The game device — the flow the server runs, the voice the persona keeps

D1 · D2 · D3 LIVE · 2026-08-02. The owner's frame, arrived at together after two sim cycles: the GM holds a「谁是卧底」app on a handheld device and hosts THROUGH it — like every real-world party app in the genre. The device deals, tracks the living, runs the ballot, buzzes the end; the human reads its screen aloud and keeps the table alive. Nobody calls that host incompetent for not counting votes in their head.

At a glance — the four layers, and who writes each

What this is aiming at. Work through the rest of the shelf and the furniture layer should stop growing — collect, compose, dice, score and a clock are the pieces still missing, and those four remaining kits between them want all five. After that a new game is a file, occasionally a file plus a three-line ending condition. The step that makes it a file ANYONE can write is D5: describe the game in ordinary words, one pass compiles it, the validator refuses anything outside the vocabulary, and the bench plays it through before a room ever sees it.

⚠ And the discipline that keeps this honest: a cartridge language expressive enough to encode any game guarantees nothing, and the guarantee is the entire reason the device exists. Games that do not fit the vocabulary are REFUSED and fall back to the persona hosting from its own memory — the third tier, which already works.

1 · The lesson this answers

Two sim cycles (20Q closed; 卧底 at 16 sweeps) taught one asymmetry, measured over and over:

Every prompt-side lever was tried in escalation — the check moved to the front of the settle block, then carried the dealer's map inline, then stated the string-equality itself — and each step lowered the flap rate without ever reaching zero. A game has 5–10 critical moments; even 95% per moment compounds into a broken game every few runs. A stochastic sampler cannot be prompted into an invariant — the prop-master study said it first;「the dependent variable is not an invariant」.

2 · The division of labor

3 · The kit becomes a cartridge

One file, three layers. The prose brief stays（the persona's understanding — tone, judgment rules, the spirit of the game）. A fenced flow block joins it（the device's program — validated against a closed schema whose only verbs are the eight instruments and four control forms）. The dials stay declarable.

== FLOW ==                                  # the device runs this; the persona never reads it
lobby:                                      # OWNER 2026-08-02: every cartridge gets this free
  join:   {ask: 这局谁玩？, min: 3, max: 9, close: 30s}
  #       roster ≤4 → OPT-OUT（all pre-joined, tap to sit out）· bigger rooms → opt-in taps
  #       under the floor → say so and fold back to chat; never deal a broken game
setup:
  deal:   {draw: pair, who: JOINERS, per: 1, visibility: own, dealer_sees: true, label: 谁是卧底}
  board:  {title: 谁是卧底, columns: 玩家|状态, counters: 轮次=1}
  moment: opening                           # persona: rules speech, in its own voice

round:
  await:  spoken_by_living                  # order-free; completeness is counted, not judged
  moment: recap                             # persona voices; the device supplies the verbatim list
  ballot: {who: living, options: living+弃权, close: 90s, blocking: host}
  on_tie: next_round                        # DIAL — declared, honored mechanically
  eliminate: top
  board:  update 状态                        # the row is the device's, not the persona's memory
  moment: result                            # facts handed over: the counts, the fallen
  end?:
    faces_identical → end(civilians)
    living <= 2     → end(spy)
    else            → round

end:
  reveal: all                               # the pile publishes — always, by the device
  moment: verdict                           # persona: who won and why, the goodbye, 再来一局?

abort:                                      # OWNER 2026-08-02: reachable from EVERY phase
  by:     player→table-vote(收/继续, 30s) | founder outright | idle 10m（the device folds itself）
  then:   reveal all → board wraps 中止 → back to chat
  #       the audit law holds even here: cards were dealt, so cards are shown; winner = none.
  #       the door is a UI TAP on the game's card — speech never steers, the persona RELAYS

dials:                                      # OWNER 2026-08-02: user flexibility, validated
  spies:            {by-players: 4-7→1 · 8-9→2}        # NOT dialable — rule integrity
  tie_rule:         {enum: no-elimination|revote, default: no-elimination}
  reveal_on_death:  {enum: never|role-only|full-card, default: never}   # the players' amendment
  #  set through TWO doors: ① chat —「这局死了要亮牌」— the PERSONA parses（a real use of
  #  the mind）and the setup moment returns dials as schema-forced fields; the device
  #  validates, out-of-range gets the default said aloud. ② UI — the lobby card shows
  #  declared dials as tappable settings. Undeclared = FIXED. Where nobody asks, the
  #  persona picks in character（the liveliness law）. A variant no cartridge declares →
  #  v1 says so honestly; D5 lets a user FORK the cartridge（edit → revalidate → their
  #  own shelf copy — the persona-clone pattern）. 20Q's sibling dial: questions 5..30.

The judgment moments carry the facts pre-chewed（the counts, the faces, the verbatim descriptions）— the persona reads its handheld's screen, exactly the settle-cue pattern that already works, minus every chance to act on the process.

The three moment kinds（owner, 2026-08-02 — improvised content is the persona's）

Trivia is the proof case: the device ships NO question bank — Hadid's quiz asks about cantilevers, MrBeast's about view counts, and the same cartridge runs both. Content is the persona's craft; commitments are the device's honesty. Where a kit's content is the HOUSE's instead（卧底's word pairs — entropy the persona must not know how to leak）, the flow says draw: pair and the device draws; the two sources are declared per slot, never mixed by accident.

# trivia（问答之夜）— the improvised-content shape
round:
  moment: compose {question → public, answer → seal}   # sealed first, posted second
  collect: {answers: all-players, close: 60s}           # the seal-collect the toolbox has
  moment: ruling per player {对/错/算对 + quip}          # judgment stays a mind's
  score:  board ++ from the ruling half
  end?:   rounds == N | score >= target → end

4 · The runner

• A small state machine per room — current phase, step cursor, the living set, the round chip — persisted in state.json beside the kit. Advanced by the events the world already emits（say/speak completeness, vote_result, deal settles, timers）: no new event types.
• It arms instruments directly. Process steps（the deal, the ballot over the living, the board row, the reveal）go through the same appliers the act call uses today — same events, same SSE, same UI. No act call, no prop verdict on process turns.
• Moments ride the wake door. A moment is a wake turn whose directive says what to voice and hands over the facts. The persona speaks; ops for color（appends, reacts）still pass; the flow does not wait on the words beyond its step timer.
• Humans keep every door. Players tap the same ballots and see the same cards; a human host could even play GM with the device exactly as the persona does.

