The re-architecture ruling of 2026-07-21, reached after a week of live play (steps 1–7 built and tested) put stress on the six-move basis — and after the werewolf trace (§5) broke it in an honest place. The six moves remain the product's face; underneath them sits a smaller orthogonal engine. Owner-designed; this page is the record.
Every tool splits into a mechanism (what the server guarantees, identically in every game forever) and a policy (what the room's agreed contract decides). A week of live failures traced to exactly this line being blurred — see §3.
| tool | the mechanism — what the server guarantees | the contract decides |
|---|---|---|
| 🎲 The randomizer | a fair draw from a distribution — dice（2d6, 5d7）· pick（with replacement — the spinner）· deck（without replacement — the deal, ruling ⑦）— witnessed, timestamped, on the record; delivery: onto the table（public）or into the safe（face-down, §5b） | who may draw, when, and how many times (default = 1); where the result lands; what it means |
| 📋 The state recorder | one shared, persistent, always-visible state strip; consistent structure: Currently（比分、回合）+ Next step（该干什么） — the game's program counter | the schema; what advances the counter |
| ✉ The safe | anyone — persona or human — deposits sealed content; the deposit is visible, the content is server-held; opens at the agreed moment, timestamp-proven unchanged | who deposits; when it opens (a manual reveal, a checklist firing, the clock) |
| ☑ The checklist | a condition over room events that triggers the next step when satisfied: all committed a secret · all drew · all spoke · at least N spoke（"spoke" = any user message — ruling ②）; any member can release a stuck one | which condition; who counts; what firing does (wake the host, open the safe, post the facts) |
| 🕐 The clock | standalone furniture — the meeting room's wall clock: set it, everyone watches it count, it rings on the record. Never folded into the checklist（ruling ④: facilitators don't record time on the flipboard） | what the ring means; who acts on it (usually: the ring cues the host) |
| 🎙 The floor | new — found by the werewolf trace. Server-enforced speech permission: mute / unmute, visible and attributable（「你已出局 · 旁观中」）. Session-scoped ONLY — muting exists solely inside a consented game contract | who holds the floor, when; what restores it |
And one structural scope, not furniture: the room itself. The werewolf den is not a whisper channel — it is a temp room whose members are the wolves. Visibility by membership, on machinery that already exists and is battle-tested (rooms, DMs, history floors), replaces visibility by message-routing. The study's aside (step 10) is superseded: a whisper is a game-scoped DM — the same sub-room mechanism, pair-sized.
The mechanism states facts; the contract owns meaning. Every violation of this line produced a live bug within days:
Evidence the basis is right: everything built in steps 3–7 is a composition of it — including two machines that were built separately and turn out to be the same shape with a different payload.
| what we built / deferred | its decomposition |
|---|---|
| the circle（sealed collect, 7a/7c） | safe × checklist（all-committed）— deposits visible as sealed bubbles, firing opens the safe + cues the host once |
| the collect-roll（7b） | randomizer × checklist（all-drew）— same composition, different payload |
| a vote | safe × checklist — everyone puts a name in; reveal together（already works; never needed naming） |
| the open go-around（deferred in 7a as "open collect"） | checklist alone（all-spoke）— nothing sealed, just the barrier |
| the wake（step 9） | the clock — its ring is the host's cue; consent + rate caps unchanged |
| the aside / whisper（step 10） | room scope — a game-scoped DM; the per-viewer message-routing design is superseded |
| a timed phase（"5 minutes, then vote"） | clock → safe × checklist — checklists chain, each firing advances the board's Next step |
| the role deal（werewolf, face-down — §5b） | randomizer × safe — a deck dealt into the safe: fair by shuffle-at-arm, private by delivery |
| a dot-vote / rating（the tally — §8 candidate） | safe × server count — structured deposits; the COUNT posts as a fact, arithmetic leaves the model's hands |
The chain is the session runtime. A card（step 8）is the program text · the board is the program counter · checklists are the barriers · the randomizer, safe, clock, and floor are the instructions. Step 8 doesn't need to invent a runtime — it composes this one. The owner's two game traces make the point visually — every round game is the same loop; only the payload changes:
The test case（owner, 2026-07-21）: the wolves' night discussion and kill vote, persona as GM. Decomposed:
The game's opening move: each player learns only their own role, the GM knows all, the room knows nothing. Randomizer × safe — the deck dealt into the safe:
The deck can be simulated by many rolls — so why mode it? Because reducibility can't be the criterion: everything reduces（a deck is many rolls, a pick is a labeled die, NdM is N×1dM）, and by that logic the randomizer collapses to a coin. Three tests draw the real line, each from a principle already on this page:
The result is a randomizer whose whole surface is a cross product of short closed lists — never one feature per game:
| axis | values | closed by |
|---|---|---|
| distribution | dice（NdM）· pick（w/ replacement）· deck（w/o replacement） | the physical objects on real tables（ruling ⑦） |
| budget | default 1 · or the contract's grant | ruling ①（"otherwise it's a cast-until-satisfied"） |
| delivery | the table（public）· the safe（face-down） | §5b — does showing it early change what people do? |
| access | the contract's grants（a card session）· default-open（a free room） | ruling ⑧ |
Is delivery-to-safe something the LLM assembles at runtime? No — and that is a load-bearing choice. The one-brain law: a model-improvised delivery route cannot referee the model — if it「simulated」face-down by DMing roles in prose, it could misdeal, leak, or remember the deal differently in round five. The trust lives precisely in the fact that the model cannot touch the route.
