render architecture) is claimed separately at filing — these are the amendments to existing records; the new-record text lives at the end of this section as §(a.0) so the whole package is in one place.

(a.0) NEW RECORD — body-map-viewer render architecture (claim a D-id at filing)

D-NNN — Body-map-viewer stepped render architecture (supersedes the T-1143 continuous-ladder mechanism). Claimed [date]. Domain: architecture.

• Decision: The Atlas map handler is rebuilt on three locked premises: (1) content determination is server-side — the CPU/Rust server answers "what is at this world coordinate at this zoom step" as a per-step data canvas; the client never invents geometry. (2) The client is a map-art function — it colorizes, styles, and annotates the server's canvas via a render-to-texture terrain layer (texel-exact, drawn at the display ratio) + an unscaled screen-space sibling layer for vector annotations. (3) Zoom is stepped — discrete gridunit-spacing levels, one server-canvas fetch per crossed step boundary, cursor-anchored, with edge-scroll pan and a hard full-zoom-out reset to the canonical Global (rung-0) body-surface frame.
• The step ladder is six levels — the Global map opener (rung 0) plus five fixed metre rungs (Dudley's Option D, every fixed rung measured): Global (rung 0, body-surface view) → Region (204.8 km, rung 1) → District (2,048 m, rung 2) → Quarter (512 m, rung 3) → Block (128 m, rung 4) → Chunk (64 m, rung 5, deepest). Rung 0 (Global) is the map opener and is variable-extent, not a fixed metre rung (Jeroen, interview 2 correction): it is the whole body surface at one gridunit per region, so its canvas is the body's region grid — variable per body (~19K gridunits on an Earth-class body; the D-243 elastic seam made visible, since region count floats per body_radius_km). Region (rung 1) is the largest fixed-size rung — viewport-sized like every fixed rung below it, not the always-kept tier (that is Global). Tile/voxel (1 m) is dropped from the Atlas ladder (Jeroen, interview 2: "the actual tile level rung seems unusable, maybe replace with 64" — a 10-px-per-tile full-screen view is ~192×108 m of ground, which is in-world viewport content, Phase-5's scope, not an Atlas map); voxel is reserved for Phase-5 in-world rendering. Every fixed rung's gridunit spacing is one of D-243's absolute-metre rungs — never a viewport-derived spacing (see the D-243 gridunit amendment, §(a.4)). Deepest bottom-out rule: 1 screen px per 64 m gridunit, no magnification margin — the old "10 px per tile" margin does not carry over (it existed because a 1 m unit is sub-readable at 1×1; a 64 m gridunit is already a legible map feature — a city block / short street — so chunk uses the plain fixed-canvas budget with no display-ratio-sized exception, §(c)).
• Canvas policy: rung 0 (Global) is the sole canonical, always-keep tier — the body-surface region-grid canvas, one gridunit per region, variable-extent per body. D-226(d)-legal by construction: at one gridunit per region it is coarser than the region grid, never a sub-region metre-resolution whole-body derivation. Every fixed rung — Region (rung 1) through Chunk (rung 5) — is viewport-sized and evictable (Region included: it is the largest fixed rung, not the canonical tier), bounded to a fixed canvas-pixel budget (not a per-monitor echo), which keeps the deep ladder legal under D-226(d) per request by construction (a viewport-sized chunk-spacing canvas is never a whole-body metre-resolution derivation on any single request). The D-226(d) prohibition is stated as a per-request / per-derivation constraint, not an aggregate-storage constraint (§(a.8), Troblum S3) — the letter and the purpose are both held server-side; the client-cache accumulation path is closed by the deep-rung retention cap in the Cache bullet, not left to practical improbability.
• Wire: the per-step canvas rides a tagged-envelope carrier (§(a.5), §(b)) — the ceiling-forcing payload D-225 deferred, now built. Dense classification fields ship PNG-per-field (measurement ④'s winner on size and speed); sparse feature lists (courses, cliffs) stay MessagePack-native.
• Cache: three tiers, cheapest-first — client in-memory LRU → client disk-backed FileAccess store (self-cleaning TTL for sim-state entries) → server (D-203-shaped resident global tier + TTL(detail, time, distance) for finer rungs). Determinism (D-227) makes every geometry tier a pure cache, never a source of truth. Staleness and storage are distinct eviction axes (§(a.6)). The server global (rung-0) tier is the body-surface region-grid canvas — one gridunit per region, ~19K gridunits on an Earth-class body — and costs ~8.85 MB PNG-encoded (27.61 MB raw) across the entire real ~267-body population (Dudley, measured: 4,825,615 total cells, avg 18,073/body; largest GJ325Ac at 25,200 cells/47.4 KB, smallest a moon at 253 cells; Earth-class reference 195×97 = 18,915, matching the ~19K framing). This supersedes the earlier ~174 MB figure (which mis-priced a fixed 4K-class Region-spacing canvas per body, ~440× too many cells). At ~8.85 MB the keep-always tier is trivially process-resident, not merely disk-safe — the "always keep global" policy gets easier, not harder, under the rung-identity correction. Convention stated: SI decimal MB, so the figure isn't "corrected" against a du-reported MiB number later (Troblum N1). Derive cost — the "snappy after first calc" number (Dudley, measured on real per-body extents, not extrapolated): ~16–21 ms single-thread per body (~830–910 ns/cell over ~18K cells) — trivially interactive on a fresh Atlas-open. The tier populates lazily, once per body, on first Atlas-open via the D-206 background queue (the same pattern every other cached layer uses), so the ~4.0 s all-267-summed single-thread figure is a sanity ceiling only, never paid synchronously in one batch (same shape as T-1177's per-body-vs-summed hydrology framing). Two client-cache hardening requirements, both stated in the record, both implemented in Stig's FileAccess spec: (i) a per-body deep-rung retention cap (a maximum resident chunk/block-spacing tile count or disk quota per body, independent of the rung-0 retention floor) — this is the structural ceiling that closes the D-226(d) accumulation gap (§(a.8)); (ii) every persistent cache entry carries a schema/version tag (the game's project.yaml version string or a generator_sha-style stamp), checked at read time — a mismatch is treated as a cache miss and re-fetched, never decoded (§(a.9), Troblum S5).
• Rationale: the T-1143 error class (client compensating for a zoom-scaled canvas — _canvas.scale, _zs/_zs_stroke/_zs_ring_radius, the line-rasterizer floor) is dissolved at the root: there is no zoom-scaled canvas anymore, so per-call compensation cannot occur. Every pre-workshop cost gate (①–⑤) came back GO with no extrapolation.
• Cross-reference: D-166 (cascade + the amended zoom-ladder corollary), D-226 (the ceiling this migrates past; D-226(d) the deep-step boundary), D-227 (derive-don't-store — the cache's discipline), D-243 (the rung ladder gridunit snaps to), D-225 (the tagged-envelope migration this executes), D-010 (determinism — server-owns-derivation, client-art-function).
• Dissent: None.

(a.1) D-166 corollary — repoint (owns between-step magnification)

Paste as an amendment on D-166, after the 2026-07-21 amendment:

Amendment (2026-07-25, body-map-viewer workshop — stepped ladder supersedes continuous). The 2026-07-21 corollary sentence — "Display at every rung samples the derivation at canvas resolution (the ladder is a continuous field, not a stack of fixed display rasters)" — is repointed, not deleted. The zoom mechanism is now stepped: the server generates one data canvas per discrete zoom step, sampled at that step's native D-243 gridunit spacing. The corollary's guarantee survives, re-expressed per-step: a gridunit is never derived coarser than its step's own rung floor, and never displayed finer than the display-ratio tunable (1×1 ideal, ≥5×5 px/gridunit acceptable — measurement ④). The "continuous field" framing is retired as literally false (it never was continuous once server-side per-step canvases replaced the client _canvas.scale model). The corollary now reads: "each zoom step's data canvas is a derivation sampled at that step's native gridunit spacing; display within a step holds that canvas at a fixed, texel-exact ratio; between-step magnification of the held canvas is bounded to one step interval and is the ladder's only sanctioned display-time scaling." This amendment owns the one honest new gap it creates: in the interval just before a step-cross, the held (coarser or adjacent) canvas is magnified to fill the new step's viewport for the fetch duration — the exact operation the original corollary was written against, now a named, bounded exception rather than a silent violation. The bound is joint in two knobs: step count (more steps → smaller per-step magnification factor) and the display ratio. The fetch interval is short — measurement ⑤ shows step-canvas texture upload at 0.03–4.6 ms across every size, never a frame-budget risk, and measurement ④ shows an uncached 330K-gridunit step derives + encodes server-side in ~80 ms — so the magnified hold is a double-digit-millisecond transient, not a resting display state. Ladder extent (interview 2, §(a.8b)): the 2026-07-21 amendment's "down to tile scale" phrasing is narrowed — the Atlas ladder bottoms out at chunk (64 m), not tile (1 m); tile/voxel is Phase-5 in-world content, not an Atlas rung. The per-step derivation guarantee above applies to every rung from region down to chunk.

(a.2) T-1143 ruling 3 — superseded for zoom transport

Paste as an amendment on the D-226 record's T-1143 ruling block (or on D-166, wherever the T-1143 rulings are anchored — they live in the D-226 amendment chain):

Superseded 2026-07-25 (body-map-viewer workshop). T-1143 ruling 3 ("continuous cursor-anchored zoom... wheel-zoom carries the view from the orbital frame down through regional granularities continuously") is superseded for the transport mechanism: zoom is stepped — scroll clicks through discrete D-243-rung gridunit-spacing levels, one server-canvas fetch per crossed step boundary. Survives unchanged: (a) cursor-anchored centering, (b) edge-scroll pan, (c) the [HARD] condition that a full zoom-out resets to the canonical Global (rung-0) body-surface frame and location. A client-side morph/tween between held step canvases is an investigation item (cosmetic interpolation of already-arrived textures while the next step's canvas is in flight — never re-derivation, never a second positional truth; see the determinism-boundary ruling, §(a.7)). T-1143 ruling 2 ("progressive capped-density tiling riding the generalized district_window carrier — no forced tagged-envelope migration") is also superseded: the tagged-envelope migration is now triggered (§(a.5)) — measurement ④ shows the step-canvas payload at 21×–563× the windowed ceiling across the three measured sizes, off by two to three orders of magnitude before encoding is even considered, which no additive-param reuse of district_window can carry.

