SPEC_ID: CivOS.CityControlTower.OnePanel.v1.0
TITLE: Universal One-Panel Control Tower for Any City (Z0-Z6)
MODE: Almost-Code
OUTPUT_RULE: Code-Only
VERSION: v1.0
STATUS: Canonical Runtime Panel
DEPENDS_ON:
  - CivOS.CityLawPack.Global.Z3-Z6.CF.v1.0
  - CivOS.CityOS.Pack6.Z0-Z6.CF.v1.0
  - CivOS.CityOS.DeltaPack.RequiredAddOns.v1.0
PURPOSE:
  Provide one fixed, repeatable control surface that can run:
    - any city
    - any Z-level
    - any law cluster
    - any collapse mode
  using the same CivOS grammar.
CORE_FUNCTION:
  Sense -> Classify -> Fence -> Repair -> Verify -> Reclassify
RUNTIME_INHERITANCE:
  - Lattice
  - VeriWeft (VWF)
  - Stacked Invariant Ledger (SIL)
  - ChronoFlight (CF)
  - FENCE
  - AVOO
  - ERCO
  - ChronoHelmAI
CANONICAL_BANDS:
  NegLattice:
    Meaning: Below safe corridor; active failure or high probability of irreversible drift
    Condition: One or more critical invariants breached OR active CM
  NeuLattice:
    Meaning: Functional but strained; corridor is narrow or under load
    Condition: No hard breach, but key sensors near thresholds
  PosLattice:
    Meaning: Stable enough for continuity, repair dominance, and selective widening
    Condition: Core inequalities hold with usable headroom
COLLAPSE_MODES (3-only):
  CM0:
    Name: NoneActive
    Meaning: No dominant collapse mode currently active
  CM1:
    Name: TransferBreak
    Meaning: Node/bind continuity failure; corridor snaps or decouples
  CM2:
    Name: BufferBreach
    Meaning: Time / money / maintenance / reserve depth exhausted
  CM3:
    Name: SignalCorruption
    Meaning: Wrong model, delayed truth, or misaligned sensing blocks repair
PRIMARY_PANEL_OUTPUTS (must always exist):
  O1: CityBand
  O2: ZBandStatus
  O3: ActiveCollapseMode
  O4: TopLawStress3
  O5: WeakestSensor3
  O6: FenceState
  O7: TopRepairMoves3
  O8: TimeToThreshold
  O9: ConfidenceBand
  O10: RecheckWindow
INPUT_SCHEMA.v1:
  RequiredInputs:
    CityID
    TimeSlice
    Z0_Status
    Z1_Status
    Z2_Status
    Z3_Status
    Z4_Status
    Z5_Status
    Z6_Status
  Each_Z_Status_Contains:
    Band
    ActiveCM
    SensorReadings
    TopLawStress
    LedgerBreaches
    FenceTriggers
    RepairState
    Notes
  SensorReadings:
    S01 NodeContinuity
    S02 BindQuality
    S03 RepairLatency
    S04 BufferDepth
    S05 ChoiceLoad
    S06 TrustSignal
    S07 InfrastructureRedundancy
    S08 TalentTransfer
    S09 CostPressure
    S10 GovernanceCoherence
    S11 SocialRegeneration
    S12 ExternalDependency
PANEL_LAYOUT.v1:
  PANEL.HEADER:
    Fields:
      - SPEC_ID
      - CityID
      - Archetype
      - TimeSlice
      - CurrentBand (overall)
      - CurrentPhaseRead
      - ConfidenceBand
      - RecheckWindow
    Purpose:
      One-line executive read
  PANEL.ROW_A: OVERALL CLASSIFICATION
    A1 CityBand:
      Values: {NegLattice, NeuLattice, PosLattice}
    A2 DominantCollapseMode:
      Values: {CM0, CM1, CM2, CM3}
    A3 DominantLawStress:
      Values: subset of {L01..L15}
    A4 TrendDirection:
      Values: {Improving, Stable, Narrowing, Deteriorating}
    A5 TimeToThreshold:
      Meaning: estimated window before next likely fence or breach
  PANEL.ROW_B: Z-BAND AGGREGATION
    B1 HumanCarrierBand:
      Aggregates: Z0 + Z1 + Z2
      Meaning: person / household / district corridor health
    B2 SystemBand:
      Aggregates: Z3 + Z4
      Meaning: city systems + macro governance corridor health
    B3 ExternalInterfaceBand:
      Aggregates: Z5 + Z6
      Meaning: global interface + civilisation-node corridor health
    B4 DominantCrossZFailure:
      Values: {None, UpstreamCompression, MidStackDecoupling, BaseHollowing, ExternalShock}
    B5 ActiveBindBreak:
      Values: named corridor break if any
  PANEL.ROW_C: SENSOR STACK
    C1 WeakestSensor3:
      Output: worst 3 sensors by threshold proximity / breach severity
    C2 ImprovingSensor3:
      Output: top 3 recovering sensors
    C3 SensorConflict:
      Meaning: where surface signals disagree with structural signals