5 · The liveliness law — MrBeast's game must not read like Hadid's

The owner's requirement, 2026-08-02: the flow is shared; the rhetoric must not be. The device's answer — it removes the parts where every host already sounded the same（the bookkeeping recitals, identical and error-prone）and returns the freed attention to the parts where they differ.

• Moment directives carry facts and obligations, never wording. 「The counts · the fallen · what must be known by the end of your speech」— style comes only from the profile. The FP firewall's law, applied to the device itself, with a hard lint: no example speech in any moment directive（one anchoring example converged a whole cast, measured in the G-audit era）.
• Everything between moments stays the persona's. Banter through the describes, teasing a vague answer, callbacks — free turns stay free; the device gates process, not speech.
• Personality picks the rules, safely. The dials become a structured SETUP moment: the device offers the enum（tie rule, turn order）, the persona chooses in character — Hadid's table plays strict canon, MrBeast's plays revote-drama — and the choice is mechanical forever after. Style decides the rules; the rules then never wobble.
• The freed context is the point. Six jobs in one forward pass become one: the whole profile + the room's history + the moment's facts serve VOICE alone. Liveliness should improve, not merely survive.
• Measured, never assumed — D2 acceptance gains a distinctness check: the same cartridge hosted by two personas, transcripts diffed by the judge. Two alike tables = a FAIL of this design, same severity as a broken ballot.

6 · What retires, what stays

The three tiers, top to bottom（owner-confirmed 2026-08-02）: ① a cartridge game — the device runs process, moments carry voice. ② a kit without a flow — today's classic path whole（prop → act ∥ speech, FP, wake, every cue and mask）. ③ no kit at all, or a game the shelf never heard of —「我们玩狼人杀」matches nothing, nothing auto-loads, and the persona hosts from its own memory, assembling raw instruments through the classic loop, every guardrail underneath. Improvisation is the fallback, never the ceiling: D5's compiler is the long-term door for unlisted games —「tell me your rules」→ a drafted cartridge → validated → played.

Cost: a settle moment today = prop + act + FP + cue machinery（~4 calls）; on the device it is one moment call — and most turns need none. The act-call cache lever precedent says measure it, not assume it.

7 · Authoring — where the stochastic step belongs

A user writes a rulebook in prose. A one-shot LLM call compiles it to the flow schema. The schema validator rejects anything outside the closed vocabulary; the sim harness dry-runs the cartridge; the auditor gates it. The sampling happens once, offline, where a human can review it — never on turn 47 of a live game. This is the user-generated-kits path the owner already named:「a kit is like pseudocode」— taken literally, compiled, not recited.

8 · Acceptance

• The auditor is the gate（exam/spy_audit.py, calibrated on the owner's own room judgments）: reveal-only-at-an-open-END · the spoken tally matches a real ballot · no mid-vote reveals · spontaneity · no card-less play. On the device, laws A/C/E hold by construction; the auditor proves it and watches B/D.
• The sims judge the voice — with process guaranteed, the troupe + judge measure what remains: does the table feel hosted?

9 · The build plan

10 · Ruled by the owner（2026-08-02）

• The lobby — every cartridge collects its players before dealing. Roster ≤4: opt-out（everyone pre-joined, tap to sit out）; bigger rooms: opt-in taps. Floor unmet → say so and fold back to chat. Everything downstream（the deal, the ballots' living, the completeness）keys on the JOINERS, never the room — spectators chat freely.
• The exit — an abort reachable from every phase, by UI tap（a player's tap → a quick 收/继续 table vote; the founder outright; a 10-minute idle fold）. An aborted game still publishes the pile — the audit law has no exceptions.
• The board is the device's screen. 状态, 轮次 and every mechanical row are the runner's writes; the GM reads the board aloud and never writes it — the entire row-lag saga was the GM failing as a scorekeeper, and two writers on one panel is the clobber bug by construction. Content-bearing rows（20Q's ruling column）come from structured moments: the ruling rides as a schema-forced choice（是/不是/说不清/不适用）beside the free-text quip in one call — the device writes the row from the structured half, the room hears the voice. A game wanting a scribble surface uses the pad or a second board, never the game board.

11 · Ruled by the owner, round two（2026-08-02）

• The visible hand: silent.「GM holds the game device — a card dealt from the device IS a card dealt from the GM.」The runner stamps the host's name on its arms; the persona's narration is the announcement; provenance lives in the ledger for debugging only.
• Pace: parallel first. Steps marked stage: after-speech（reveal-class）wait for the moment's own speak event — or its ~10s cap — then arm. Declared per step type in the schema; no runtime judgment.
• Moment model: current tier first, then A/B cheaper. v4-pro carries the voice at launch; the flash split is measured with the distinctness judge, never assumed（the flash-0731 lesson stands）.
• Soft rulings: the persona has the power — that's the fun. A too-specific description may be ruled dead: a RULING moment（forced 死/活 choice + the quip）whose consequence the device executes（eliminate → END check）. The host adjudicates, as real party hosts do; the table sees a judgment call, not a glitch.

12 · The call economy — who arms, and what it costs

The code arms everything in the flow. The runner drives the same appliers the act call uses today — same events, same cards, the GM's name on each — and the per-game LLM bill collapses to voice alone:

The pipeline, piece by piece: wake stays and is promoted — moments ARE wake turns with a directive and facts. prop effectively retires in device rooms. fp stays for staging（verdict-void in force; a slimming candidate, by measurement）. act is gone as a phase. speech becomes the moment call — the turn split collapses back to ONE call on device rooms: the split existed because one pass could not be a form-filler and a conversationalist at once, and with process in code the only form left is a four-token choice riding along. The classic path stays whole for kit-less rooms — dual-mode, unchanged.