(a.3) select_rung / rung-model — replaced by the step index

Paste as an amendment note (on the same T-1143-rulings block):

Superseded 2026-07-25. The shipped rung selector — select_rung()'s unified per-rung coverage-ceiling walk keyed on MAX_COVERAGE_M (Quarter → District → Region → tile-mode mosaic; atlas-zoom-ladder-t1143.md §6 "Final model, round 3") — is replaced by a discrete step index into the stepped gridunit ladder. Rungs-as-derivation-granularity survive conceptually (every step still names an absolute-metre D-243 rung), but the selector is no longer a coverage walk over viewport extent — it is "which step the viewport is currently on," advanced/retreated one notch per scroll. select_rung, MAX_COVERAGE_M, the coverage-ceiling walk, and the compute_tile_grid() whole-body Region-tile mosaic that composed the beyond-Region extent are retired. The whitelist-validation discipline from resolve_window_granularity (T-1150: finer-than-district integer multiples only, unknown values fall back, never trusted from the wire) is the correct shape for the step index's own validation and should be reused, not reinvented.

(a.4) D-243 — gridunit vocabulary entry (additive)

Paste into D-243's item (5) vocabulary block, or as a labelled amendment:

Amendment (2026-07-25, body-map-viewer workshop) — gridunit added to the locked vocabulary (additive; no rung changes). gridunit (at zoom step): the per-step data-canvas cell. Not a new spatial rung — a role name for whichever D-243 absolute-metre rung the Atlas ladder pins a given zoom step to. At every fixed rung, gridunit spacing equals one of the ladder's fixed metre values and never floats with viewport size or display resolution — a fixed step's gridunit is a D-243 metre rung, full stop. The Atlas ladder's fixed rungs run from Region (~205 km, rung 1) down to chunk (64 m, rung 5, the deepest Atlas rung); tile/voxel (1 m) is NOT an Atlas gridunit — it is dropped from the ladder (§(a.8b), Jeroen interview 2) and reserved for Phase-5 in-world rendering. The one exception to fixed-metre snapping is rung 0 (Global): it is the variable map-opener, one gridunit per region, so its gridunit is a whole region (~205 km) but its canvas extent floats with the body's region count (the D-243 elastic seam). Global's gridunit is still not viewport-derived — it is the region grid, a fixed property of the body — so the "never floats with viewport/display" discipline holds; only the body's own region count varies. So the outline's "10 px per tile" bottom-out is superseded by "1 screen px per 64 m gridunit, no magnification margin" (Dudley's chunk bench): the Atlas bottoms out at the chunk rung at the workshop's own 1×1 ideal ratio, with no extra magnification, because a 64 m gridunit is already a legible map feature (city block / short street) — unlike a 1 m unit, which needed the 10× margin only to be readable at all (which is exactly the in-world-viewport problem chunk is defined to sit above). The display ratio (screen-px per gridunit — 1×1 ideal, ≥5×5 acceptable) is the free, client-side, viewport-dependent parameter, kept terminologically and architecturally separate from gridunit spacing: two monitors at different resolutions requesting the same step receive the same absolute-metre canvas (same rung, same derived content, same cache entry — shareable) and merely display it at different px-per-gridunit ratios (a GPU texture-to-viewport resize, never a re-derivation). This is what keeps the derivation cache key free of any presentation parameter (D-227: "a canvas for a fixed seed never changes" stays true). The display ratio is step-dependent, not flat across the ladder (Stig, measurement ⑥ — Image.set_pixel 77.5 ns/cell flat, so coloring cost is driven by cell count, never display density): 1×1 at the deepest steps (Block/chunk — full fidelity where the player is closest to visible detail; chunk-64 m is now the deepest Atlas rung, §(a.8b)), 1×1 preferred at the mid steps (Quarter/District) while the realistic canvas stays under ~2M cells, and ~5×5 reserved for the shallow rungs (Region/rung 1 — and the Global/rung-0 opener, whose region-grid canvas is tiny in cell count regardless of ratio) where the metre extent grows large. There is no measured reason to sacrifice fidelity where the player is nearest the detail; the ~5×5 fallback is a cost-relief valve for the coarse steps only. This changes nothing about the snap rule or the cache key — the ratio still governs only presentation (canvas extent sizing + on-screen scale), and per-step ratio selection is a client-side policy, never a spacing or derivation input.

(a.5) D-226 T-1124 §2 windowed-family ceiling — tagged-envelope migration triggered

Paste as an amendment on D-226 (extends the amendment chain that already holds the T-1156/T-1170 carrier notes):

Amended 2026-07-25 (body-map-viewer workshop — tagged-envelope migration triggered, superseding T-1143 ruling 2's "no forced migration"). The windowed-family ceiling's purpose survives untouched: prevent uncorrelated concurrent windowed queries needing per-field request correlation. Its current mechanism — "exactly one windowed-query field on AtlasLayerResponse (district_window), sized for a ≤4,096-cell served window" — cannot carry a step canvas: measurement ④ (T-1179) shows the best available encoding (PNG-per-field) at 21×–563× the ~30 KB reference across the three measured canvas sizes (330K/2.07M/8.3M gridunits), with no encoding in the measured set closing that gap (it is a cell-count gap of two to three orders of magnitude, not a codec gap). The tagged-envelope migration D-225 deferred (2026-06-12 constraint: "the next inbound message type must introduce a tagged envelope") is hereby the sanctioned path and is executed: the step-canvas payload becomes its own tagged message type on the existing IPC stream (not a second socket, not a district_window growth) — the exact shape §(b) fixes. The ceiling rule is re-scoped, not lifted: "exactly one windowed-query field" now governs the legacy district_window carrier only; the tagged step-canvas envelope is a separate carrier the ceiling rule does not apply to by construction — it is not a second windowed field on the old shape, it is the new shape. The ceiling's original job (no uncorrelated concurrent windowed queries) is preserved within the envelope by the same echo-key/staleness discipline district_window uses today ((body, step, center, granularity) echoed on every response, latest-wins, stale-discardable). Framed as expected scope, executing a planned deferral — tier: challenging but doable, not a risk. Concrete shape (Dudley, §(b)): inbound is a discriminator-field StepCanvasRequest { step_canvas: bool, body_id, step_index, center, extent, min_wl_m } — a sixth Inbound variant extending the existing star_map/city_names/browse ShapeProbe pattern (the required-marker form D-225's 2026-06-12 amendment named); outbound is a dedicated StepCanvasResponse message (not a field on AtlasLayerResponse) + SimBridge::send_step_canvas_response. The legacy district_window carrier survives byte-unchanged — the envelope carries only new step-canvas traffic; district_window goes cold when its only client (the retired AtlasWindowViewer) is deleted, then is removed in a follow-up cleanup ticket (D-005/D-192 co-ship — no old-client/new-server window). The ceiling rule is therefore RE-SCOPED, not retired: it keeps governing the live legacy carrier verbatim.

(a.6) Map-time axis + storage/staleness eviction split (Jeroen's interview-1 amendment)

New — records interview-1 ruling 2 verbatim-grounded. Paste as an amendment on D-227 (the derive-don't-store record whose cache discipline this instantiates) and cross-reference from the new render-architecture record:

Amendment (2026-07-25, body-map-viewer workshop — map time axis; and staleness vs storage as distinct cache axes). The Atlas map shows current state via a TTL-split: static geometry (morphology/elevation/moisture/ vegetation/glaciation/height — everything derive-don't-store covers) is cached indefinitely-fresh (determinism: re-derivation is byte-identical, so "stale" is not a concept that applies to geometry); sim-state planes (frozen/flooded, and any future climate-sim-driven field) are carried as separately-cached short-TTL planes, re-requested as sim time advances. Two distinct eviction axes (Jeroen, interview 1, verbatim: "we still may also want to evict non global level geometry based on time to save storage for planets the player visits but never goes back to"): (1) staleness-eviction applies only to sim-state planes (they genuinely go stale as sim time moves); geometry never goes stale. (2) storage-eviction applies to all sub-global cache entries including geometry — every fixed rung, Region (rung 1) through Chunk (rung 5), included — evicted on time-since-last-visit purely as a storage-budget policy, not because the data is wrong (a re-derive on next visit is byte-identical and cheap — measurement ②/③, ~190–220 ns/cell parallel flat at every rung). The global tier — rung 0 (Global, the body-surface region-grid canvas), NOT Region — alone is keep-always — exempt from both axes, the resident tier that makes "atlas navigation snappy after first calc" true. (Region is rung 1, the largest fixed rung; it is viewport-sized and storage-evictable like every rung below it — the always-kept tier is the variable Global opener above it.) This makes Dudley's TTL(detail, time, distance) formula precise: the time term is storage-eviction for geometry (evict a long-unvisited body's fine-rung canvases to reclaim disk) and staleness for sim-state planes (re-fetch a flooded/frozen plane whose sim-time TTL expired) — two different reasons an entry leaves the cache, never conflated.