    C4 SignalQuality:
      Meaning: trustworthy / mixed / degraded
    C5 TruthLatencyRisk:
      Meaning: whether signal is arriving too late to repair
  PANEL.ROW_D: LAW STACK
    D1 TopLawStress3:
      Output: top 3 active laws under pressure
    D2 LawHolding3:
      Output: top 3 laws currently stabilising system
    D3 SingleCorridorRead:
      Output: whether valid options are narrowing toward one path
    D4 BorrowedLiftFlag:
      Boolean: True if surface performance depends on hidden drawdown
    D5 FrontierPermission:
      Values: {Blocked, Narrow, Conditional, Open}
      Rule: only allowed when PosLattice + CM0 + reserve headroom
  PANEL.ROW_E: FENCE + REPAIR
    E1 FenceState:
      Values: {Standby, PreFence, ActiveFence, PostFenceRecovery}
    E2 TriggeredFencePoints:
      Output: named fence triggers active now
    E3 TopRepairMoves3:
      Output: three next actions only
    E4 RepairSequence:
      Output: which stage of R0-R7 the system is in
    E5 DowngradeOrReentry:
      Values: {Hold, Downgrade, PartialReentry, FullReentry}
  PANEL.ROW_F: LEDGER
    F1 ActiveLedgerBreaches:
      Output: breached invariant ledgers now
    F2 MostImportantUnreconciledGap:
      Output: one gap preventing re-entry to safer band
    F3 ReserveRentStatus:
      Values: {Healthy, Tight, Borrowing, Breached}
    F4 LedgerDirection:
      Values: {Reconciling, Flat, Diverging}
    F5 VerificationStatus:
      Values: {Unverified, Partial, VerifiedUnderLoad}
  PANEL.ROW_G: COMMAND OUTPUT
    G1 ExecutiveRead:
      One sentence structural read
    G2 Next7Days:
      1-3 operator moves
    G3 Next30Days:
      1-3 structural moves
    G4 MustNotDo:
      1-3 forbidden moves that worsen failure mode
    G5 EscalationRule:
      when to move from local repair to macro intervention
OVERALL_BAND_CLASSIFIER.v1:
  Inputs:
    - Z0..Z6 bands
    - Active CM counts
    - Critical ledger breaches
    - Sensor threshold severity
  Rules:
    Rule1:
      If any critical Z0-Z3 invariant is hard-breached
      AND repair path is not active
      -> CityBand = NegLattice
    Rule2:
      If CM1 or CM2 or CM3 is active at 2+ adjacent Z-levels
      -> CityBand = NegLattice
    Rule3:
      If no hard breach
      BUT 2 or more core sensors are inside warning corridor
      -> CityBand = NeuLattice
    Rule4:
      If RepairRate >= DriftRate
      AND BufferDepth above minimum
      AND no critical unreconciled ledger breach
      -> CityBand = PosLattice
    Rule5:
      If surface Z5-Z6 is strong
      BUT Z0-Z2 is weak
      -> downgrade overall classification by 1 band
      Reason: base hollowing takes precedence over shell performance
Z_BAND_AGGREGATION_RULES.v1:
  HumanCarrierBand:
    Source: Z0 + Z1 + Z2
    PrioritySensors: {S04, S06, S11, S03}
    HardFail:
      - Z0 Neg + Z1 Neg
      - OR active CM2 at Z0/Z1 with no repair
  SystemBand:
    Source: Z3 + Z4
    PrioritySensors: {S07, S10, S03, S04}
    HardFail:
      - Z3 Neg on infrastructure continuity
      - OR CM3 at Z4 causing misrepair
  ExternalInterfaceBand:
    Source: Z5 + Z6
    PrioritySensors: {S08, S12, S06}
    HardFail:
      - external dependency shock with no reserve route
      - or shell detaches from base for 2+ cycles
DOMINANT_COLLAPSE_MODE_SELECTOR.v1:
  RuleA:
    If S01/S02 failures dominate and named binds are broken -> CM1
  RuleB:
    If S04 collapse, reserves exhausted, maintenance debt rising -> CM2
  RuleC:
    If S06/S10 low trust, S03 delayed, wrong corrective model -> CM3
  RuleD:
    If multiple apply:
      PriorityOrder:
        1) CM3 when wrong model is causing false repair
        2) CM2 when buffers are near irreversible depletion
        3) CM1 when break is local and reparable
  RuleE:
    If none dominant -> CM0
TOP_LAW_STRESS_SELECTOR.v1:
  Compute:
    For each law L01-L15:
      LawStressScore = f(sensor breach proximity, ledger conflict, trend direction, cross-Z spread)
  Output:
    Select top 3 scores