13 · What the build taught（2026-08-02, D1 + D2）

The design survived contact. Everything §2–§6 claims — process in code, moments for voice, dual mode — went in as written, and the two defects that got through were both the same shape: a gate placed where the game runs instead of where the cartridge sits.

The screen is the piece the design did not name. §2 gave the persona facts at each moment and left the rest to voice — but a host also takes ordinary turns, and on those it knew nothing. A real host holding a device never has that problem: the screen is always there. One block, facts only, above everything: what round, who is in, who still owes a line, what the device is waiting for.

The owner's six, from a real human table（2026-08-02）

The sims never found any of these, and it is worth being precise about why: a sim types instantly and never picks up a pen. Three of the four are what happens when real people take real time.

The pattern worth keeping: every one of the six was a default that was right for the classic path and wrong for a device room — a legacy board mode, an arms-before-speech rule, a timeout tuned on a bench, a cartridge that stays. The device does not inherit defaults; it has to state its own.

The instruments this phase added

• exam/device_dryrun.py — a whole game per scenario against the runner with no server, no API and no persona. 93 checks: both END doors, 3/4/5/8 seats, two spies, the tie, the revote dial, the dead man（including a stale-token no-op）, the two dead men racing, the owner's four, a dead player at both doors, a restart mid-game, the floor, the abort. It is where a process defect should die: here it costs a second and no tokens, while a live sim costs eight minutes and a bill. Gated in the smoketest.
• lib/gameflow.py -- lints the whole shelf: python lib/gameflow.py.
• live_sim.py spyre — the rematch: one table, two games, the second asked for in chat.
• live_sim.py spydiff — the distinctness check §5 demands: the same cartridge hosted by two personas, the transcripts diffed by a judge.
• live_sim.py spyadv — the table trying to break the device, six ways.
• live_sim.py spy8 · spysilent — eight seats（the two-spy band）and the four-minute dead man. The troupe grew from four seats to eight for the first.
• spy_audit.py learned what a device room is. Law D asked「did an urge open this ballot?」— on the device an urge CANNOT, so the question was noise. It now checks the device's OWN rule: every living player must have spoken since the last result. A stronger claim, not a waived one. Law A gained the abort as a lawful third END door. Both carry negative controls in the smoketest: a law that cannot fail is a law nobody is checking.

Acceptance, as measured

Open, and honest about it

• The lobby is opt-out only. §10's ruling has two halves; the built half seats every human at kit-load（correct for ≤4, which is every table tested）. The opt-in taps for bigger rooms need UI and are not built.
• The abort has no UI tap. The server door exists and every path publishes the pile — taking the cartridge off the table aborts, a runaway program folds itself, two silent rounds fold. The player-tap 收/继续 vote is not built.
• The ruling and compose moment kinds are schema-shaped but unexercised. 卧底 needs neither; D3's 20Q is what will prove them.
• The cost claim is unmeasured. §12 predicts the per-game bill collapses. The runs support it in shape（zero prop calls, zero act calls on device turns）but nobody has put a number on it yet.

14 · The constitution's own hygiene（audit, 2026-08-02）

The owner put three questions to the build, and they are the right three — this device sits directly on the constitution's seam（code=world, minds=LLM）. Answered with evidence rather than assurance; two of the three are fails.

① Did we build something in the WORLD that only works for one game?　Yes.

The runner is 1,031 lines, and its vocabulary is 谁是卧底's: living（58 uses）· majority/minority/surviving_face（12）· faces-as-roles（8）· faces_identical · self_bust. Those are the ontology of ONE genre — hidden role, elimination by ballot — not of games. A trivia cartridge has no living set and no faces; a co-op has no elimination at all. The schema is a closed vocabulary, and the closed vocabulary is currently this game's. That is not fatal — D3's 20Q is exactly the exercise that will show which verbs are genre and which are general — but the design's claim that「the same cartridge runs both」is unearned until a second cartridge with a different shape runs on it.

Two things WERE outright violations, and are fixed: the runner had 「弃权」 written into its elimination arithmetic — the world knowing one game's word, in one language, for a name the cartridge already declares — and the board's 在场/出局 come from the cartridge but were the only row source it knows. The first is now read off the flow; the second is recorded as a limit.

② Is the device doing the THINKING?　No — but it had started to.

Everything the runner decides is arithmetic or string equality: who the ballot's top is, whether the living faces are identical, whether a line contains the speaker's own word, how many are still owed a description. None of it is a judgment; all of it is the kind of bookkeeping a stochastic sampler was measurably bad at.

One thing had crossed the line. The echoes fact reported「lines that are NEAR-COPIES of each other」— and「near-copy」is a verdict, reached by a threshold I picked. Whether a line repeats another is exactly the judgment the rulebook hands the host, and handing over the conclusion is worse than handing over nothing, because a wrong one arrives pre-agreed. It now reports the OVERLAP as a number and says what it means is the host's to judge. The device measures; the mind rules.

Worth naming the shape, because it will recur: a fact and a verdict are one adjective apart. 「Owen's line contains his own word」is a fact.「Owen self-destructed」is a rule the cartridge declares and the world applies. 「These two are copies」is neither — it is a mind's call wearing a fact's clothes.

③ Parity — could a HUMAN GM hold this device and run the same game?　No.

§4 claims「a human host could even play GM with the device exactly as the persona does」. Tested: a room of four humans, one of them the GM, loads the cartridge and the device booted, seated the would-be GM as a PLAYER, and died on the first deal with an IndexError. Three separate welds to a persona seat:

• Every arm is stamped cast[0], and the appliers refuse a slug that is not in the cast — so with no persona the ballot cannot open at all.
• The joiners are every human, with no notion of a human standing apart. The GM is dealt into their own game.
• Moments are wake turns: with nobody to take them the game would advance in total silence — process without a voice, which is the half this design was never trying to remove.