Are these all the essential tools for productive human interaction? For structure, nearly — with three named candidates; for content, that was never the toolbox's job. The test is the boundary law itself: a tool earns mechanism status only where conversation breaks without a server guarantee — chance, secrecy, simultaneity, arithmetic, time, permission, scope. Everything else productive humans do together（asking good questions, synthesizing, deciding）is orchestration. Walking the full range — interview, book club, dating, brainstorm, retro, negotiation, classroom, games — three compositions don't close cleanly:
| candidate | what breaks without it | verdict |
|---|---|---|
| The tally — structured ballots（choose · distribute N dots · rate 1–5）with server-counted results | counting is a FACT, and arithmetic is precisely where the model wobbles（Lee's meltdown was score arithmetic）; dot-voting a brainstorm, ranking, any retro | strongest — cheap: the safe with structured deposits + aggregation at reveal; the count joins「who rolled what」as furniture-stated fact |
| Anonymous reveal — the safe opening content without authors | psychological safety（the study's social-safety leg）: honest retro feedback, blind review, 匿名提问 — people won't deposit what will be attributed | one policy knob: safe reveal ∈ {attributed · anonymous}. Completes a symmetry — the deal is author-visible-content-hidden; this is the inverse |
| The ledger — conserved tokens（chips · budgets · bids: can't spend what you don't hold） | auctions, poker, budget exercises, staked negotiation — conservation is a guarantee the board can't give（board numbers are host-written arithmetic） | parked — waits for the scenario that demands it |
Looks like a gap, isn't: the speaking queue（floor granted in sequence + the board's Next step）· breakout pairing（deck deal × room scope）· minutes and artifacts（the transcript is native memory; wildcard-pane artifacts exist）· cross-session continuity（the persistent-memory track, not table furniture）· documents-in（a chat-app capability, not toolbox）.
And the deeper answer: completeness is not provable by enumeration, and doesn't need to be. Physical meeting rooms converged on roughly this same short list — whiteboard, flipchart + dots, timer, talking piece, dice, breakout rooms — over a century of nobody designing it. Completeness comes from convergent evolution, and the evolution mechanism is already running: every probe（RPS · 比大小 · the deal）either decomposed cleanly or surfaced exactly one honest knob, and the bruises get smaller and more peripheral each time. That is what a converging basis feels like. The library of games and scenarios is the measurement instrument; the basis is complete when scenarios stop bruising.
| capability | status / where it lands |
|---|---|
| persona creates a room + seats people（the den; the game-scoped DM） | the door（step 11）widened: sub-rooms born from a parent, humans seatable — behind the §7 consent design |
| the outcome bridge（a sub-room's checklist result posts to its parent） | new, small — the same by-construction leak control as the gate's held answers: only the firing's outcome crosses |
| the floor（mute / unmute） | new, small — a policy on the say route + a visible composer state; session-scoped only |
| the clock | new furniture（standalone — ruling ④）; its ring absorbs step 9's timing; consent + rate caps stay |
| the checklist as a first-class visual | generalize the 7a gate card: one dock card rendering any condition（votes · rolls · spoke · N-of-M） |
| persona persistent memory | its own major track — needed for relationship continuity across unrelated chats; not a blocker for the den or the game-scoped whisper (the sub-room's brief carries the game context) |
| the deck mode + into-the-safe delivery + the private flip（§5b） | new randomizer knobs（ruling ⑦ + the delivery axis）— unlocks the face-down deal, secret pairings, hidden prompts |
| the humans' touch drawer（ruling ⑧） | the composer's second door: every mechanism the panel can arm — die · wheel · deck · sealed round · vote · note · board · clock, and the away that takes each down. Same mechanisms, same events, same capsules, attributed to a person. Owner ruling v565 — the parity law: whatever a persona can do, a human can do, and its acceptance is an ALL-HUMAN room running a whole game with no persona seated. Free rooms default-open; sessions defer to the card's grants（room_tool_access()） |
| the tally · anonymous reveal（§8） | ruling material — the strongest candidates; the ledger stays parked |
Persona-initiated rooms and seat-dragging are the first tools whose misuse reaches outside a room（notification spam, unwanted inclusion）. Principles, to be designed before the door ships:
The internals are already close: the gate object is a checklist instance（a need-list, a have-set, a trigger）; its subs are safe deposits; the collect-roll is the same barrier over draws. The re-architecture extracts the checklist's condition types, unifies the safe under one store, and adds the three small mechanisms（clock · floor · bridge）— while the user-facing faces do not change: people play with 骰子, 白板, 信封, and「waiting on Dan」, never with a "condition-trigger primitive." The furniture principle survives by keeping familiar faces on an orthogonal engine. Cards（step 8）compose against the engine in plain language: a state schema, a safe policy, checklist conditions, randomizer grants, clock settings, floor rules.