  MandatoryFlags:
    - L07 SingleCorridorLaw must appear if valid options are collapsing
    - L09 BorrowedLift must appear if shell > base for 2 cycles
    - L11 VesselFirst must appear if human carrier or institution carrier is overloaded
    - L15 only appears when rupture window is close, not merely because of fear/noise
FENCE_ENGINE.v1:
  States:
    F0 Standby
    F1 PreFence
    F2 ActiveFence
    F3 PostFenceRecovery
  TransitionRules:
    F0 -> F1:
      if any sensor enters warning corridor with accelerating deterioration
    F1 -> F2:
      if threshold crossing likely before normal repair window
    F2 -> F3:
      after overload truncated and core continuity preserved
    F3 -> F0:
      only after verification and stable re-entry
  FENCE_OUTPUT_ACTIONS:
    - Truncate overload
    - Freeze expansion
    - Downgrade optional load
    - Protect core service nodes
    - Route to minimal safe corridor
    - Stitch back in phases, not all at once
REPAIR_ENGINE.v1:
  SharedRepairStages:
    R0 Detect
    R1 TruncateOverload
    R2 PreserveCoreContinuity
    R3 RebuildBinds
    R4 ReconcileLedger
    R5 RestoreBuffers
    R6 ReopenValidCorridor
    R7 WidenOnlyAfterProof
  MoveLibrary (top-level categories):
    Mv01 RestoreBuffer
    Mv02 RepairBind
    Mv03 ImproveSignal
    Mv04 ReduceChoiceLoad
    Mv05 AddRedundancy
    Mv06 ProtectRegeneration
    Mv07 ReduceExternalConcentration
    Mv08 DowngradeAmbition
    Mv09 MaintenanceFirst
    Mv10 ReconcileLegitimacy
  TopRepairMoves3 Rule:
    Output max 3 moves
    Must include:
      - 1 immediate stabiliser
      - 1 structural repair
      - 1 preventive anti-relapse move
TIME_TO_THRESHOLD_ESTIMATOR.v1:
  Purpose:
    Estimate remaining corridor before next likely breach
  Inputs:
    - trend direction
    - sensor velocity
    - current headroom
    - repair latency
  OutputBands:
    T0: Immediate (0-7 days equivalent)
    T1: Short (1-4 weeks equivalent)
    T2: Medium (1-6 months equivalent)
    T3: Long (6+ months equivalent)
  Note:
    Use relative chrono windows, not false precision
CONFIDENCE_BAND.v1:
  High:
    Multiple aligned signals, ledger confirmed, trend stable
  Medium:
    Main pattern clear but some signal conflict
  Low:
    Surface and structure disagree OR truth latency too high
  Rule:
    Low confidence should reduce frontier permission automatically
EXECUTIVE_READ_GENERATOR.v1:
  Format:
    "<CityID> is currently in <Band>; the dominant risk is <CM>;
     the system is narrowing/widening mainly through <TopLawStress1>;
     next safe move is <TopRepairMove1>."
  Constraints:
    - One sentence
    - Mechanism-first
    - No persuasion language
    - No moral framing
MUST_NOT_DO_ENGINE.v1:
  If CM1:
    MustNotDo:
      - add new complexity before bind repair
      - increase optional load
      - assume shell strength fixes broken transfer
  If CM2:
    MustNotDo:
      - spend reserves on prestige/frontier
      - delay maintenance
      - conceal depletion
  If CM3:
    MustNotDo:
      - punish symptoms while preserving wrong model
      - overtrust surface dashboards
      - suppress truthful telemetry
ESCALATION_RULE.v1:
  LocalOnly:
    if active issue contained in one Z-band with intact buffers
  CrossZEscalation:
    if same CM appears in 2+ adjacent Z-levels
  MacroIntervention:
    if Z3/Z4 turns Neg OR Z0-Z2 hard-fails while shell still looks strong
  FullCityFence:
    if L15 rupture window approaches
ONE_PANEL_MINIMAL_SCHEMA (copyable runtime object):
  PanelObject:
    CityID: <string>
    TimeSlice: <string>
    Archetype: <string>
    CurrentBand: <NegLattice|NeuLattice|PosLattice>
    DominantCollapseMode: <CM0|CM1|CM2|CM3>
    TrendDirection: <Improving|Stable|Narrowing|Deteriorating>
    HumanCarrierBand: <Neg|Neu|Pos>
    SystemBand: <Neg|Neu|Pos>
    ExternalInterfaceBand: <Neg|Neu|Pos>
    TopLawStress3: [<Lxx>, <Lxx>, <Lxx>]
    WeakestSensor3: [<Sxx>, <Sxx>, <Sxx>]
    FenceState: <Standby|PreFence|ActiveFence|PostFenceRecovery>