(a.7) river-courses-t1170.md carrier rule + cliff sparse-list — terminology repoint + cliff addition

Paste as a note at the top of docs/architecture/river-courses-t1170.md and as a one-line D-227 cross-reference update:

Note (2026-07-25, body-map-viewer workshop). The carrier three-way rule (Ruling 1c) survives unchanged in substance; "the windowed payload" is repointed terminologically to "the per-step data-canvas payload — formerly the district_window field, now the tagged step-canvas envelope (D-226 2026-07-25 amendment, §(a.5))." Rule (iii) — rung-indexed invented detail rides the windowed payload regardless of geometric kind — now has a second vector member alongside courses: cliffs: Vec<CliffSegment>. Carved-gorge geometry (dominant elevation unchanged + per-segment channel_depth + cliff_edge, T-1177's direct solver-output carry) is rung-indexed invented detail exactly as course geometry is (hydrology settles once per body, but the carved representation drawn at a step is a windowed-rung concern the same way course geometry is), so it rides the step-canvas envelope as a sparse feature list — zero-length when nothing is carved (measurement ①: gorge carving is structurally rare, zero carved cells across all three production-scale benches), #[serde(default)], parallel to courses. It is not a dense per-gridunit array and not a stolen bit of an existing classification byte. Scope: Phase-4 Atlas (Jeroen, interview 1, ruling 3 — a map showing a smooth shoreline where the settled solver computed a carved channel would misrepresent the "settled hydrology" the workshop premised; including it is nearly free given the direct-carry representation). The sparse-list encoding's "near-zero occupancy" cost is SURVEY-CONFIRMED population-wide (Troblum B1, resolved strong): the pre-filing population survey ran all 267 committed real heightmaps independently (each body's own PNG-embedded sea level, real 512×256 working grid, ~0.86 s total, byte-exact determinism across two runs) and found zero carved-outlet basins, zero cliff_edge cells, 0/267 bodies with any carving — across genuinely varied terrain (31–187 basins/body), not a flat population. The cliffs field ships empty on every currently-committed body; the "near-free" claim is now population-backed, not one-body-backed. Framing held deliberately at "not observed yet ≠ cannot occur": the carving arithmetic (channel_depth = original − spill_level, the cliff_edge flag) stays unit-proven in isolation for any future body whose terrain does produce the narrow two-independently-sealed-basins-plus-single-cell-corridor geometry carving requires — the field-set and Phase-4 scope stand because the model must represent what the solver can produce, and the sparse-list is the right shape at zero occupancy (empty vec, #[serde(default)]) and remains a correct shape at any future nonzero occupancy. Survey scope limit to carry into the filed record: the survey used uniform moisture_q = 55 (per-body climate wiring is out of scope) — this affects only the endorheic/overflow split, never carving (carving is elevation-gated, never moisture-gated), so the zero-carving finding is independent of the climate simplification. Full addendum: measurements/t1177-hydrology.md "POPULATION SURVEY" section.

(a.8) D-226(d) whole-body prohibition — per-request framing + client-cache accumulation cap (Troblum S3)

Paste as an amendment on D-226 (the item-(d) prohibition), alongside the ceiling amendment §(a.5):

Amended 2026-07-25 (body-map-viewer workshop — accumulation gap closed, Troblum adversarial pass S3). The item-(d) whole-body prohibition ("chunk/ tile/voxel output never appears as a whole-body planetary map layer") is stated explicitly as a per-request / per-derivation constraint, not an aggregate-storage constraint. The stepped ladder's viewport-sizing policy holds it by construction server-side: no single StepCanvasRequest ever derives whole-body coverage at sub-Region spacing (the deepest step is a chunk-64 m viewport canvas — see §(a.8b) for the tile/voxel-drop narrowing). But the client-side persistent cache (Stig's FileAccess store) introduces an accumulation path the letter of the rule does not cover: a systematic exhaustive pan at the deepest (chunk) spacing — most plausibly the D-226 item-(4) AtlasAgentInterface automated QA sweep, not normal play — could assemble a near-whole-body chunk-resolution artifact as N discrete cached files over wall-clock time (the tile-spacing case that produced the ~985 GB / 6.6M-tile figure is now moot at the Atlas ladder — tile is dropped, §(a.8b) — but the accumulation principle still applies at chunk/block spacing, just at a coarser resolution and a proportionally smaller aggregate; impossible by accident, but not structurally prevented). The rule's purpose is about information content, not file count, so packaging it as N files does not exempt it. Closed structurally, not by improbability: a per-body deep-rung client-cache retention cap (a maximum resident chunk/block-spacing tile count or disk quota per body, independent of the rung-0/Global retention floor) bounds sub-global accumulation so the aggregate can never approach whole-body metre-resolution coverage. The automated QA channel inherits the same cap — an agent sweep's client cache is bounded identically, so a QA run cannot silently deposit the forbidden artifact in user://atlas_cache/. The exact cap value is a tuning constant sized in Stig's cache spec at implementation; the requirement that a cap exist is record-level.

(a.8b) D-226(d) floor — partial restore at chunk (Jeroen's interview-2 narrowing of his own interview-1 opening)

Paste as an amendment on D-226, immediately after the T-1143 ruling 1 block (which opened item-(d)'s floor for the ladder) — this narrows that opening:

Amended 2026-07-25 (body-map-viewer workshop, interview 2 — the opened floor lands at chunk; tile/voxel re-close for the Atlas). T-1143 ruling 1 (2026-07-21) opened item-(d)'s floor "toward block/tile granularity" for the Atlas ladder, on the BHAG that "we set a new BHAG so old restrictions are up for debate." Interview 2 scopes that opening — it does not reverse it. Jeroen (verbatim): "the actual tile level rung seems unusable. maybe replace with 64?" Reasoning (matching the workshop's own seam logic): a 10-px-per-tile full-screen Atlas view is ~192×108 m of ground — that is in-world viewport content (Phase-5 scope), not a map. The Atlas zoom ladder therefore bottoms out at chunk (64 m), and tile/voxel (1 m) output returns to never-Atlas-mapped — exactly item-(d)'s original prohibition, now restored for the tile/voxel tier specifically. Precise post-interview-2 state of the floor: the opening is used down to chunk (64 m) — block (128 m) and chunk (64 m) are legal Atlas rungs, riding the viewport-sized windowed carve-out (§(a.8) per-request framing) — and re-closed below chunk: tile (1 m) and voxel/subvoxel output are Atlas-invisible, verified by the believability/derivation harnesses and shown in-world in Phase 5, exactly as item (d) originally required. This is a deliberate narrowing of the BHAG's scope, not a walk-back of the BHAG ("a Reach a character can travel through" is unchanged; what changed is that the Atlas map stops one rung above the in-world viewport, because that's where a map stops being a map). The harness-verification path for tile/voxel L5 fill remains primary, as it was before the opening — the opening's practical effect is now limited to the block and chunk rungs, which is the range where a whole-viewport canvas still reads as a map rather than a scene.

(a.9) Client-cache schema/version tag — the one D-192 gap (Troblum S5)

Paste as an amendment on D-227 (the cache-discipline record) and cross-reference from D-192:

Amendment (2026-07-25, body-map-viewer workshop — persistent-cache version discipline, Troblum adversarial pass S5). D-192 drops the client/server protocol version handshake on the subprocess-co-ship rationale ("the Godot client launches the Rust server it was built with — always in sync at runtime"). That holds for the live wire, and for the tagged-envelope migration itself (no live network deployment where an old client meets a new server). It does not hold for a disk-backed persistent cache (Stig's user://atlas_cache/ store, premise 9): a cache file written by game version N and read back by version N+1 survives a game update by construction — exactly the version boundary D-192 assumes away everywhere else. A patch that changes the step-canvas payload shape (adds a field — e.g. this workshop's own cliffs list — or shifts an enum discriminant range per T-1150's "unknown values fall back, never trusted from the wire") would have an N-schema cache decoded as N+1-schema: a hard decode error at best, a silent misinterpretation of old bytes as new fields at worst (the exact class D-225's 2026-06-12 tagged-envelope constraint prevents for the live wire, now extended to the disk format). Requirement (record-level): every persistent client-cache entry carries a schema/version tag at write time (the game's project.yaml version string, or a generator_sha-style stamp), and a read-time check: a tag mismatch is treated as a cache miss — re-fetch, never decode. This extends the existing cache-index shape ({written_at, last_read_at, kind, size_bytes} + schema_version) by one field; it lands in Stig's FileAccess spec at implementation, but the requirement is stated here so it is not discovered as a stale-cache decode bug in the wild. Consistent with D-227's "cache never truth, evict → recompute always valid" — a version-mismatched entry is just another eviction case.

(a.10) Seed-chaining — the "cache-accelerated pure function" model (Jeroen interview-2: he meant consuming coarser output)

Paste as an amendment on D-227 (this is the one place derive-don't-store meets "a finer step reads a coarser step's output") — for Jeroen's final ratification against his phrase "serves as seed information for the deeper cascade." Governance framing is mine; the cost/impl side is Dudley-confirmed (dudley-interview2-response.md §2) — his A/B mechanism distinction is folded in, and the [DUDLEY] bracket is resolved.

Amendment (2026-07-25, body-map-viewer workshop, interview 2 — seed-chaining resolved as a cache-accelerated pure function). Jeroen's outline — "[the step canvas] at the same time serves as seed information for the deeper cascade" — is ruled at interview 2 to mean the finer step consumes the coarser step's resolved output (not merely that the coarser rung is independently re-derivable). This is reconciled with D-227 derive-don't-store without weakening it, via the cache-accelerated pure function model:

• What "consuming coarser output" means precisely — mechanism B, not mechanism A (Dudley §2, load-bearing to prevent a subtle violation). (A) Reading the coarser step's RESOLVED CLASSIFICATION (e.g. taking a District-spacing morphology_zone as a shortcut for a Chunk cell's zone) is ruled OUT — it violates Araminta's categorical-field re-derivation rule (§(a.6)/round-1: coarser steps re-derive morphology/vegetation/ glaciation as a fresh dominant-mode pick at their own spacing, never inherit a different spacing's classification — the same-vocabulary/different-meaning- per-scale contradiction). (B) Reading the coarser step's underlying CONTINUOUS PRIMITIVE (the region/district baseline blend at a world position) as an input to the finer step's OWN fresh classification is what "seed information for the deeper cascade" means — and it is already the shipped pattern (invent_primitives's district call reads a region baseline today). The cache-accelerated model applies to (B): cache the continuous baseline blend, not the resolved classification.
• The DEFINITION stays pure. Every gridunit value remains derive(seed, position) — a pure function of fixed inputs, byte-identical on every evaluation (D-010/D-227 unchanged). "Consuming the coarser output" does not make the finer step a function of mutable state; the coarser baseline it consumes is itself derive(seed, position) at the coarser rung — a pure value, not a stored fact.
• The IMPLEMENTATION may read a resident coarser canvas as an ACCELERATION, with a derive-fresh fallback when that canvas isn't resident. Reading the cached coarser canvas is faster than recomputing it; not having it costs a fresh derive of exactly the shape Dudley already benched.
• This is an OPTIMIZATION, not a SEMANTIC DEPENDENCY — the load-bearing governance distinction. The coarser canvas being read is itself evictable derived data (a pure function of the same seed). So correctness never depends on the cache being warm: if the coarser entry is evicted, the finer step derives it fresh and gets byte-identical input, producing the same output. That is precisely D-227's own standing test — "eviction → recompute, always valid." A semantic dependency would mean "the finer step is wrong without the coarser cache" — never true here, because the coarser value is re-derivable to the same bytes. The cache is still never truth, only an accelerator: derive-don't-store holds intact.
• Mandatory determinism test (the proof that makes this airtight): the cache-hit path (read resident coarser canvas) and the cache-miss path (derive the coarser input fresh) must produce byte-identical finer-step output — both are the same pure function of the same seed. This is a required test, the same shape as T-1170's window-independence invariant. If it passes, the two paths are indistinguishable except in speed, which is the definition of "optimization, not dependency." If it ever failed, that would be a determinism bug (a non-pure derivation), caught here rather than corrupting a save (D-227's determinism-is-save-critical clause).
• Benched numbers survive as worst-case ceilings (Dudley-confirmed). Every ①②③ cost number measured the independent re-derivation path — which is exactly the cache-miss fallback. So the measured costs are the cache-cold ceiling: the shipped system is never slower than the appendix, and is faster whenever the coarser baseline is resident. This closes Troblum B2's "every cost number prices the wrong architecture" worry — the numbers price the fallback, and the fallback is the worst case, so they remain authoritative as an upper bound.
• No chain-reaction on eviction (Dudley-confirmed). A deep-step (chunk) cache miss does not walk backward through evicted District/Region cache state — each rung's fresh-derive fallback is fully self-contained (derive(seed, position) takes nothing but those two inputs, by construction), so a miss costs one fresh derive at that rung's own inputs, never a cascade through every evicted ancestor. Troblum B2's chain-reaction worry dissolves — there is no dependency to chain, because the fallback was never built to depend on any other rung's cache state.
• Acceleration magnitude is unquantified but not architecture-gating (Dudley-confirmed honest caveat). The saving from reading a cached continuous baseline vs. recomputing it (mechanism B) is very likely real but modest — no bench isolates the region-baseline-blend sub-cost from the full derive_at_metres call (most of the per-cell cost is the octave-sum detail-scatter work mechanism B does not propose caching). This is a future implementation-time measurement, not a gate on the architecture ruling: the ①②③ ceiling numbers already answer the load-bearing yes/no, and the "expected" (as opposed to worst-case) latency is sized later.
• Cross-reference: supersedes Dudley's round-2 §(b) "independent re-derivation, never reads a cached response" as the exclusive rule — that ruling survives as the fallback path's description (function-composition on a cache miss); interview 2 adds the cache-read fast path (mechanism B) on top, governed by the byte-identical-paths test above.

(a.11) Lakes — settled-hydrology sourcing of the existing MorphologyZone::Lake; endorheic cue via outflow-course presence (FINAL, converged)

FINAL — fully converged on both sides. The endorheic-cue residual is closed: Dudley picked Araminta's outflow-course presence (his doc updated with proper supersession — the stale 4-state-water sections, a crossed-in-flight reply to Araminta's original questions, are marked SUPERSEDED-BY-CROSSING and traceable, not deleted; his corrected section carries her 8-dense + 2-sparse struct with a no-dissent confirm). No open clauses remain in this amendment.

Paste as an amendment on D-227 (the derive-pipeline record — the fill is a data-source fix, not a wire change) with a D-239 §6 cross-reference. Converged sources: Araminta's encoding ruling (araminta-round2.md §(e), where she verified Dudley's code-read at source — district_profile.rs:556-565, generator.rs:1198-1223, features.rs:104-105 — and withdrew her earlier new-field proposal) + Dudley's pipeline ruling + endorheic-cue pick (dudley-interview2-response.md, "LAKES CONVERGENCE", corrected section).

Amendment (2026-07-23, body-map-viewer workshop — lakes sourced from settled hydrology; endorheic cue via outflow-course presence). The outline's lake behaviour (settled fill, overflow, endorheic sinks — measurement ①/T-1177) reaches the Atlas map with no new wire field and no vocabulary change:

• Lakes ride the EXISTING MorphologyZone::Lake (discriminant 1, already in the frozen 17-zone D-239 §6 vocabulary — not a new zone; no new wire field for the fill itself). The gap was never a missing vocabulary entry; it was a missing data source. Today derive_morphology_zone emits Lake from a crude heightmap threshold (ocean_fraction_q >= 60, a bilinear sample of elev < sea_level), with zero connection to HydrologyResult's settled-equilibrium basins (the code's own comment already flags this as a known gap). The fix: derive_morphology_zone sources the Lake emission from settled hydrology instead of the heightmap heuristic, falling through to today's ocean_fraction_q heuristic where no basin exists.
• Pipeline sourcing — sample the continuous filled_scaled field, NOT projected basin-cell membership (Dudley's ruling, adopted). Water derives from HydrologyResult's continuous filled_scaled field sampled bilinearly at each gridunit's world position (the same mechanism ocean_fraction_q/ sea_level already use) — not from basin-cell membership projected as a discrete 512×256 lookup, which would produce a blocky, non-refining lake edge — exactly the magnified-coarser-composite artifact D-166's corollary forbids (§(a.1)). This is seed-chaining mechanism B (§(a.10)) applied to hydrology exactly as it already applies to sea_level: sample a coarser rung's continuous primitive fresh per rung, never re-solve — so the lake edge refines with zoom (a genuine finer curve at each rung), not a coarse grid magnified. Sea vs. Lake is unchanged (both already-existing discriminants; the OpenOcean tier is untouched).
• Static, distinct from the sim-state flooded plane. Lake basin geometry is a settled equilibrium — a pure function of seed + terrain (D-227), cached indefinitely-fresh like all geometry. It is not the short-TTL frozen/flooded sim-state plane (§(a.6)); a lake's existence and extent are static, while the flooded plane is the sim-time-varying water-height overlay. The two do not conflate.
• Endorheic-vs-overflow cue = OUTFLOW-COURSE PRESENCE. No wire bit, no new zone (FINAL). The distinction (a lake that drains vs. a closed sink) ships as a client-side read of whether a lake has a river course exiting it: an overflow basin's outlet edge appears in courses (T-1170); an endorheic basin's does not. Three reasons this is the right carrier, not a dense marker:
  • Proportionality. Endorheic is 1,030 of 22,270 basins = 4.63% in the real population. A per-cell bit under morphology-fold would force either an 18th MorphologyZone arm — a D-239 frozen-vocabulary change every consumer inherits forever (including the one-colorizer-family guarantee) — or a new wire field, for a fewer-than-1-in-20 distinction, when a zero-marginal- cost alternative exists.
  • The work is required regardless. Overflow lakes must show their exit rivers to be hydrologically honest (a lake that drains but shows no outlet river is simply wrong on the map) — so the basin-outlet→course wiring is built no matter what. The endorheic cue is a side effect of that required work, not a feature it pays for.
  • Definitionally sound, no misfire case. Every Overflow basin has a guaranteed non-empty outlet_path (tested: overflowing_basin_has_nonempty_outlet_path); every Endorheic basin has none. The presence/absence read is exact — there is no basin class that drains-but-shows-no-course or is-closed-but-shows-a-course. The cliffs list is NOT the cue (T-1177's survey: zero carved cells across all 267 real bodies — a cliff-wired cue would fire nowhere).
• Honest scope — until the outlet-wiring ticket ships, there is NO visible endorheic cue. HydrologyResult's basin outlet_path/BasinOutcome is not currently threaded into RiverNetwork/courses (D8-network-derived, a different computation; T-1177's own scope note confirms HydrologyResult is prototype-only, unwired to any payload). So the two deliverables are distinct: the Lake sourcing fix (self-contained — the map shows lakes as water) and the outlet-wiring (the exit-river distinction). Between them, the map shows lakes but not the drains-vs-closed distinction — state this plainly; it is not a gap in the design, it is the honest sequencing. The outlet-wiring is a real, small, additive follow-up ticket (§(d)), pre-cleared by T-1170 Ruling 7b (the reserved TERMINAL downstream sentinel: "an interior sink becomes an additive drainage-extraction change, not a wire migration... the work is in D8 sink retention and lake morphology, and every piece this batch builds consumes them without modification"), and river_course::build_edges is already no-op-safe on TERMINAL (Dudley's confirm) — additive, not a migration.
• Visual treatment: lakes draw as water at every rung, same colorizer family as sea/ocean (one-colorizer-family guarantee, Araminta round-1 §3 — a Lake discriminant colours identically whether sourced by heuristic or basin); endorheic-vs-overflow reads via outlet-course presence at the lake shore (no distinct fill/texture on the lake body, no new styling rule for Stig — the present-or-absent exit river is the visual difference).

---

(b) TAGGED-ENVELOPE MECHANICS — governance disposition (with Dudley on wire/serving)

Division of labor: I own the record framing + the D-225/D-226 §2 disposition (what happens to the ceiling rule). Dudley owns the wire/serving design (message shape, demux, legacy coexistence). Dudley has ruled (dudley-round2.md §(a), grounded in a direct read of server/src/bridge/mod.rs); his three answers are folded in below and §(a.5)'s bracketed clause is now resolved.