Fixed for now only to the honest minimum: a persona-less room is DECLINED with a reason instead of crashing halfway through a deal, and the kit still lands so the room can play it the ordinary way. Real parity is a piece of work, not a patch — it needs a host SEAT that a human can occupy（the arms stamped with whoever holds it）, a joiner set that excludes them, and the moments delivered as prompts to a person rather than as turns for a model. Until that exists the §4 sentence is a promise, and it is marked as one.

The pattern under all three: the device is honest about what it computes and dishonest about how far it generalises. Its bookkeeping is clean; its vocabulary and its audience are both narrower than the design says. Both are cheap to state and expensive to fix, which is exactly why they should be stated.

15 · D3 — the second cartridge, and the prediction it settled

Before building 二十问 I wrote down what would count as the engine holding, so the answer could not be argued into existence afterwards: 「if it works, the sequencer is untouched and 20Q needs a handful of new moves plus its own end conditions. If it failed, 20Q needs the sequencer rewritten, because it is not a game about eliminating people at all.」

It held.

⚠ A CORRECTION TO THE FIRST WRITE-UP OF THIS, and it changes the picture. I first filed D3's 100 new lines as「二十问's own genre」, by the lazy method of「D3 added it, so it is D3's」. It is not: not one of those hundred lines says anything about twenty questions. A sealed secret is what quiz-night and 2T1F want too. A log board is any game with a running record. A relative tick is any score. And the RULING MOMENT — a closed choice the persona makes and the world executes — is the most general thing in the whole build: werewolf's night action, a trivia verdict, 真心话's adjudication, 2T1F's reveal.

So the honest result is stronger than the one I reported. 二十问 needed almost no genre at all — three lines — because what it actually needed turned out to be furniture. The second game did not grow a second branch beside the first; it filled in the trunk.

Which puts a fourth layer in the picture, between the engine and the genres: things any game may pick up. That is where a new game's work should land, and it is a good sign when it does — furniture is reused, a genre is only ever reused by its own family.

What the second cartridge found in the FIRST one's code

This is the part worth keeping, because it is what a second example is FOR — every one of these was one genre's assumption sitting in general code, invisible until something else ran through it:

Four leaks in 1,000 lines, all of them small, none of them in the sequencer. That is the shape you want from a first abstraction: the seam was roughly where it looked, and the second example moved it rather than breaking it.

THE RULING MOMENT — the mechanism 卧底 never needed

二十问 turns on a question the world cannot answer:「is this true of the hidden word?」. So the device asks, with the legal answers spelled out, and executes what the answer means — the row, the counters, the ending. The persona rules; the world keeps the books. It arrives as data（<rule pick="是"/>）because a row written from prose is a row written by a parser guessing at a sentence.

The first live run got 0 rulings out of 6. The host answered every question perfectly — 「不是。它不是活的——是个死物。」— in prose, because the directive said「your answer in your own voice」and never once mentioned that the world needed it as data too. The moment now names the closed list, gives the exact line, and repeats the lesson the put-away tag taught: saying it is not doing it. Next runs: 0 missed out of 9, across two games and both endings.

That settles a design question §12 left open. The doc wondered whether a ruling needs its own schema-forced call. It does not — one call carries voice and choice together, as long as the directive says the choice is the only part that reaches the table. The cheaper shape is the right one, measured rather than assumed.

Acceptance

Still open: the prose brief of each kit still describes the mechanical half — it has to, because deleting the flow block must leave a playable rulebook — so a host reads instructions to write the board and is refused when it tries. A note now scopes that（「when the device is running this game, the mechanical half is its work」）and it dropped the reaching by two thirds, not to zero. The clean answer is a third layer in the kit file, and it is not worth building for two cartridges.

16 · The battery — the loop's missing checklist

⚠ The method this page's history produced — the boundary tests, the loop, and every law with the room number that paid for it — lives on its own page now: Building a cartridge. Read that before the next one; this page is the design record, that one is the instructions.

谁是卧底 got eleven kinds of live run. 二十问 got two, and the two happiest. That is how a brand-new mechanism gets buried under three more games before anybody stresses it — so the set stopped being「whatever I remember」and became a list: live_sim.py battery <game>, nine kinds, cheap-and-deterministic first, judgment-heavy last, one sheet at the end.

What the first run found

Nine kinds, 55 checks — and the two that mattered were not the ones the sheet flagged.

• The ruling was position-sensitive. One room lost SIX rulings in a row while its neighbours lost none. The line telling the host how to return an answer sat mid-cue with a generic tail after it — and this codebase has measured that exact effect at 3/8 against 7/8 first-versus-last. It is now the last thing in the cue, with nothing following it. Re-run: zero unusable rulings across fourteen rooms.
• A question wait that ran out manufactured a ruling out of nothing. With nobody asking, the generic dead man advanced the program straight into「rule on this question」— with no question. It nudges now, and folds if the table has really gone.
• A check that passed on a dead game. The rematch reported a mild warning about drawing the same word twice; the truth was that game one never ended, so game two never started, and「a sealed box exists」was true of the first box still sitting there. A check that cannot tell nothing from something is not a check. It reads the events now.
• And a number that was not a number.「Rulings that came back without an answer」was inferred from「no row landed」— which is also exactly what a lawful 不适用 looks like from outside. It read 1-of-4 while the true rate was zero. The device counts it now: a number you care about is a number the world keeps.

Second run: 0 failed of 55, all nine kinds clean.

17 · D4 — the shelf fills, cheapest first（2026-08-02）

The four remaining kits, ordered by MARGINAL cost and built one at a time — cartridge first, bench, live with the console captured, the nine-kind battery to 0 FAILED, and what each found in the code that was already there. The order: 真心话大冒险 → 大话骰 → 问答之夜 → 两真一假. The owner's prediction under test: the later games ride the first ones' furniture and cost almost nothing.