    TriggeredFencePoints: [<name>, <name>, <name>]
    ActiveLedgerBreaches: [<ledger>, <ledger>, <ledger>]
    ReserveRentStatus: <Healthy|Tight|Borrowing|Breached>
    FrontierPermission: <Blocked|Narrow|Conditional|Open>
    TopRepairMoves3: [<move>, <move>, <move>]
    TimeToThreshold: <T0|T1|T2|T3>
    ConfidenceBand: <High|Medium|Low>
    RecheckWindow: <string>
    ExecutiveRead: <string>
    Next7Days: [<action>, <action>, <action>]
    Next30Days: [<action>, <action>, <action>]
    MustNotDo: [<forbidden>, <forbidden>, <forbidden>]
    EscalationRule: <string>
CITY_BINDING_HOOKS.v1:
  NewYork:
    LikelyTopStressDefaults: {L05, L06, L09}
    LikelyWeakSensors: {S09, S06, S03}
    DefaultRepairBias:
      - ReduceChoiceLoad
      - RestoreBaseThroughput
      - ReconnectShellToBase
  Singapore:
    LikelyTopStressDefaults: {L04, L08, L03}
    LikelyWeakSensors: {S12, S04, S11}
    DefaultRepairBias:
      - MaintainSlack
      - ProtectReserves
      - AntiOvercompression
  Beijing:
    LikelyTopStressDefaults: {L11, L13, L14}
    LikelyWeakSensors: {S03, S10, S06}
    DefaultRepairBias:
      - ImproveSignal
      - ReconcileOutcomeVsCompliance
      - IncreaseTruthBearingBandwidth
  Tokyo:
    LikelyTopStressDefaults: {L03, L11, L13}
    LikelyWeakSensors: {S11, S03}
    DefaultRepairBias:
      - ProtectMaintenance
      - RebuildRegeneration
      - OpenSafeRenewalCorridors
  London:
    LikelyTopStressDefaults: {L09, L05, L06}
    LikelyWeakSensors: {S09, S06, S10}
    DefaultRepairBias:
      - ReconnectLegacyToThroughput
      - BindReconciliation
      - ReduceAffordabilityDrivenTransferLoss
  Seoul:
    LikelyTopStressDefaults: {L11, L09, L06}
    LikelyWeakSensors: {S11, S05, S04}
    DefaultRepairBias:
      - ProtectRegeneration
      - AddSlack
      - FencePerformanceLoad
CONTROL_TOWER_RUN_CYCLE.v1:
  Step1:
    Ingest Z0-Z6 status
  Step2:
    Classify each Z
  Step3:
    Aggregate into 3 Z-bands
  Step4:
    Determine overall CityBand
  Step5:
    Select Dominant CM
  Step6:
    Rank top law stresses
  Step7:
    Check FENCE state
  Step8:
    Generate top 3 repair moves
  Step9:
    Generate executive read + next actions
  Step10:
    Set recheck window
PASS_CONDITION.v1:
  The panel is working if:
    - it outputs one dominant read
    - it does not exceed 3 repair moves
    - it distinguishes CM1 vs CM2 vs CM3 correctly enough to avoid wrong repair
    - it prevents frontier permission when base conditions fail
    - it downgrades shell strength if base hollowing is detected
FAIL_CONDITION.v1:
  The panel fails if:
    - it reports “healthy” while Z0-Z2 is broken
    - it confuses buffer breach for signal corruption repeatedly
    - it allows expansion while reserves are borrowing
    - it cannot produce a next 7-day move
    - it tracks too many variables without converging on action
DEFAULT_BLANK_PANEL_TEMPLATE:
  PanelObject:
    CityID: <City>
    TimeSlice: <Tn>
    Archetype: <Archetype>
    CurrentBand: <NegLattice|NeuLattice|PosLattice>
    DominantCollapseMode: <CM0|CM1|CM2|CM3>
    TrendDirection: <Improving|Stable|Narrowing|Deteriorating>
    HumanCarrierBand: <Neg|Neu|Pos>
    SystemBand: <Neg|Neu|Pos>
    ExternalInterfaceBand: <Neg|Neu|Pos>
    TopLawStress3: [<Lxx>, <Lxx>, <Lxx>]
    WeakestSensor3: [<Sxx>, <Sxx>, <Sxx>]
    FenceState: <State>
    TriggeredFencePoints: [<FP1>, <FP2>, <FP3>]
    ActiveLedgerBreaches: [<LGR1>, <LGR2>, <LGR3>]
    ReserveRentStatus: <Healthy|Tight|Borrowing|Breached>
    FrontierPermission: <Blocked|Narrow|Conditional|Open>
    TopRepairMoves3: [<Mv1>, <Mv2>, <Mv3>]
    TimeToThreshold: <T0|T1|T2|T3>
    ConfidenceBand: <High|Medium|Low>
    RecheckWindow: <Window>
    ExecutiveRead: "<One sentence>"
    Next7Days: [<A1>, <A2>, <A3>]
    Next30Days: [<A1>, <A2>, <A3>]
    MustNotDo: [<X1>, <X2>, <X3>]
    EscalationRule: <Rule>
NEXT_DEPENDENCY:
  After this, the next required spec is:
    CivOS.CitySensorThresholds.Calibration.v1.0