The ceiling-rule disposition (mine, final)

The windowed-family ceiling (D-226 T-1124 §2, [HARD]) has two separable parts, and only one moves:

• Its purpose — "no uncorrelated concurrent windowed queries needing per-field request correlation" — is preserved in full. This is why the rule existed: two independently-in-flight windowed queries would each need their own request→response correlation, and the hand-rolled shape-demux couldn't carry that. The tagged envelope strengthens this: a tagged message has an explicit correlation handle by construction (the tag + echo key), which is strictly better than the shape-demux the ceiling was protecting.
• Its mechanism — "exactly one windowed field on AtlasLayerResponse" — is re-scoped to the legacy carrier only. The rule was a fence around a hand-rolled demux, not a first-principles limit on windowed data. Once a proper tagged envelope exists, the fence is obsolete for anything inside the envelope: the envelope can carry as many correlated fields as its schema declares, because the tag makes correlation explicit rather than structural.

So the disposition is: the ceiling rule keeps governing district_window (the legacy shape-demuxed carrier) verbatim, and does not extend to the tagged step-canvas envelope, which is a new carrier with its own explicit correlation discipline. This is the same move T-1156 and T-1170 made in miniature (both kept traffic off the ceiling by choosing the right carrier) — the difference is those two stayed inside the one-field shape because they could (skeleton is whole-body; courses are content of the existing field), whereas the step canvas cannot (cell count alone forces a new carrier), so this one builds the envelope the others didn't need.

D-225's constraint is landed on its intended target. D-225's 2026-06-12 amendment said the next inbound message type must introduce a tagged envelope rather than extend shape-based detection. Every carrier since (T-1124's window params, T-1131's BrowseRequest — "the fifth and last map-shape probe") deferred it by riding existing shapes. The step canvas is the one that can't ride an existing shape, so it is correctly the one that pays the deferred cost. This is a planned migration executing on schedule, not an emergency.

Three slots — Dudley's rulings, folded in

Dudley read the actual decode_inbound/Inbound code and found the "tagged-marker" pattern D-225 asked for is already implemented five times (each newer inbound shape — StarMapRequest/CityNamesRequest/BrowseRequest — carries a mandatory boolean discriminator, and ShapeProbe already enforces at-most-one-discriminator). So the migration extends a proven pattern rather than inventing a new envelope format — which sharpens my governance framing: at the code level this is "doable," and the "challenging" part lives in the client rebuild (Stig) and the cache/ladder work, not the demux.

1. Message shape → discriminator field on the existing stream. Inbound: a new StepCanvasRequest { step_canvas: bool, body_id, step_index, center, extent, min_wl_m } as a sixth Inbound variant, extending the existing ShapeProbe mutual-exclusivity chain. Outbound: a dedicated StepCanvasResponse message (not a field on AtlasLayerResponse — D-226 T-1124 §2 names this exact "dedicated response message by rule" case) + SimBridge::send_step_canvas_response. My §(a.5) text stands verbatim — "its own tagged message type on the existing IPC stream" is exactly a discriminated inbound variant + dedicated response message; D-225's language was "a tagged envelope (or a required marker field)", and the required marker field is what ships. The ceiling disposition is identical to what I drafted.

2. Legacy coexistence → district_window survives unchanged; the envelope carries only the new step-canvas traffic. Dudley's call matches my lean: no retirement message, no dual-write, no migration of existing windowed traffic. The legacy carrier keeps working byte-for-byte until Stig's stepped viewer replaces its only client, at which point it goes cold and gets deleted in a follow-up cleanup ticket (D-005/D-192 co-ship guarantee means no old-client/new-server window). Therefore the ceiling rule is RE-SCOPED (my §(a.5) primary text), not fully retired — it keeps governing the live legacy district_window carrier verbatim; the envelope is the new carrier outside it. The §(d) deprecation table's parenthetical "(if Dudley rules one-carrier-subsumes-all → SUPERSEDE)" branch does not fire — re-scope is final.

3. Rung-0 (Global) and rung-1 (Region) both ride the NEW envelope — at step_index: 0 (Global, the variable body-surface region-grid canvas) and step_index: 1 (Region, 204.8 km fixed), not the legacy whole-body region_grid/district_grid Option fields. Dudley's reasoning is the one I'd have given: putting the opener on the legacy family would force the new stepped client to speak two response protocols (envelope for the deeper rungs, old family for the opener) for zero architectural gain — one request shape, one response shape across the whole ladder is simpler on both sides and is what premise 8 ("step boundaries = compute-chunk boundaries") implies uniformly. The only per-rung difference is that rung 0's canvas extent is variable (the region grid) rather than a fixed pixel budget — a field value on StepCanvasRequest, not a different message shape. Render-architecture record "Wire" bullet updated accordingly (§(a.0): the envelope carries every rung including the Global opener; the legacy whole-body layers keep serving whatever non-stepped consumers survive the cutover, if any).

Response framing (Araminta's relayed dense/sparse question, Dudley answered): one flat tagged StepCanvasResponse carrying all fields together (six dense PNG-per-field + settlement_id dense + courses/cliffs sparse MessagePack-native), not a dense/sparse split into separately-tagged sub-messages. The progressive-paint UX case (terrain first, annotations after) is real but belongs client-side (paint the RTT layer on decode, defer the annotation draw a frame) — no wire-protocol complexity for a cost split the measurements don't show (courses +0.09–0.21 ms, negligible). This matches the whole-payload-together precedent D-225 set for Layer1Output.

Filing note: §(a.5) and §(a.0) are now final — no bracketed clauses remain.

---

(c) STEP-LADDER TABLES — snap-rule constraints (mine) + costs (Dudley's)

INTERVIEW-2 UPDATE — tile/voxel dropped, chunk-64 m is the new deepest rung, and Dudley's Option D is DELIVERED (every row measured). Jeroen ruled the tile rung "unusable" (§(a.8b)); chunk (64 m) is the deepest Atlas rung. Dudley benched the never-measured chunk rung (dudley-interview2-response.md §1) and built Option D — this is now the live ladder table (below). Options A/B/C are superseded and retained only for the carried-forward reasoning.

Option D — the adopted ladder (six levels: Global opener + 5 fixed rungs; chunk-64 m deepest, every fixed rung measured)

Six levels after Jeroen's interview-2 rung-identity correction: rung 0 = Global (the variable body-surface region-grid map opener, always-kept), then five fixed metre rungs Region→Chunk.

Rung	Level	Spacing	Factor (from prev)	Canvas	Cells	World extent	Derive cost (parallel)
0	Global (opener)	1 gridunit / region (~205 km)	—	variable — the body's region grid	~18K (avg/body; ~19K Earth-class)	whole body	~16–21 ms/body single-thread (Earth-class 18,915 cells = 15.9–16.2 ms; largest 25,200 = 20.9–21.3 ms; ~830–910 ns/cell); ~8.85 MB PNG all 267 bodies
1	Region	204.8 km	— (variable→fixed seam)	3840×2160	8.3M	whole body (capped mosaic)	1,827 ms
2	District	2,048 m	100×	3840×2160	8.3M	7,864 × 4,424 km	1,827 ms
3	Quarter	512 m	4×	3840×2160	8.3M	1,966 × 1,106 km	~1,827 ms (same-band)
4	Block	128 m	4×	3840×2160	8.3M	491 × 276 km	~1,827 ms (measured)
5 (deepest)	Chunk	64 m	2×	3840×2160	8.3M	245.8 × 138.2 km	1,724–1,733 ms (measured)

Rung 0 (Global) is categorically different from the fixed rungs: its canvas is the body's region grid (one gridunit per region), so its extent is variable per body (the D-243 elastic seam — region count floats per body_radius_km, ~19K gridunits Earth-class, far smaller than a fixed 4K canvas) and it is the sole always-kept tier. Rung 1 (Region) is the largest fixed rung — 204.8 km spacing, a fixed 3840×2160 viewport canvas, evictable like every rung below. The Global→Region transition (rung 0→1) is the variable→fixed seam, not a metre factor; the first metre factor is Region→District (rung 1→2, ÷100).

Every fixed row (1–5) is directly measured or in a directly-measured band — the "zero asterisks" property the old Option B earned by skipping chunk, now earned by measuring it. (Rung 0 is Dudley-measured too: ~16–21 ms/body single-thread over ~18K region-grid gridunits, ~8.85 MB PNG across all 267 bodies — trivially cheap to derive and store.) Two things Option D settles that the old tables couldn't:

• The deepest-step canvas-sizing special case is GONE. The old voxel/tile deepest step needed a display-ratio-sized canvas (216×384 m at 10 px/tile, not the fixed-budget convention every other step used, because the two were incompatible at 1 m spacing). Chunk has no such incompatibility — at 1×1 px/gridunit the fixed 3840×2160 budget and the "no magnification margin" bottom-out rule are the same rule, so chunk uses the plain fixed-canvas convention like every other rung. Dropping the special case is a genuine simplification, a free consequence of Jeroen's own ruling.
• Deepest-step derive cost rose two orders of magnitude in absolute terms (17 ms → ~1.7 s) — and that is correct, not a regression. Chunk's canvas covers a vastly larger world area (216×384 m → 245.8×138.2 km) at the same cell count, so it costs the same as every other rung's full canvas (1.7–1.8 s parallel band) — which is exactly what "no special case" means. 1.7 s parallel is comfortably inside the step-cross tolerance every number in this workshop uses. Cost still does not gate this rung.

Bottom-out rule (record-level, §(a.0)/§(a.4)): 1 screen px per 64 m gridunit, no additional magnification margin. The old 10×-per-tile rule was a legibility margin for a sub-readable 1 m unit; a 64 m gridunit is already a legible map feature, so it does not carry over — applying it would needlessly shrink coverage 10× for no legibility gain.

My snap constraints (hard, from the snap rule + interviews 1 & 2, corrected for the Global/Region rung-identity fix):

• Every fixed rung's gridunit spacing = one of D-243's metre rungs. The Atlas ladder's fixed rungs are region ~205 km (rung 1), district 2,048 m, quarter 512 m, block 128 m, chunk 64 m (rung 5) — tile/voxel (1 m) is NOT an Atlas rung (§(a.8b), Phase-5 in-world content).
• Rung 0 = Global — the variable map opener (one gridunit per region, the body's region grid; D-243 elastic seam), the whole-body canonical / always-keep tier. This is the ONE variable-extent level; it is not viewport-derived (its gridunit is a whole region, a fixed property of the body).
• Rung 1 = Region (~205 km) — the largest fixed rung, viewport-sized and evictable like every rung below it; not the always-kept tier (that is Global).
• Deepest rung (5) bottoms at chunk (64 m), at 1×1 px/gridunit, no margin — fixed 3840×2160 canvas like every other fixed rung (no display-ratio-sized exception; that oddity died with the tile rung).
• No fixed rung invents a spacing D-243 doesn't name.
• Display ratio (px/gridunit, 1×1 → 5×5) is the free client knob, decoupled from spacing — it sizes the canvas extent and the on-screen scale, never the spacing.