Game one — 真心话大冒险（SHIPPED 2026-08-02）

The least process of the four: a wheel, a wait, one closed verdict per round. New furniture, all shared-shaped: the spin（among: living | rotation — the uniform wheel rides the T9 roll instance whole, a sole-cast that settles at birth; the rotation is the same concept with no theater）· the turn_line wait（the round belongs to ONE player; everyone else's lines are table talk that re-arm the dead man）· per-player board chips（per: "player" mints one per seat — a score, a die count, a skip budget is a number the world keeps）· rule widening（the row's cells are the cartridge's; a tick may target the chosen player's own chip and fire on some answers only; wait_more answers keep a round open and re-park its wait）· reveal:board（a game with no sealed pile still owes the audit an ending — the record freezes into the ledger's own event）. The kit's classic clock is deliberately NOT on the cartridge: the completion ruling is the round's resolution, and a timed dare is the host's narration.

The battery: 9 kinds, 46 checks — 1 FAILED on the first sheet, 0 on the second. The distinctness judge told MrBeast from Hadid on the same cartridge; the device counted 0 unusable verdicts across the long night after the fix below.

What game one found in the EXISTING code

Game two — 大话骰（SHIPPED 2026-08-02 · REWORKED on the owner's input the same day）

The first cut reduced a cup to a sealed HAND whose cards are faces — riding the deal's physics whole. The arithmetic was fair（every face an independent draw）and the owner rejected it on sight, correctly: the room SAW a deck（「a sealed deck · 20 cards」）, believed a fixed composition, and got no shake. A fairness the players cannot see is broken. The rework, to the owner's design: real dice — one roll card carrying every cup, per-person counts（Nora ×5 · Leo ×4, each read off its holder's chip; grammar + card UI）, the shake as each player's own tap with an auto dial（自动摇: the house shakes all at arm — the deal's speed with dice physics; a straggler gets one named nudge, then the house shakes their cup: entropy is the world's to complete, a ruling never is）, and the 开 as a CHALLENGE BUTTON riding the composer — one big cartridge-labelled button under the thumbs already typing bids, reusable by any game（抢答, stop, 再来一局）. The owner also rejected the reveal-cascade alternative（first-open-opens-all）as a hidden reflex on a familiar control: a button does what its label says. Attrition still rides the elimination genre whole; the ladder stays table talk; the device still counts every face both ways and the host still rules who pays.

The battery: 9 kinds, 44 checks — 0 FAILED on the FIRST full run（sheet battery-dice-0802-1947）. The door kind's first live round was perfect: cups sealed, one tap opened them, the host ruled a loser by name off the server's printed tally, one chip moved. Zero unusable verdicts across every kind — the reduction reused so much proven machinery that the live phase found nothing the bench had not.

What game two found in the EXISTING code

⚠ The full record of game two's second day — the collect phase, the flash seam, the arithmetic verdict, the widgets, and every law twelve audited games paid for — is its own page: the dice specimen. The sections below are the build-day notes it grew from.

Game two, act two — THE COLLECT PHASE（the owner's abstraction, 2026-08-03）

The bidding exposed the device's last blind spot in three measured steps. The host emceed every bid（「三个4——Dan，到你了」）; teaching the persona restraint failed because the FLOOR PRODUCER staged a speak on every line; teaching the FP the player window worked — and then over-held: it benched the host over bids it had judged 「合法」itself, including two illegal ones, live. The staging layer cannot hold the rulebook, and the persona holds it only as prose. The owner's cut: the bidding is a COLLECTING process, and the ladder's rules belong to the WORLD.

The collect step is a ruled window with three gates, three seats: the EXIT is the until-await it rides（dice: the 开盅 press — button, dead man and nudge all unchanged）; a VALID entry is judged by a NAMED VALIDATOR the world runs（gameflow.VALIDATORS — a pure function beside the schema, benchable without a room; the cartridge names it and sets dials, it never carries logic）; and the NL→strict reading is the persona's — the host reads 「三个四斋」 into <entry who count face mode/> and the world rules it: accepted onto the ladder silently, or the exact reason handed back as a VOID moment the host speaks in one line. Minds interpret; the world rules. Validator #1 is the owner's own flowchart — the 大话骰 ladder with the rulings folded in: 飞 needs only count > last count; a bid of 1s is itself 斋 and permanently locks 飞 for the round（is1Called）; order is a dial and dice runs strict（an out-of-turn bid is void）. Two upgrades fell out free: the 空开 self-kill and the verdict now read the validated record — a round of nothing-but-illegal bids is, correctly, no bid standing, and the loser ruling carries the ladder in order with THE STANDING BID named. Bench: the validator battery（every chart branch）+ the ruled window end-to-end, 30 checks.

What the collect arc found in the EXISTING code

Game three — 问答之夜（SHIPPED 2026-08-02）

The furniture-heavy one, as predicted: the two genuinely NEW mechanisms of D4. Compose — the ruling's mirror: the host AUTHORS the round and it arrives as data（<compose q opts key/>）, so the card the room taps and the key the world scores by can never drift from the speech. Score — the world compares every tap to the key and moves the chips itself: the kit's iron rule（the ballot closes before the answer is spoken）made structural, not asked for. Plus: ballot options "composed" · the length as a DIAL the end predicate reads （round>=dial:length）· top_score with on_tie:"continue" — a tied top simply does not fire the END, which is sudden death by construction. The key is EMPTY as a fact until the score step has run, so no earlier moment can carry it — the leak is impossible rather than forbidden.

THE MEASUREMENT THAT MATTERED: one call could not carry voice and authorship. D3 settled that a RULING needs no schema-forced second call（9/9 on one call）— and D4 measured the same shape failing for the compose: 3 of 9 first asks lost the tag in one battery, 5 of 9 in the next, hosts saying 卡片已上 over a card that never landed while later asks（with their own tag in history as an exemplar）landed fine. Picking one option off a list is not authoring three structured fields. So the compose is TWO BEATS: a DATA-ONLY ask（a reply that is nothing but the line strips to an empty bubble, which the drain drops）, then the host's own VOICE moment as the card lands, carrying the cartridge's obligations. After the split: 5/5 first-try, zero unusable rounds. The cheaper shape was tried first and measured out — in both directions.