“`text id=”l7p2dn”
SPEC_ID: CivOS.CitySensorThresholds.Calibration.v1.0
TITLE: Universal Sensor Threshold Calibration for Any City (Z0-Z6)
MODE: Almost-Code
OUTPUT_RULE: Code-Only
VERSION: v1.0
STATUS: Canonical Threshold Engine
DEPENDS_ON:

• CivOS.CityControlTower.OnePanel.v1.0
• CivOS.CityLawPack.Global.Z3-Z6.CF.v1.0
• CivOS.CityOS.Pack6.Z0-Z6.CF.v1.0

PURPOSE:
Convert raw city conditions into calibrated, comparable CivOS sensor states so the One-Panel can:
– classify band (Neg/Neu/Pos)
– detect proximity to fence triggers
– distinguish CM1 / CM2 / CM3
– rank weakest sensors
– estimate TimeToThreshold
This is a threshold prior pack, not a live data claim.

CORE_FUNCTION:
RawInput -> Normalize -> CompareToThresholds -> AssignBand -> FlagBreaches -> Feed OnePanel

CALIBRATION_PRINCIPLE:
Same spine, different body.
The threshold engine is universal.
Raw measurements differ by city/domain, but all must be normalized into the same CivOS sensor grammar.

NORMALIZATION_STANDARD.v1:
CanonicalScale:
HealthScore: 0..100
Meaning:
100 = very healthy / high headroom
70-89 = stable but watch
50-69 = warning corridor
30-49 = pre-fence / narrow corridor
0-29 = breach / active danger
Rule:
All sensors must be converted to HealthScore before comparison, even if their raw data units differ.

SENSOR_DIRECTIONALITY.v1:
PositiveDirection (higher raw is better -> higher HealthScore):
– S01 NodeContinuity
– S02 BindQuality
– S04 BufferDepth
– S06 TrustSignal
– S07 InfrastructureRedundancy
– S08 TalentTransfer
– S10 GovernanceCoherence
– S11 SocialRegeneration
NegativeDirection (higher raw is worse -> lower HealthScore):
– S03 RepairLatency
– S05 ChoiceLoad
– S09 CostPressure
– S12 ExternalDependency

RAW_TO_HEALTH_CONVERSION.v1:

PositiveDirectionRule:
HealthScore = Clamp(0,100, RawNormalized)

S03.RepairLatency:
RawVariable: time_to_effective_repair
Reference: RepairLatency_max_by_Z
Formula:
if Raw <= SafeMax -> HealthScore = 90..100
if SafeMax < Raw <= WarnMax -> interpolate 70..89
if WarnMax < Raw <= FailMax -> interpolate 30..69
if Raw > FailMax -> HealthScore = 0..29

S05.ChoiceLoad:
RawVariable: rho = ChoiceLoad / ChoiceCapacity
Reference: rho_max_by_Z
Formula:
if rho <= rho_safe -> HealthScore = 90..100
if rho_safe < rho <= rho_warn -> interpolate 70..89
if rho_warn < rho <= rho_fail -> interpolate 30..69
if rho > rho_fail -> HealthScore = 0..29

S09.CostPressure:
RawVariable: cp = EssentialLoad / EffectiveCapacity
Meaning:
EssentialLoad = non-optional recurring burden
EffectiveCapacity = usable time/money/institutional capacity after core commitments
Formula:
if cp <= cp_safe -> HealthScore = 90..100
if cp_safe < cp <= cp_warn -> interpolate 70..89
if cp_warn < cp <= cp_fail -> interpolate 30..69
if cp > cp_fail -> HealthScore = 0..29

S12.ExternalDependency:
RawVariable: ed = concentration share of top external corridor OR critical import reliance index
Formula:
if ed <= ed_safe -> HealthScore = 90..100
if ed_safe < ed <= ed_warn -> interpolate 70..89
if ed_warn < ed <= ed_fail -> interpolate 30..69
if ed > ed_fail -> HealthScore = 0..29

THRESHOLD_BANDS.v1:
PosBand:
HealthScore >= 70
NeuBand:
40 <= HealthScore < 70
NegBand:
HealthScore < 40

CRITICAL_BREACH_RULE.v1:
A sensor is CriticalBreach if:
– HealthScore < 30
OR
– HealthScore < 40 for 2 consecutive cycles
OR
– velocity is deteriorating fast enough to hit <30 before repair window closes

Z_TIME_GRAMMAR.v1:
Z0: hours-days
Z1: days-weeks
Z2: weeks-months
Z3: months-quarters
Z4: quarters-years
Z5: years
Z6: years-decades

=============================================================================

CANONICAL THRESHOLD TABLES

=============================================================================

REPAIR_LATENCY_MAX_BY_Z.v1:
Meaning:
Maximum acceptable time-to-effective-repair before the corridor is considered too slow.
Structure:
SafeMax = still healthy
WarnMax = narrow corridor
FailMax = functionally too late

Z0:
SafeMax: 1 day
WarnMax: 3 days
FailMax: 7 days
Z1:
SafeMax: 1 week
WarnMax: 2 weeks
FailMax: 1 month
Z2:
SafeMax: 2 weeks
WarnMax: 1 month
FailMax: 3 months
Z3:
SafeMax: 1 month
WarnMax: 1 quarter
FailMax: 2 quarters
Z4:
SafeMax: 1 quarter
WarnMax: 2 quarters
FailMax: 1 year
Z5:
SafeMax: 1 year
WarnMax: 2 years
FailMax: 4 years
Z6:
SafeMax: 2 years
WarnMax: 5 years
FailMax: 10 years

RHO_MAX_BY_Z.v1:
Meaning:
Maximum safe choice-load ratio by Z before symmetry-choice shear begins to dominate.
Variable:
rho = ChoiceLoad / ChoiceCapacity
Structure:
rho_safe = healthy
rho_warn = warning
rho_fail = likely collapse pressure