---

The material below (Options A/B/C + convention notes) is pre-interview-2 (voxel-deepest) reasoning, superseded by Option D above. Retained for the carried-forward logic (factor-unevenness analysis, the zero-asterisk argument) — every "voxel 1 m / 216×384 m / 10 px/tile" row is void.

The tables and convention notes below are pre-interview-2 (voxel-deepest) reasoning, retained for the carried-forward logic (canvas convention, factor analysis, zero-asterisk argument). Options A/B/C and every "voxel 1 m / 216×384 m / 10 px/tile" row are SUPERSEDED by Dudley's Option D (chunk-64 m deepest). The display-ratio-split logic below still holds — it just now lands the "display-ratio-sized deepest step" at the chunk rung, with Dudley's chunk bench supplying the deepest-row numbers that replace 216×384 m / 17 ms.

Canvas convention (Dudley's correction, adopted — reads at chunk now, not voxel): the fixed 3840×2160 canvas-pixel budget holds at every step except the deepest — at the deepest rung the fixed-px-budget convention and the display-ratio contract are mutually incompatible (a fixed 3840×2160 canvas at metre-scale spacing covers little ground yet holds many cells, oversized for the bottom-out display density), so the deepest step is display-ratio-sized instead. (Pre-interview-2 this was voxel 1 m → 216 × 384 m / 82,944 cells, measurement ③; post-interview-2 the deepest rung is chunk 64 m and the extent is Dudley's Option-D chunk display band.) This is a convention-level split (fixed-budget shallow, display-ratio deep), not a skeleton-specific one.

Per-step display ratio (Stig, measurement ⑥): the px-per-gridunit ratio is step-dependent, not flat — 1×1 at Block/chunk (full fidelity where the player is nearest visible detail; ⑥ confirms set_pixel at 77.5 ns/cell flat, so cost is cell-count-bound, not display-density-bound), 1×1 preferred at Quarter/District while the realistic canvas stays under ~2M cells, ~5×5 at the shallow rungs (Region and the Global opener) where extent grows. This tightens the extent column above: at the shallow steps the ~5×5 ratio means a coarser realistic canvas than the fixed 3840×2160 worst-case (fewer cells, cheaper), so the 8.3M/1,827 ms figures in the tables are the fidelity-ceiling cost, not the typical one — the actual shallow-step canvas at ~5×5 is proportionally smaller. The deep steps stay at 1×1 (the 17 ms/83K deep-step number is already at full 1×1 fidelity). Cost only improves against the table where the ratio relaxes; nowhere does it worsen.

Three candidate ladders — Dudley's cost fills folded in (all costs MEASURED or same-band-confirmed against ①–④; the one honest gap, chunk at 64 m, is flagged not guessed):

Option A — one-rung-per-step (6 steps, clean 1:1 to D-243)

Step	Gridunit rung	Spacing	Factor	Viewport extent	Cells	Derive cost (parallel)
0	region	204.8 km	— (canonical)	whole body (capped-tile mosaic)	8.3M	1,827 ms MEASURED
1	district	2,048 m	÷100	7,864 × 4,424 km	8.3M	1,827 ms MEASURED
2	quarter	512 m	÷4	1,966 × 1,106 km	8.3M	~1,827 ms same-band (T-1154)
3	block	128 m	÷4	491 × 276 km	8.3M	~1,827 ms MEASURED (T-1154)
4	chunk	64 m	÷2	246 × 138 km	8.3M	UNMEASURED — never benched; cutoff-mechanism reasoning strongly implies same-band, but Dudley refuses to report a number he didn't run
5	voxel	1 m	÷64	216 × 384 m (display-ratio)	83K	17 ms MEASURED (③)

My concern with A, now confirmed by cost: chunk (64 m) is the one rung nobody measured, and it's D-243's stream/derive unit, not a natural display rung — its ÷2 factor is a barely-perceptible zoom notch that adds a fetch and an asterisk for no visual gain.

Option B — skip-chunk (5 steps) — the joint recommendation

Step	Gridunit rung	Spacing	Factor	Viewport extent	Cells	Derive cost (parallel)
0	region	204.8 km	— (canonical)	whole body	8.3M	1,827 ms MEASURED
1	district	2,048 m	÷100	7,864 × 4,424 km	8.3M	1,827 ms MEASURED
2	quarter	512 m	÷4	1,966 × 1,106 km	8.3M	~1,827 ms same-band
3	block	128 m	÷4	491 × 276 km	8.3M	~1,827 ms MEASURED
4 (deepest)	voxel	1 m	÷128	216 × 384 m (display-ratio)	83K	17 ms MEASURED (③)

Why B wins, and it's an evidence argument, not a taste one (Dudley + me converge here independently): every row is directly measured or same-band- confirmed — zero asterisks. That's a direct consequence of chunk never having been benched: B is the only one of the three skeletons that doesn't lean on the unmeasured rung. The one genuinely large factor (block→voxel ÷128) lands at the deepest step where between-step magnification matters least (max detail already; no finer step to under-serve). The ÷100 Region→District factor at 0→1 is the one that maps onto a real seam — see the factor note below.

Option C — coarse-doubled (4 steps, skip District too)

Step	Gridunit rung	Spacing	Factor	Viewport extent	Cells	Derive cost
0	region	204.8 km	— (canonical)	whole body	8.3M	1,827 ms MEASURED
1	quarter	512 m	÷400	1,966 × 1,106 km	8.3M	~1,827 ms same-band
2	block	128 m	÷4	491 × 276 km	8.3M	~1,827 ms MEASURED
3 (deepest)	voxel	1 m	÷128	216 × 384 m (display-ratio)	83K	17 ms MEASURED

Why I list but don't recommend C: it costs identically to B row-for-row (same rungs, same measured rates — District's absence is not a cost saving, it's purely a pacing choice, Dudley confirms). Its distinguishing feature is the ÷400 Region→Quarter jump at 0→1 — a brutal between-step magnification interval (the held Region canvas magnified ~400× to approximate a Quarter view before the fetch lands is the D-166-corollary artifact at its worst). Only viable if fetch latency makes that magnified hold imperceptible — and since costs don't separate B from C at all, this is a pure UX-pacing call for Jeroen, not a cost tradeoff.

The factor-unevenness note (Dudley's serving answer, folded in)

The rung-identity correction makes the serving-seam story cleaner, not messier — the architectural boundary now lines up with a genuine rung boundary instead of being buried inside a metre factor. The two seams that matter are now distinct:

• The variable→fixed / global→sub-global seam is rung 0→1 (Global→Region). This is the one real serving-side boundary: Global (rung 0) is variable-extent and always-kept; Region (rung 1) is the first fixed, viewport-sized, evictable rung. The cache-tier split (keep-always vs. storage-evictable, Dudley's §(d)) falls exactly on this seam — cleaner than the old framing, which had the cache boundary and the ÷100 metre factor collapsed onto one "step 0→1" edge.
• The metre factors (÷100, ÷4, ÷4, ÷2) are all within the sub-global fixed ladder (Region→District ÷100, then ÷4/÷4/÷2). None crosses a serving seam — Region, District, Quarter, Block, chunk are all sub-global geometry, same eviction policy, same derive path, same flat per-cell cost. The ÷100 Region→District jump is the largest metre factor but it is pure UX pacing now that it no longer coincides with the cache boundary (which moved up to rung 0→1). Option D's gentle bottom factors (largest sub-global jump ÷4, deepest transition a barely-perceptible ÷2) are strictly better for the between-step magnification red flag than any prior option.

Recommendation — Option D (adopted)

The Option D table at the top of §(c) is the adopted ladder: six levels (Global opener + 5 fixed rungs: Region→District→Quarter→Block→Chunk), every fixed rung measured, no unmeasured rung, no deepest-step canvas-sizing special case, and the gentlest factor profile of any candidate. It inherits everything the old Option B earned (measured-not-inferred rows) and removes Option B's one remaining awkwardness (the voxel deepest-step special case) for free, as a consequence of Jeroen's own tile-drop ruling. (The old A/B/C ranking below is superseded — Option D is what the chunk-deepest ruling produces, and it dominates all three.) The one call left for Jeroen is confirming the six-level shape (Global opener + 5 fixed rungs) — Option D is Dudley's and my joint recommendation, no B-vs-C fork survives the tile drop.

---

(d) DEPRECATION-SWEEP DRAFT (Expected Output 2)

Every DQR record and ticket that conflicts with the decided setup, each with a disposition one-liner — ready for the Clerk consistency audit at wrap-up. The audit's job is to catch conflicts this list didn't name; this list is the known-conflicts starting set (the governance delta's named items + the round-1 ticket reconciliations the brief called out).

