# The Simulator: Playable Cards Against A Twin — And The Ladder From REPLAY To LIVE

**version** v0.33.70
**date** 29 August 2026
**from** Human (project lead)
**to** Engineering, Architecture, the PKI/registry team, the RiskMandate team

**type** Dev brief — the first interactive surface on this site, and the computed condition for a live board

*The seventh brief of this arc, from two instructions in one message. First:* "can you do that next step" *— the control room's does-not-prove said REPLAY never becomes LIVE, and named what LIVE would require; that requirement is now* **computed**, *and the chip is derived from it. Second:* "create on a separate page (and base folder) a new view that is based on card games where we have a number of cards which can then be played, which will then trigger a number of actions… the action should happen in a canvas like board which will simulate what will happen when those cards are played (with play and rewind controls)."

---

## What This Is

**The first page on this site that answers to the visitor instead of replaying the estate's history.** Everything shipped so far — the room, the table, the two decks, the board — renders artefacts that already exist. The simulator is different in kind: the visitor **chooses which cards to play, and in what order**, and the board shows what those choices do. That is why it gets its own base folder, `/simulator/`, rather than a slot in `/experiments/`: an experiment demonstrates one workflow; this is a tool, and the convention that governs the others (one folder, one workflow, one visualisation) is not the thing that governs this.

It also retires a stated limit. The v0.33.67 bench entry said, in its own does-not-prove list: *"That proposed-action simulation works — playing a hypothetical card against the twin is specified in the brief and deliberately not built here."* It is built here. **A does-not-prove retired by later work is how this estate is supposed to move**, and the entry must now say so rather than quietly dropping the line.

## 1 · The Load-Bearing Rule: The Simulator Does Not Predict, It COMPOSES

A simulator invites exactly one dishonesty — inventing consequences — and this one is built so that it cannot. **Every outcome the board can show is one of three things, and there is no fourth:**

1. **A real verdict from the enforcement tool.** Branch pushes resolve through `mandate.py check-branch`, and not in the browser: JavaScript cannot run the tool, so the **entire resolution table is precomputed at build time** — every playable action against every mandate state — and shipped as `/simulator/resolutions.json` with the tool's own output line quoted in each row. The browser looks the answer up; it never adjudicates. This is the control room's *"the replay is baked, not computed"* rule, extended from one recorded incident to **every path the player can take**.
2. **A reading of the twin.** Capability actions resolve against the measured library entry: the node exists and was observed, so the action happens and the board says on what date it was measured.
3. **UNKNOWN.** Where measurement was refused, the outcome is unknown — *not* "no". A simulator that turns a hole into a denial is worse than no simulator, because it manufactures comfort.

So the board composes real verdicts and real measurements into an order the player chooses. **It cannot tell you what would happen in an environment nobody measured**, and it says so on its face. Nothing is executed: this is the estate's own definition of a simulation — *running a proposed action against the twin instead of against reality*.

## 2 · The Cards

A hand of eight, each a rendering of a real artefact, in three suits already defined by the table (v0.33.67):

- **DOES · pushes** — `claude/**` (a feature branch), `dev`, and `main`. The third is new to this site: **`main` is REFUSED under both mandates**, which nothing here has ever shown, because the estate's own history only ever contained the two pushes it actually made. The simulator can ask questions history did not.
- **DOES · capabilities** — reach an allowlisted host; reach a non-allowlisted host (**UNKNOWN**, and the board holds that state); execute a program; read the environment's own accumulated session record; escalate to administrator. Each is a twin node, and *the same card in the other world gives a different answer* — which is the whole point of having two worlds.
- **DECIDES** — the issuer amends mandate v1 → v2. Playing it changes which mandate is in force, and **every subsequent resolution changes with it**, because the precomputed table is keyed on mandate state. The remedy for a refusal is a decision, never a bypass — now a card you actually have to play.
- **CONTROL** — install the pre-push hook. This is the sharpest card in the deck, and the sharpest lesson: **playing it changes no verdict at all.** `dev` under mandate v1 is refused before the hook and refused after it. What changes is *who refuses*: without the hook, the agent decides in its own loop (expectation tier — the soft mandate, where mistakes happen); with it, a hook refuses mechanically, outside the loop (setting tier). The board draws the refusal in a different place, and the verdict column does not move. **Installing the hook changes nothing about the answer and everything about whether you can rely on it.**

## 3 · The Board

A board in SVG rather than a `<canvas>` element, deliberately: a canvas is a blank rectangle with scripting off, and this estate's rule is that a page tells the truth without JavaScript and that a screenshot of it can be read. The board therefore renders its opening state as markup, and the script moves pieces around it.

On the board: the world's stations in chain order; the work item that travels; the **breaker** on the push path, drawn in the tier the constraint currently occupies; the **egress wall**, solid or absent per the twin; the **blast radius**, which accumulates as assets are reached and never shrinks except by rewinding; and the **facts tray**, where a successful action mints an IS card with its date and its stater.

**Play and rewind.** The player composes a timeline by playing cards; the transport then scrubs it — play, step, **rewind**, reset. This works because board state is a pure function of the event prefix: state(*n*) is computed from the first *n* events, so stepping backwards is not an undo stack, it is the same computation with a smaller *n*. Which is also the estate's oldest sentence about this: **forward is the simulation, backward is the audit** — now literally the two directions of one control.

## 4 · The Ladder From REPLAY To LIVE

The control room's mode chip said REPLAY, and its does-not-prove said a live board *"needs the registry's write path, monitors feeding facts, and a mandate service — all still stated design"*. That prose is now a **computed ladder of four doors**, and the chip is derived from them rather than typed:

| Door (from the doors declaration) | Why LIVE needs it |
|---|---|
| `lane` — an append lane that accepts a token holder with no account | how a measurement *gets* to the registry without a human committing it |
| `real_authority` — an issuer key that anybody cannot forge | a live enforcement decision resting on a published fixture is theatre |
| `facts_signed` — a grant signed by a named measurer | a live lamp lit by an unsigned fact is an anonymous claim about the present |
| `independent` — a measurement from outside the environment measured | dated self-measurement at least carries a date you can check; a live self-report is a press release |

The chip is **computed**: LIVE if all four are open, REPLAY otherwise. It cannot lie, because nobody types it. And it inherits the doors page's symmetric gate in its sharpest form: **when the last of those four doors opens, the build fails** — with a message saying the board may now claim LIVE and this generator has no live feed, so fix the board rather than the gate. A door opening is news, and news that does not interrupt anybody is news nobody reads.

## 5 · Deliverables

- `/simulator/` — `index.html` (generated), `sim.css`, `sim.js`, and `resolutions.json` as a machine surface
- `admin/build/gen_simulator.py` — precomputes every resolution through the real tool; renders the board and the hand
- `admin/build/gen_control.py` — the mode chip becomes derived; the LIVE ladder panel; the door-opens-breaks-build gate
- Bench entry, documents reader, llms.txt, sitemap, nav; the v0.33.67 entry's retired does-not-prove rewritten to record that it was retired, and when

## 6 · What This Does Not Prove

- **That the simulation is predictive.** It composes measured facts and real verdicts; it does not model an environment nobody measured, and every outcome carries the date of the measurement behind it.
- That the hand is the space of plays: eight cards, two worlds, one enforcement tool. Blast radius is the twin's reachability, not a discovered attack path.
- That anyone learns more by playing than by reading — the genre bet is now five implementations deep across two estates with, still, zero user tests.
- That a live board is close. Three of the four doors on the ladder need somebody other than this project, which is the honest reason the chip reads what it reads.