Z0:
rho_safe: 0.35
rho_warn: 0.50
rho_fail: 0.70
Z1:
rho_safe: 0.45
rho_warn: 0.60
rho_fail: 0.80
Z2:
rho_safe: 0.55
rho_warn: 0.75
rho_fail: 0.95
Z3:
rho_safe: 0.70
rho_warn: 0.90
rho_fail: 1.10
Z4:
rho_safe: 0.85
rho_warn: 1.05
rho_fail: 1.25
Z5:
rho_safe: 1.10
rho_warn: 1.30
rho_fail: 1.55
Z6:
rho_safe: 1.25
rho_warn: 1.50
rho_fail: 1.80

BUFFER_DEPTH_MIN_BY_Z.v1:
Meaning:
Minimum operating runway before a normal shock becomes a buffer problem.
Variable:
Runway = equivalent survivable operating duration without service degradation
Structure:
HealthyMin = desired runway
WarningMin = narrow runway
HardFailMin = below this, CM2 likely

Z0:
HealthyMin: 7 days
WarningMin: 3 days
HardFailMin: 1 day
Z1:
HealthyMin: 4 weeks
WarningMin: 2 weeks
HardFailMin: 1 week
Z2:
HealthyMin: 3 months
WarningMin: 1 month
HardFailMin: 2 weeks
Z3:
HealthyMin: 6 months
WarningMin: 3 months
HardFailMin: 1 month
Z4:
HealthyMin: 12 months
WarningMin: 6 months
HardFailMin: 3 months
Z5:
HealthyMin: 24 months
WarningMin: 12 months
HardFailMin: 6 months
Z6:
HealthyMin: 60 months
WarningMin: 24 months
HardFailMin: 12 months

TRUST_SIGNAL_MIN_BY_Z.v1:
Meaning:
Minimum trust/legitimacy score required to keep correction channels usable.
Variable:
TrustHealthScore (0..100)
Structure:
HealthyMin = robust
WarningMin = fragile
HardFailMin = signal becomes unreliable

Z0:
HealthyMin: 70
WarningMin: 55
HardFailMin: 40
Z1:
HealthyMin: 68
WarningMin: 52
HardFailMin: 38
Z2:
HealthyMin: 65
WarningMin: 50
HardFailMin: 38
Z3:
HealthyMin: 62
WarningMin: 48
HardFailMin: 35
Z4:
HealthyMin: 60
WarningMin: 45
HardFailMin: 35
Z5:
HealthyMin: 58
WarningMin: 42
HardFailMin: 32
Z6:
HealthyMin: 55
WarningMin: 40
HardFailMin: 30

NODE_CONTINUITY_MIN_BY_Z.v1:
Meaning:
Minimum structural continuity needed to prevent CM1.
Variable:
NodeContinuityHealthScore (0..100)

Z0:
HealthyMin: 75
WarningMin: 60
HardFailMin: 45
Z1:
HealthyMin: 72
WarningMin: 58
HardFailMin: 42
Z2:
HealthyMin: 70
WarningMin: 55
HardFailMin: 40
Z3:
HealthyMin: 68
WarningMin: 52
HardFailMin: 38
Z4:
HealthyMin: 65
WarningMin: 50
HardFailMin: 35
Z5:
HealthyMin: 62
WarningMin: 48
HardFailMin: 35
Z6:
HealthyMin: 60
WarningMin: 45
HardFailMin: 32

BIND_QUALITY_MIN_BY_Z.v1:
Meaning:
Minimum quality of relationship links required to keep transfer corridors intact.
Variable:
BindQualityHealthScore (0..100)

Z0:
HealthyMin: 75
WarningMin: 58
HardFailMin: 42
Z1:
HealthyMin: 72
WarningMin: 55
HardFailMin: 40
Z2:
HealthyMin: 70
WarningMin: 52
HardFailMin: 38
Z3:
HealthyMin: 68
WarningMin: 50
HardFailMin: 35
Z4:
HealthyMin: 65
WarningMin: 48
HardFailMin: 35
Z5:
HealthyMin: 62
WarningMin: 45
HardFailMin: 32
Z6:
HealthyMin: 60
WarningMin: 42
HardFailMin: 30

INFRASTRUCTURE_REDUNDANCY_MIN_BY_Z.v1:
Meaning:
Minimum redundancy needed to avoid single-point fragility.
Applicability:
Z0-Z2: optional / derivative only
Z3-Z6: primary
Variable:
RedundancyHealthScore (0..100)

Z3:
HealthyMin: 70
WarningMin: 55
HardFailMin: 40
Z4:
HealthyMin: 72
WarningMin: 58
HardFailMin: 42
Z5:
HealthyMin: 68
WarningMin: 52
HardFailMin: 38
Z6:
HealthyMin: 65
WarningMin: 50
HardFailMin: 35

TALENT_TRANSFER_MIN_BY_Z.v1:
Meaning:
Minimum acceptable renewal of talent, skill movement, and succession continuity.
Applicability:
Z1-Z6
Variable:
TalentTransferHealthScore (0..100)