DQR records — amend / supersede

Record	Disposition
D-166 corollary (2026-07-21)	AMEND — repoint the "continuous field, not fixed display rasters" sentence to per-step (§(a.1)); it now owns between-step magnification as a bounded exception. Not deleted.
D-226 T-1124 §2 windowed-family ceiling	AMEND — re-scope "exactly one windowed field" to the legacy district_window carrier only; the tagged step-canvas envelope is a new carrier outside the rule (§(a.5)). Purpose preserved, mechanism narrowed. (Re-scope is final — Dudley ruled district_window survives, envelope carries only new traffic, §(b); the SUPERSEDE branch does not fire.)
D-226 T-1143 ruling 2 ("no forced tagged-envelope migration")	SUPERSEDE — migration now triggered (§(a.2), §(a.5)).
D-226 T-1143 ruling 3 (continuous cursor-anchored zoom)	SUPERSEDE for transport (stepped); cursor-centering/edge-scroll/full-reset survive (§(a.2)).
D-226 T-1143 §6 select_rung / MAX_COVERAGE_M coverage-walk model	SUPERSEDE — replaced by the discrete step index (§(a.3)).
D-226 T-1143 ruling 1 (item-(d) floor opened "toward block/tile")	AMEND / NARROW (interview 2, §(a.8b)) — the opening now lands at chunk (64 m); tile/voxel (1 m) re-closes for the Atlas (Phase-5 in-world content). A deliberate scoping of the BHAG, not a reversal.
D-243 item (5) vocabulary	AMEND (additive) — add gridunit as a role name for a rung; add the display-ratio-vs-spacing distinction; the Atlas ladder bottoms at chunk (64 m), tile/voxel not an Atlas rung (§(a.4), interview 2). No D-243 rung definitions change — the metre ladder is intact; only which rungs the Atlas uses is narrowed.
D-225 (2026-06-12 tagged-envelope-deferral constraint)	SATISFY (note, not supersede) — the deferred constraint is now executed by this workshop's envelope; annotate D-225 that its "next inbound message type must be a tagged envelope" constraint is discharged here (§(a.5)).
D-226 item (d) whole-body prohibition	AMEND (Troblum S3 + interview 2) — state the prohibition as a per-request / per-derivation constraint, not aggregate-storage; add the per-body deep-rung client-cache retention cap (§(a.8)); and record the floor's partial-restore at chunk (§(a.8b) — the accumulation case is now chunk/block spacing, tile/voxel Atlas-invisible again). The prohibition's substance survives; this hardens it and re-narrows its floor.
D-227 (derive-don't-store)	AMEND (additive) — (1) the map-time TTL-split + staleness-vs-storage eviction-axes distinction (§(a.6)); (2) the persistent-cache schema/version-tag requirement (§(a.9), Troblum S5); (3) the seed-chaining "cache-accelerated pure function" model (§(a.10), interview 2) — a finer step may read a resident coarser canvas as an optimization with derive-fresh fallback, staying inside derive-don't-store because the coarser value is itself re-derivable to identical bytes (optimization, not semantic dependency); (4) the lake sourcing fix (§(a.11)) — MorphologyZone::Lake sourced from HydrologyResult's continuous filled_scaled (mechanism B), a derive-pipeline data-source change, not a D-239 vocabulary change (the frozen 17-zone set is reused verbatim — see the D-239 note below). All four are additive; derive-don't-store's core is unchanged and, for (3), reinforced (the byte-identical-paths determinism test is D-227's own eviction-validity property applied to a fast path).
D-192 (no client/server version handshake)	CROSS-REF note (Troblum S5) — annotate that the co-ship "always in sync" guarantee does not extend to the persistent disk cache; the schema/version tag (§(a.9)) is where that boundary is handled. Not a change to D-192's live-wire reasoning, which stands.
river-courses-t1170.md carrier rule (Ruling 1c)	AMEND (note) — terminology repoint ("windowed payload" → step-canvas envelope) + add cliffs as rule (iii)'s second vector member (§(a.7)). Substance unchanged.

Records confirmed SURVIVING UNTOUCHED (state explicitly so the Clerk audit doesn't over-rewrite): D-010 (four principles — the server relocation reinforces principle 4); D-166 cascade + phase gating (still Phase-4 Atlas); D-169/D-170 (implant UI — the map component still lives in the implant Atlas app, occludes gameplay via HudGroups); D-223 (atlas_city_names — Araminta's settlement-name lookup rides it unchanged); D-239 (the 17-zone morphology + vegetation/glaciation vocabulary — frozen across every step per Araminta's one-colorizer-family ruling; the §(a.11) lake fix explicitly does NOT touch it — it reuses the existing MorphologyZone::Lake discriminant, changing only its data source, and the endorheic cue rides courses precisely to avoid an 18th zone). (D-226 item (d) moved out of this list — it is now AMENDED per Troblum S3, above.)

Tickets — cancel / re-scope / repurpose

Ticket	Current status	Disposition
T-1176 (design discussion: revise the Atlas map render mechanism)	in_progress	CLOSE as delivered — this workshop is its output; the render-architecture D-record + amendments are the deliverable. Mark done at filing, referencing the new D-record.
T-1158 (decompose atlas_window_viewer.gd — canonical-frame + rung-reselection cluster)	backlog	CANCEL with supersession note (Stig's round-1 call, confirmed): the canonical-frame state machine T-1158 wanted to extract is exactly what changes shape under stepped zoom (no continuous zoom floor, no _canonical_fit_zoom()); extracting code about to be deleted is waste. The new component's three-piece decomposition (input/pan, step-cross orchestration, two draw layers) is decided fresh in the implementation ticket, not by reviving T-1158. Note: "superseded by body-map-viewer render architecture (D-NNN); decomposition folded into the new component's implementation."
T-1175 (Atlas map-reading polish — river/nature presentation, single large pass)	backlog	RE-SCOPE + note the styling-engine dependency: T-1175's per-vertex river tapering/width-grammar work lands on the screen-space annotation layer (§ Stig round-1) via a Polygon2D-strip mechanism (draw_polyline can't taper). The c1 blocker is now cleared — measurement ⑥ landed (Stig: Image.set_pixel 77.5 ns/cell flat) and the c1 call resolved CPU-first (terrain raster colorized CPU-side; shaders deferred, not a ladder precondition). T-1175's tapering is a screen-space-annotation-layer concern independent of the terrain c1 call, so it depends only on (a) the new annotation layer landing — the ⑥-gated dependency is discharged. Not cancelled; re-homed onto the new component, unblocked.
T-1157 (redesign atlas visual-capture goldens for the zoom ladder)	backlog	RE-SCOPE as the new mechanism's verification story: the dead-goldens problem T-1157 targets is a direct consequence of the AtlasViewer/orbital-mosaic split that the stepped model collapses (global zoom = step 0, not a separate code path — Stig round-1). Re-scope to "capture harness for the stepped render architecture" — goldens key on (body, step) canvases, not the retired continuous-zoom frames. Keep, don't cancel: the capture harness is more needed than ever (it's the eyeball-check substrate for every step canvas).
T-1174 (batch vs window derive paths sample different world positions for the same DistrictPos)	backlog	KEEP, unchanged in intent — this is a derivation-correctness bug (two derive paths disagreeing on the same position) that is orthogonal to the render pivot and survives it: the tagged envelope still needs batch and window derive to agree cell-for-cell (it's the same derive_at_metres correctness both carriers depend on). If anything the stepped model raises its priority (more derive paths sharing the same position math). No supersession; note only that it now blocks the step-canvas serving path too.
T-1153 (continuous cursor-anchored zoom ladder in the client)	done	Its shipped CODE is superseded (the continuous zoom transport, _view_zoom float, progressive cross-rung refinement machinery) — the ticket stays done (it delivered what it was scoped for), but its code is on the _canvas.scale retirement path (below). No ticket action; flag its shipped surfaces in the retirement-path note so the implementation ticket knows what it's replacing.
T-1152 (derived planetary rung — progressive capped-density tiling; AtlasViewer heightmap texture retires)	done	Its compute_tile_grid() whole-body Region-tile mosaic is superseded by the rung-0 Global canvas (the body-surface region grid, one gridunit per region — the map opener; there is no beyond-Region mosaic, and Region itself is now rung 1, a viewport-sized fixed rung, not the top). Ticket stays done; its mosaic code is on the retirement path. The heightmap-texture retirement it did land (the reliefmap.png display path) stays retired — that survives the pivot (heightmaps were already demoted to derivation input by the D-166 corollary).
T-1153/T-1152 test suites	—	The zoom-ladder goldens and rung-selection tests those two stories shipped are retired with their code (they test continuous zoom + coverage-walk selection + the Region-tile mosaic — all superseded). T-1157's re-scoped capture harness (above) is their replacement. Concretely: the select_rung/coverage-walk unit tests, the continuous-zoom seam tests, and the compute_tile_grid mosaic tests are deleted in the same change that deletes the code they cover; new step-index + step-canvas tests land under the re-scoped T-1157. Do NOT leave the old goldens asserting against retired frames (the T-1157 dead-goldens problem, repeated).
NEW — lake morphology sourcing (§(a.11) converged core)	new	CREATE — source the existing MorphologyZone::Lake emission from HydrologyResult's continuous filled_scaled field (bilinear per-rung sampling, seed-chaining mechanism B), replacing the ocean_fraction_q >= 60 heightmap heuristic as the authoritative Lake trigger with heuristic fallback. Self-contained; no wire change, no vocabulary change. Blocks nothing; consumes T-1177's HydrologyResult (currently prototype-only).
NEW — hydrology basin-outlet → D8 wiring (§(a.11) endorheic follow-up)	new	CREATE — thread a HydrologyResult overflow basin's resolved outlet_path/spill point into RiverNetwork/courses as a D8 downstream continuation (so an overflow lake's outlet edge appears in courses, an endorheic basin's absence reads as "no course"). Pre-cleared additive by T-1170 Ruling 7b (reserved TERMINAL sentinel; river_course::build_edges already no-op-safe on TERMINAL) — not a wire migration. This is the deliverable the endorheic-vs-overflow distinction ships on: the cue is outflow-course presence (§(a.11) FINAL — no bit, no zone), so until this ticket lands the map shows lakes but not the drains-vs-closed distinction. Required regardless (overflow lakes must show exit rivers to be hydrologically honest); the endorheic cue is a side effect of that work.

The _canvas.scale retirement path (explicit, for the implementation ticket)

Retired in the same change that lands the new two-layer component (Stig round-1 §1; sequenced so close inspection is never stranded, the T-1138 discipline):

• _canvas.scale / _canvas.position transform model + _apply_transform() (continuous scale) — replaced by the step-canvas anchor (a fixed per-step texture draw, not a continuous scale node).
• _zs() / _zs_stroke() / _zs_ring_radius() compensation family in atlas_window_geometry_nature.gd — deleted wholesale; the unscaled screen-space annotation layer makes them structurally impossible to need.
• select_rung() + MAX_COVERAGE_M + compute_tile_grid() (T-1152/T-1153 code) — replaced by the step index.
• The AtlasViewer/orbital-mosaic-vs-window two-code-path split — collapses to "the Global opener is rung 0" (one viewer, one path; global zoom is the rung-0 body-surface canvas, not a separate code path).
• _view_zoom float + _canonical_fit_zoom() continuous fit — replaced by the discrete rung index + the rung-0 (Global) canonical frame.