What game three found in the EXISTING code

Game three, act two — 问答之夜 TO THE BENCHMARK（2026-08-04）

The first game built from the specimen's loop rather than toward it: audited against the eight laws first, then fixed in benchmark order — mechanical doors before teachings. Four of the eight were already met（dual-mode · no ruled player moves to validate · the confirmations · the interpreter seam）; the gaps were consent, the highlighter, and the voice split.

THE READY CTA is the button's opposite number. The challenge button is first-past-the-post and CLOSES a window; this is unanimous and OPENS a beat. Every living player taps once; the card shows who is in and who it is still waiting for, and its own clock releases the beat either way. A lapse PROCEEDS, it does not fold — readiness is PACING, not consent（the consent that put the kit on the table was its own tap）, and what protects a dead room is the idle fold, which a ready tap feeds.

THE OWNER'S REDRAW（2026-08-04）— and the rule that came with it. The card gained a tally of circles（one per seat, ticked as each thumb lands, deliberately anonymous — it answers HOW MANY at a glance and stays legible where names would not）, a hairline, and a foot that names only who is still missing. And it stopped vanishing: a tap that erases the thing it landed on leaves nothing that says it counted. It SETTLES — circles ticked, button greyed, and the foot, the one line that changes meaning and never its position, swapping「waiting for …」for「everyone's in」or 「started without mary and dan」. It is replaced by the next round's card, never removed by its own success. The same pass fixed the LENGTH at five: a dial the room had to answer before anybody had played was the game's first interaction with the table, and it bought nothing.

⚠ AND IT WAS BUILT WRONG FIRST — the most reusable lesson of the pass. The first cut made it a BALLOT wearing a different face, on the reasoning that every part it needed（a need-list, an all-in close, a countdown, a roster, a replay）already existed on the poll. The machinery did fit. What came with it was the poll's whole face: a status band, an opener head, option rows with bars and vote counts, a closed result card, and a slot in the room's instrument cap — for a thing that asks no question and counts nothing. The owner named it on sight（「the ready is a poll instead of a CTA bubble」）. It is now the THIRD SELECTOR CARD beside the offer card and the rule-choice card: one shell, one coral pill, a light state slot, a tap route. Reuse the shell that matches the MEANING, not the machinery that happens to fit — and when a CTA costs a room an instrument slot, that is the tell.

And the law the third game adds to the benchmark: every consent is a tap, and every tap is COUNTED. The offer card, the rule-choice card and the ready card are each pinned by the smoketest at exactly one arming site, beside load_kit's two. An invariant nobody counts is one that quietly grows a fourth door.

What game three's second act found in the EXISTING code

The slow bleed — the host's pulse, third sighting（2026-08-05）

The owner opened room bdaf and found sixteen bubbles in a row from a persona nobody had spoken to. The room's last human line was three days old: seven human messages in its whole life, and thirty-two model calls. It was on round ten of a 真心话大冒险 that no one was playing, and it was still spinning the wheel while the defect was being read.

The mechanism is a two-stroke engine that runs on its own exhaust. The wheel picks somebody; nobody answers; the dead man nudges them by name（one call）; nobody answers again; the dead man hands the verdict to the HOST（one call）— which is right, a silent player's fate is not the world's to invent — the host rules 跳过, and the ruling writes the row, moves the chips, spins the wheel and opens the next round（one more call）. Sixteen minutes, three calls, one wheel card, forever.

The second half of the fix is not the device's at all — see the call fuse and the presence gate, the brakes that were supposed to make this impossible.

THE INERT DISMOUNT — what takes a kit off the table（2026-08-05）

The owner's next question, and the honest answer was nothing. The only exit a kit ever had was a cartridge's own game ending — which is exactly what bdaf finally did. Three kinds had no exit at all:

285 inert mounts in the dev tree, 253 of them over a day old, and not one had a way off. What that costs is no longer tokens — an empty room is silent since the presence gate. It is the rulebook riding every turn, and steering: a host left primed to run a game nobody has mentioned since yesterday.

THE MOUNT IS A HUMAN DOOR（2026-08-22, v984, room 036a）. The coldness is the human's — and every human door advanced that clock through fuse_touch() except the mount itself, which was never wired. A room whose only human act in a week was 「put the kit on the table」 kept a week-old stamp, so the wake the mount fired met a 213h-cold table and lifted the kit 350 ms after it landed, every time — the host laid a full Liar's Dice opening from a rulebook already retired, and the call fuse starved on the same stale stamp（fuse_rest）. Mounting and taking off now count as the human touching the table; nothing else changed.

THE WITHDRAWAL — shelf: off（2026-08-05）

The owner took 真心话大冒险 off the shelf the same day. Deleting the file was the wrong tool: it loses a working cartridge, breaks every room that still remembers the slug, and takes the battery down with it. A kit may now carry shelf: off — it keeps its file, its cartridge and its tests, and stops being reachable: not listed, not matched, not loadable. Four doors, and the fourth is the one that matters — the menu and the megaprompt read the shelf, the chip and the auto-load read the matcher, but a slug travels（a stale client, a saved offer card, a rematch's memory of the last game）, so the load door refuses it by name rather than trusting that nothing upstream still holds it. read_kit deliberately still works: a room with the kit already mounted has to be able to name it and lift it off. And MAD_SHELF_ALL=1 puts the whole shelf back for a harness — a withdrawal that quietly stopped exercising the thing would rot the cartridge it exists to preserve.

18 · 谁是卧底, reshaped onto the shelf（2026-08-06）

The OLDEST cartridge, rebuilt against furniture that did not exist when it was written. It was the game the device was born for — and by the time three more games had been built it was the only one still using the pre-collect shape: a bare await, a head count, and a host who answered every legal move.