Z1:
HealthyMin: 65
WarningMin: 50
HardFailMin: 38
Z2:
HealthyMin: 65
WarningMin: 50
HardFailMin: 38
Z3:
HealthyMin: 62
WarningMin: 48
HardFailMin: 35
Z4:
HealthyMin: 62
WarningMin: 48
HardFailMin: 35
Z5:
HealthyMin: 65
WarningMin: 50
HardFailMin: 38
Z6:
HealthyMin: 65
WarningMin: 50
HardFailMin: 38

GOVERNANCE_COHERENCE_MIN_BY_Z.v1:
Meaning:
Minimum alignment between rules, institutions, and actual execution.
Applicability:
Z2-Z6
Variable:
GovernanceCoherenceHealthScore (0..100)

Z2:
HealthyMin: 62
WarningMin: 48
HardFailMin: 35
Z3:
HealthyMin: 65
WarningMin: 50
HardFailMin: 38
Z4:
HealthyMin: 68
WarningMin: 52
HardFailMin: 40
Z5:
HealthyMin: 62
WarningMin: 48
HardFailMin: 35
Z6:
HealthyMin: 60
WarningMin: 45
HardFailMin: 35

SOCIAL_REGENERATION_MIN_BY_Z.v1:
Meaning:
Minimum restoration of human carriers (time, health, family-capable slack, renewal).
Applicability:
Z0-Z3 primary, Z4-Z6 indirect but still tracked
Variable:
SocialRegenerationHealthScore (0..100)

Z0:
HealthyMin: 72
WarningMin: 58
HardFailMin: 42
Z1:
HealthyMin: 70
WarningMin: 55
HardFailMin: 40
Z2:
HealthyMin: 68
WarningMin: 52
HardFailMin: 38
Z3:
HealthyMin: 65
WarningMin: 50
HardFailMin: 38
Z4:
HealthyMin: 60
WarningMin: 45
HardFailMin: 35
Z5:
HealthyMin: 58
WarningMin: 42
HardFailMin: 32
Z6:
HealthyMin: 55
WarningMin: 40
HardFailMin: 30

COST_PRESSURE_MAX_BY_Z.v1:
Meaning:
Maximum sustainable essential-load ratio before ordinary function narrows.
Variable:
cp = EssentialLoad / EffectiveCapacity
Structure:
cp_safe = healthy upper bound
cp_warn = warning upper bound
cp_fail = likely CM2 trigger

Z0:
cp_safe: 0.55
cp_warn: 0.70
cp_fail: 0.85
Z1:
cp_safe: 0.60
cp_warn: 0.75
cp_fail: 0.88
Z2:
cp_safe: 0.65
cp_warn: 0.80
cp_fail: 0.90
Z3:
cp_safe: 0.70
cp_warn: 0.82
cp_fail: 0.92
Z4:
cp_safe: 0.72
cp_warn: 0.84
cp_fail: 0.93
Z5:
cp_safe: 0.75
cp_warn: 0.86
cp_fail: 0.94
Z6:
cp_safe: 0.78
cp_warn: 0.88
cp_fail: 0.95

EXTERNAL_DEPENDENCY_MAX_BY_Z.v1:
Meaning:
Maximum acceptable concentration in a single critical external corridor.
Applicability:
Z5-Z6 primary; Z3-Z4 optional if externalized system risk is material
Variable:
ed = critical reliance concentration share

Z3:
ed_safe: 0.35
ed_warn: 0.50
ed_fail: 0.65
Z4:
ed_safe: 0.30
ed_warn: 0.45
ed_fail: 0.60
Z5:
ed_safe: 0.25
ed_warn: 0.40
ed_fail: 0.55
Z6:
ed_safe: 0.20
ed_warn: 0.35
ed_fail: 0.50

=============================================================================

SENSOR PRIORITY BY Z (FOR WEIGHTING / RANKING)

=============================================================================

SENSOR_WEIGHTING_BY_Z.v1:
Purpose:
Rank weakest sensors appropriately by zoom level.
Scale:
1 = low relevance
5 = highest relevance