Surviving client surfaces (Stig round-1, not on the retirement path): _filter_for_granularity_v2() (NEAREST/LINEAR per rung still a real RTT draw-time question), atlas_window_tile_set.gd's LRU shape (right skeleton for the new client cache, plus the two-tier eviction), and the compositing/legend/overlay-bar chrome (call-site updates only, no structural rewrite).

---

Summary — 100% COMPLETE, Clerk-audit-ready

All governance calls are decided and Jeroen-ratifiable, and every cross-agent input is folded in — Dudley's interview-2 response (chunk-64 m display band + Option D + seed-chaining confirm + S2/S4) and his corrected global-tier byte number (~8.85 MB PNG all-bodies), Jeroen's Global/Region rung-identity correction (below), on top of round 2's Dudley/Araminta/Stig/Troblum inputs. No [DUDLEY] brackets and no held clauses remain. §(a.11) (lakes) is FINAL — both parts converged on both sides: (1) the core — lakes reuse the existing MorphologyZone::Lake (no new field/zone, a data-source fix) sourced from HydrologyResult's continuous filled_scaled field sampled bilinearly per rung (lake edges refine with zoom, not blocky-magnified — seed-chaining mechanism B); and (2) the endorheic-vs-overflow cue = outflow-course presence (Dudley picked Araminta's (i); no wire bit, no 18th zone). Rationale recorded: proportionality (4.63% endorheic doesn't justify permanently widening the D-239-frozen vocabulary), the outlet-wiring is required regardless (overflow lakes must show exit rivers to be honest — the cue is a side effect), and the inference is definitionally sound with no misfire (every Overflow basin has a non-empty outlet_path, every Endorheic none). Honest sequencing stated: until the outlet-wiring ticket ships, the map shows lakes but not the drains-vs-closed distinction. The stale "4-state water field" crossing is documented (superseded by Araminta's withdrawal, Dudley's doc marked SUPERSEDED-BY-CROSSING) — never adopted.

Jeroen's rung-identity correction (post-briefing-back) — folded in throughout. Round 2 conflated the map opener's spacing with its rung identity: it called Region "step 0 / the canonical tier." Corrected to six levels: rung 0 = Global (the body-surface map opener — variable extent, one gridunit per region, the D-243 elastic seam made visible; this is the canonical always-kept tier), rung 1 = Region (the largest fixed-size rung, viewport-sized and evictable like every rung below it), then District (2), Quarter (3), Block (4), Chunk (5). Corrected everywhere: §(a.0) ladder/canvas/ cache bullets, §(a.1)/§(a.2) full-zoom-out reset (→ Global frame), §(a.4) gridunit entry (Global is the one variable-extent level, fixed rungs snap to metres), §(a.6) keep-always tier (→ rung 0, not Region), §(a.8) retention floor (→ rung 0), §(b) envelope carriers (both Global and Region ride it), §(c) Option D table + snap constraints + factor note, and the T-1152 disposition. The correction makes the serving-seam story cleaner: the global/sub-global cache boundary now falls on a real rung edge (rung 0→1, the variable→fixed seam) instead of being buried in the ÷100 Region→District metre factor. Byte-math consequence (Dudley, measured): the always-kept global tier is the tiny variable region-grid canvas — ~8.85 MB PNG-encoded across all ~267 bodies (27.61 MB raw; avg ~18K cells/body), not a fixed 4K-class canvas. This supersedes the ~174 MB figure (~440× too many cells) and makes the tier trivially process-resident, not merely disk-safe — "always keep global" gets easier under the correction. Sub-global (Tier 2) is unchanged: disk + storage-eviction.

Interview-2 reworks are folded in (two changes, two ratifications):

• RATIFIED as-is: the ceiling re-scope (§(a.5)/§(b), files as drafted) and everything in the package not touched by the two reworks below.
• REWORK 1 — ladder bottom → chunk (64 m), Option D delivered: tile/voxel dropped (Jeroen: "the actual tile level rung seems unusable, maybe replace with 64"). New amendment §(a.8b) records this as a deliberate interview-2 narrowing of his interview-1 floor opening — used to chunk, tile/voxel re-closes for the Atlas (Phase-5 in-world content). Updated consistently across §(a.0), §(a.4) (the "10 px per tile" bottom-out superseded by "1 px per 64 m gridunit, no magnification margin" — Dudley's chunk bench), §(a.1), §(a.8), and §(c). Option D is the adopted ladder (six levels: Global opener
  • 5 fixed rungs Region→District→Quarter→Block→Chunk; every fixed rung measured — chunk deepest = 245.8×138.2 km / ~1.7 s parallel). Its bonus: the deepest-step canvas-sizing special case is gone — chunk uses the plain fixed-3840×2160 budget like every fixed rung (a free simplification), and its factor profile (÷100/÷4/÷4/÷2, all within the sub-global fixed ladder) is the gentlest of any candidate, strictly best for the between-step magnification flag.
• REWORK 2 — seed-chaining → "cache-accelerated pure function": Jeroen ruled he meant consuming the coarser output, not independent re-derivation. New amendment §(a.10) reconciles this with D-227 without weakening it: the definition stays pure (derive(seed, position)), the implementation may read a resident coarser canvas as an optimization with derive-fresh fallback, and it stays inside derive-don't-store because the coarser value is itself re-derivable to identical bytes (optimization, not semantic dependency — proven by a mandatory byte-identical-paths determinism test). Dudley's §(b) independent-re-derivation ruling survives as the fallback path; the benched numbers survive as the cache-cold worst-case ceiling, which closes Troblum B2. Dudley-confirmed (dudley-interview2-response.md §2): the model is D-227-sound, no chain-reaction on eviction (each rung's fallback is self-contained), and his A/B mechanism distinction is folded into §(a.10) — "consuming coarser output" means reading the coarser continuous primitive baseline (mechanism B, the shipped district-reads-region pattern) as input to a fresh classification, not reading the coarser resolved classification (mechanism A, ruled out — it would violate Araminta's categorical re-derivation rule). Acceleration magnitude is unquantified but not architecture-gating (a future impl-time measurement).

Final and record-ready (§a, §b, §c, §d) — 1 new-record draft (§(a.0)) + twelve amendment texts (§(a.1)–§(a.11), including §(a.8b)): §(a.1) D-166 corollary; §(a.2) T-1143 rulings 2/3 supersession; §(a.3) select_rung→step-index; §(a.4) D-243 gridunit; §(a.5) D-226 §2 ceiling→envelope; §(a.6) D-227 TTL-split; §(a.7) T-1170 carrier + cliff; §(a.8) D-226(d) per-request+cap; §(a.8b) D-226(d) floor→chunk (interview 2); §(a.9) D-227/D-192 cache schema-tag; §(a.10) seed-chaining (interview 2); §(a.11) lakes — FINAL (morphology-fold + filled_scaled sourcing + endorheic cue via outflow-course presence, interview 2). §(a.7) cliff cost is survey-confirmed (0/267 carve). §(c) carries the adopted Option D ladder (six levels: Global opener + 5 fixed rungs, chunk-deepest, every fixed rung measured). Deprecation sweep: 12 DQR dispositions (adds D-226 T-1143-ruling-1 narrow + the D-227 seed-chaining line)

• 10 ticket dispositions (adds the two lake tickets — morphology-sourcing + basin-outlet D8 wiring) + the _canvas.scale retirement path. No [DUDLEY] brackets, no held clauses, no open items remain — the global-tier byte total is in (~8.85 MB PNG all-bodies, Dudley measured; supersedes the ~174 MB figure, tier now trivially process-resident) and §(a.11)'s endorheic cue is finalized (outflow-course presence). The package is 100% complete and Clerk-audit-ready.

For Jeroen's final ratification (governance calls, decided text ready): (1) §(a.10) seed-chaining against his phrase "serves as seed information for the deeper cascade" — the cache-accelerated-pure-function model (mechanism B) is the reconciliation of his "consuming coarser output" intent with D-227; (2) Option D's six-level shape (Global opener + Region→District→Quarter→Block →Chunk) — the tile-drop removed the old B-vs-C fork, so this is a single confirm, not a choice. The migration is the one real chunk of new work; Dudley's code read puts it at "doable" (one Inbound variant + one SimBridge method on a pattern proven five times), with the "challenging" part in Stig's client rebuild.

Troblum's adversarial pass is now fully dispositioned: B1 (cliff survey) resolved 0/267 → §(a.7) survey-confirmed; B2 (seed-chaining) resolved by §(a.10); S2 (deep-step course density) run by Dudley — a real finding (+38%–87% cost at chunk/block vs. District's <5%, traced to course point-count scaling inversely with rung spacing; still affordable in absolute terms, flagged as an implementation consideration — a possible rung-independent station-spacing cap — for the ticket plan; the measurement is filed as the "S2 ADDENDUM" in measurements/t1178-t1154-derive-bench.md, alongside the chunk-64 m "INTERVIEW-2 ADDENDUM" — both already written by Dudley); S4 (sim-state phase cadence) resolved by a Dudley+Araminta joint formula (SIM_STATE_TTL bound to 1× the field's own driving sim bucket — tidal-or-seasonal for flooded, seasonal for glaciation; 1× confirmed cost-affordable). S1 (evict-then-revisit costing) remains a Dudley cache-spec tuning number, not a governance-text change — my §(a.6) TTL amendment already separates the two eviction axes it probes. S2's finding may warrant a one-line note in the §(a.7)/render-record wire discussion if course rendering at chunk needs the station-cap; flagging for the Clerk audit. Full adversarial-pass disposition is visible for the audit.