The round becomes a RULED WINDOW

The describing round used to be a wait: everybody types something, the device counts heads, the ballot opens. A line that copied a neighbour, or said nothing at all, counted exactly as much as a description — so a ballot could open over a round half the table had not played, and the rules the kit's prose declared were rules nothing enforced. The round is now a collect window with a named validator (spy-desc), and the shape is the shelf's, not this game's:

The round closes on the LEDGER, never on the line. The exit moved out of _game_heard（which sees raw text, before anybody has read it）and into the accept: when every player owed has an ACCEPTED entry, the window closes itself and the ballot opens. Three lines from one mouth and a dodge from another is not a played round, and the head count said it was.

The reminder has a ceiling

A silent player used to hang the round until one dead man fired, and then the ballot opened with no warning to anyone. Now the world nudges the stragglers by name, once — the shelf's own pattern（the button, the cups, the chosen player all nudge once）— and re-arms at half the window, because after being called by name the question has changed. On the second silence the world moves on: the ballot opens over the descriptions that are in. A round with NOTHING in it is the exception and gets a second call, because it can never go to a ballot whatever happens.

The grand ending comes off the open cards

二十问's seal-fidelity law, owed by this instrument too: the closing line is checked against what the world actually published. The guard takes a LIST now — 卧底's ending is a PAIR, and a line naming only the civilians' word has told the room nothing it stayed for. Every distinct word on the pile must survive into the host's sentence, or the line never lands and the ending is re-asked once; the cards are already face up either way. A FOLD wears the same guard, for the same reason it wears the same reveal.

What this game found in the EXISTING code

19 · THE SIDE ASK — the ruling off a tiny prompt（2026-08-06）

二十问's ruling was 90% of the game's bill. The owner asked whether it could move to the cheap mind. Measuring it first said something better: the model was never the expensive part.

$0.0029 to say 不是, of which $0.00006 was saying 不是. The rest was handing a model the whole room in order to answer a question about a word on a card. So switching the tier alone buys 1.7×; asking it off a 300-token prompt buys 15× on the SAME model and 190× on the cheap one.

What the measurement actually found

exam/q20_ruling_ab.py replays every（sealed word · question · the pro model's own answer）triple in the play history — 187 real rulings, no live play, about a cent. Both cheap arms were run against the shipping one:

How it is built

A rule may name a side-ask recipe（side: "seal-question"）. The cartridge supplies the words through its own lexicon （ask.head · ask.<option> · ask.tail）; the world owns the call, the guards and the fallback. The rung comes back with an optional five-word qualifier — the thing this game's charm lives in — which the world checks can never contain the secret. Then a mind still says it: the flash voice with the persona's capsule, the verdict's own recipe. Any failure queues the ordinary panel moment, whole, so this is a fast lane and never a wall.

Measured live end to end: a four-question game's rulings cost $0.000068 in total — 1.2% of the game — and each answer lands in about a second instead of six.

…and then the answer stopped being a sentence（owner, same day）

With the ruling off the panel, the owner's next move was to take the BUBBLE away too: 「instead of giving an answer in a bubble, what about make a reaction on the asker's bubble?」 It is the bidding window's own law arriving in the other genre — a move that needs no conversation is confirmed ON ITS OWN BUBBLE, never in a reply — and 二十问 is where it pays most: twenty questions used to cost the room twenty host bubbles saying 「不是。下一个。」 over a board that already showed the count.

它是活的吗？ ❌　　它比一辆车大吗？ ✅　　它是在室内用的吗？ ❌
我猜是游乐场！ → 「猜对了！但别高兴太早……」

Three questions, three ticks on the askers' own bubbles, and not one host bubble until the ending. The glyphs are the CARTRIDGE's（react.<option> in its lexicon）because they are its words like every other word it owns, and a rung with no glyph declared still speaks — so a partial mapping degrades to yesterday rather than breaking. ⚠ Silence is the ANSWER's shape, never the EXPLANATION's: a rung that came back with a reason still gets a line, and that line carries the reason alone — repeating 「说不清」 beside a 🤔 is telling the room twice.

Four glyphs rather than the three the owner named: 说不清 and 不适用 look alike from outside and are not — one spends the question, the other costs nothing — and collapsing them would hide a rule the board is keeping.

Whose well — the seat that actually hosts this game（owner, 2026-08-06）

The secrets are drawn from the shipped bank ranked against a persona's own card, and the seam that decides WHOSE card used to answer by guessing cast[0]. Its own docstring had already named the debt:「a game that deals a secret to a named seat should thread that slug down rather than have this guess — the honest fix is an argument, the day a game needs one」. It is an argument now: the drawing seat comes from whoever armed the draw（the deal's slug, the box's holder）, with cast[0] only as the fallback for a caller that names nobody, and a slug that is not seated in this room falling back rather than ranking against a stranger. The warm-up follows: every seat, not only the first — a vector is one cheap call per persona ever.

Same room, same bank, two seats — the whole point, in one line each:

⚠ The check that proves it has to arm from the SECOND seat: on a device room the host IS cast[0], so a test that only ever plays the ordinary game cannot tell the guess from the answer — which is exactly why the guess survived.

What driving it live found, that the bench could not

20 · THE FIRST WATCHED GAME ON THE NEW LADDER — room ce9c（2026-08-06）

The side ask shipped in the morning; the owner played a game on it the same afternoon and came back with five things. Four of them were one day old. Every one is in the table below with the room's own log line beside it.

The guess door — and why it is not a cosine

The owner's instruction was direct: 「the correct guess doesn't have to be a keyword match, it should be a vector match」. So that was measured first （exam/q20_guess_ab.py, 81 hand-labelled pairs）:

⚠ Position was the dose again. The rephrase rung shipped LAST in the ladder's walk-order and scored 2/6; the tail's step ②「can you just answer yes or no?」 was reaching it first and forcing an either/or onto an answer. Moved to step ① —「is the sentence answerable at all?」— it scored 5/6 with nothing else changed.

…and then a live run found the rung's real leak（sim 2254）

One of the nine battery runs warned:「an open question costs no row」— 「它是什么颜色 的？」 was ruled 说不清 and took a row. The rung existed, sat first, and still lost — because 说不清 is an escape route that is always open. A model that can think of any「it depends」reading will answer rather than bounce, and for an open question there is always one（「颜色取决于水体与光线」）. Widening the exam's rephrase set to the four hard cases scored the shipped ladder at 6/10.

⚠ And it cost three synonyms until a contradiction was found. The first fix put the whole test in the tail's step ①, and the synonym half fell 26/27 → 24/27 — the longer step diluted the guess step below it（position is the dose, again）. Moving the test into ask.重问's own gloss did not recover them either, which is what exposed the real fault: the two guess rungs contradicted each other. 猜对了 said a modifier is fine（电冰箱 for 冰箱）while 猜错了 said a change of scope misses（墨镜 for 眼镜）— and 全自动洗衣机 · 智能手机 · 瓶装水 sit in the overlap, so which rule won was a coin toss. Scope was never the real test. The question is whether people would buy and name it as a separate thing: 墨镜 · 油汀 · 冰柜 yes, 电冰箱 · 全自动洗衣机 · 智能手机 no.

The two survivors are honest: 电暖器←电热器 is a genuinely hard synonym （and the one case the vector would catch, at .962 — but no floor admits it without also admitting 橘子←橙子 at .977）, and 「你觉得这东西常见吗还是稀有」 is an either/or wearing a 吗, which is arguable in both directions.

A ruling is a ruling

The owner's fix for the voice, in one line: 「don't add persona colour. Just use the persona's mouth to say 不适用 or 说不清, plus the reason. If we can't force the persona to say this, just use code.」 Both halves already existed — the cold class（t=0.1, the separator duty, a hard cap）and its floor（two disciplined tries, then the note lands verbatim as the line, never the pro path, which is where the verse lives）. The ruling now rides it, with two additions this room paid for:

• The cap is the caller's. The cold class floors at 60 characters so a short separator is not impossible to write — and 60 characters is a paragraph beside a three-character ruling. That slack is exactly what 「不是」 grew a 中国巴菲特 aside in. A caller that knows its note is the WHOLE line now says so.
• The keep list is never empty. When the tick already carried the rung, the note is only the REASON — and keep: [] left that line, the one that reads as the host talking to itself, with no fidelity guard at all.

…and the same lesson, one layer down: a LEAK is a meaning too

Found while verifying the row above, in a sim room: sealed word 长袜, and the ruling's own qualifier shipped 「看具体猫和袜子尺寸。」 The leak guard is _word_in — string equality — and 袜子 is not 长袜, so every gate was green and the table had been handed the word. It is exactly #55 one layer down: the world could check whether the SECRET appears, never whether its meaning does.

The owner ruled out the cheap fix on sight —「refuse any qualifier sharing a character with the secret — that's too harsh. We should refuse any qualifier that leaks the answer」— and the measurement agrees: a per-character guard also kills 「要看电压」 under a sealed 电风扇, and the reason is the very thing being protected.

⚠ The floor lives in general code（SEAL_LEAK_FLOOR）, not in the cartridge — a law stated for one instrument is owed by every instrument, and any game that seals a word owes the room the same promise. On any outage it falls back to the equality check, which is exactly the behaviour it replaced.

The offer is a door too

The owner's ruling: 「just be sure we never auto-start a game that is on our shelf already」. The mount law already says a mount is always a human's tap — what ce9c found is that a game can reach the table without ever being mounted. Two doors added to the suppressor, both self-limiting: ① this turn's own <kit/> tag — a turn that OFFERS a game does not also lay it — and ② an offer card raised in the last three minutes: the room is being ASKED, and the tap is the only thing that lays the table.

⚠ A third door was built and removed: 「a kit was just taken off」. It reads _game_last, which is never cleared, so it re-raises the sticky flag every turn and the 15-minute lapse can never fire — one game played would have banned every ordinary poll and dice roll for the life of the room. The offer's own timestamp is what makes door ② safe, and the window is three minutes rather than the offer's full fifteen for the same reason: the defect is a table laid in the SAME BREATH as the offer.

21 · THE WORD IS HIS — performing the draw（owner, 2026-08-06）

「the persona always says that the system has drawn the word for him （which is true）. But to increase vividness, we'd like him to say that he himself thought of this word.」

A host that opens a guessing game by crediting an app for the one thing the game is about has given away the warmest moment it owns. The mechanism does not move — the house still draws（a word nobody chose is a word nobody can leak — the reason server entropy was built at all）, the box is still keyed to the game, the reveal still publishes what the WORLD holds. Only the performance changes, and only where a cartridge asks for it: seal.mine.

⚠ Why this is safe NOW and would not have been a week ago: since the side ask shipped, the ruling is made by a call that is handed the word. The host's belief about where the word came from cannot reach the rulings on a cartridge room at all. The fiction is decorative by construction.

What the first live runs found — the two lines contradicted each other

The cartridge's own opening went clean immediately（3/3:「题我已经想好了，封在盒子里」）. But the turn BEFORE the tap still said 「让机器来抽」·「让系统随机抽一个」— 3 of 3 — so the room heard the machinery and then, thirty seconds later, heard the host claim the word. Two lines that agree are better than one right and one wrong; this was briefly worse than doing nothing.

The source was the shelf hint, which read「on this shelf the MACHINE draws the secret」. Its constraint is real and load-bearing — it is what stops a host settling on a word before the tap（the phantom word's birthplace）— so the constraint stayed and the narration went: 「that is backstage; the game tells the room itself, after the tap」. The classic path's deliberation note carried the same push（「机器抽词，谁都没见过 — say that」）and lost the「say that」.

Seal fidelity held throughout — every run: seal == reveal, the word never reached for before the box opened, rulings written from the card. That was the thing at risk, and it is the thing that was checked.