Z0:
S01: 4
S02: 4
S03: 5
S04: 5
S05: 4
S06: 5
S07: 1
S08: 2
S09: 5
S10: 2
S11: 5
S12: 1

Z1:
S01: 4
S02: 5
S03: 5
S04: 5
S05: 4
S06: 4
S07: 2
S08: 3
S09: 5
S10: 2
S11: 5
S12: 1

Z2:
S01: 5
S02: 5
S03: 4
S04: 4
S05: 3
S06: 5
S07: 2
S08: 3
S09: 4
S10: 4
S11: 4
S12: 2

Z3:
S01: 4
S02: 4
S03: 5
S04: 5
S05: 3
S06: 4
S07: 5
S08: 3
S09: 4
S10: 5
S11: 4
S12: 3

Z4:
S01: 4
S02: 4
S03: 5
S04: 5
S05: 3
S06: 4
S07: 5
S08: 4
S09: 4
S10: 5
S11: 3
S12: 4

Z5:
S01: 3
S02: 3
S03: 4
S04: 5
S05: 2
S06: 4
S07: 4
S08: 5
S09: 3
S10: 4
S11: 3
S12: 5

Z6:
S01: 3
S02: 3
S03: 4
S04: 5
S05: 2
S06: 4
S07: 4
S08: 5
S09: 3
S10: 4
S11: 3
S12: 5

=============================================================================

COLLAPSE MODE MAPPING

=============================================================================

CM_SENSOR_SIGNATURES.v1:
CM1.TransferBreak:
PrimarySensors:
– S01 NodeContinuity
– S02 BindQuality
SecondarySensors:
– S06 TrustSignal
– S08 TalentTransfer
TriggerPattern:
– S01 or S02 < HardFailMin – AND named corridor break exists CM2.BufferBreach: PrimarySensors: – S04 BufferDepth – S09 CostPressure – S07 InfrastructureRedundancy SecondarySensors: – S11 SocialRegeneration – S03 RepairLatency TriggerPattern: – S04 < HardFailMin OR – cp > cp_fail
CM3.SignalCorruption:
PrimarySensors:
– S03 RepairLatency
– S06 TrustSignal
– S10 GovernanceCoherence
SecondarySensors:
– S05 ChoiceLoad
– S12 ExternalDependency
TriggerPattern:
– S03 beyond FailMax
OR
– S06/S10 both below HardFailMin while wrong repair persists

=============================================================================

CITY-SPECIFIC CALIBRATION DELTAS (PRIOR OVERRIDES)

=============================================================================

CITY_DELTA_PROFILE.v1:
Purpose:
Apply structural bias adjustments without changing the universal spine.
Rule:
Deltas modify thresholds by small amounts only.
Larger changes require verified backtests.

NewYork:
Notes:
– high choice environments need stronger operator filtering
– cost pressure and trust asymmetry matter early
Adjustments:
RHO_MAX_BY_Z:
Z0: -0.05
Z1: -0.05
Z2: -0.05
COST_PRESSURE_MAX_BY_Z:
Z0: -0.05
Z1: -0.05
Z2: -0.03
TRUST_SIGNAL_MIN_BY_Z:
Z0: +3
Z1: +3
Z2: +2

Singapore:
Notes:
– compact coordination is strong, but correlation risk and dependency concentration matter
Adjustments:
BUFFER_DEPTH_MIN_BY_Z:
Z3: +1 month
Z4: +2 months
Z5: +3 months
EXTERNAL_DEPENDENCY_MAX_BY_Z:
Z3: -0.05
Z4: -0.05
Z5: -0.05
Z6: -0.05
SOCIAL_REGENERATION_MIN_BY_Z:
Z0: +3
Z1: +3
Z2: +2

Beijing:
Notes:
– signal integrity matters more because wrong-model correction scales widely
Adjustments:
REPAIR_LATENCY_MAX_BY_Z:
Z2: -1 week
Z3: -2 weeks
Z4: -1 month
TRUST_SIGNAL_MIN_BY_Z:
Z2: +3
Z3: +3
Z4: +3
GOVERNANCE_COHERENCE_MIN_BY_Z:
Z3: +3
Z4: +3

Tokyo:
Notes:
– slow drift and regeneration need earlier flags; stability can hide narrowing
Adjustments:
SOCIAL_REGENERATION_MIN_BY_Z:
Z0: +3
Z1: +4
Z2: +4
Z3: +3
TALENT_TRANSFER_MIN_BY_Z:
Z1: +3
Z2: +3
Z3: +2
RHO_MAX_BY_Z:
Z3: -0.05
Z4: -0.05

London:
Notes:
– legacy shell can mask base strain; trust and affordability need tighter monitoring
Adjustments:
COST_PRESSURE_MAX_BY_Z:
Z0: -0.05
Z1: -0.05
Z2: -0.04
TRUST_SIGNAL_MIN_BY_Z:
Z1: +3
Z2: +3
Z3: +3
GOVERNANCE_COHERENCE_MIN_BY_Z:
Z3: +2
Z4: +2

Seoul:
Notes:
– compression, regeneration, and performance load need stricter fences
Adjustments:
RHO_MAX_BY_Z:
Z0: -0.05
Z1: -0.05
Z2: -0.05
Z3: -0.03
SOCIAL_REGENERATION_MIN_BY_Z:
Z0: +5
Z1: +5
Z2: +4
Z3: +3
BUFFER_DEPTH_MIN_BY_Z:
Z0: +2 days
Z1: +1 week
Z2: +2 weeks

=============================================================================

CALIBRATION ENGINE

=============================================================================

CALIBRATION_RUN_CYCLE.v1:
Step1:
Ingest raw metrics for one city, one Z, one time slice
Step2:
Convert raw units into canonical raw variables:
– time_to_effective_repair
– rho
– cp
– ed
– normalized direct scores for positive-direction sensors
Step3:
Apply universal thresholds by Z
Step4:
Apply city delta profile if CityID is known
Step5:
Convert each sensor into HealthScore
Step6:
Assign sensor band:
– Pos if >= 70
– Neu if 40..69
– Neg if < 40
Step7:
Flag:
– CriticalBreach
– PreFence
– Improving
– Conflicted
Step8:
Send calibrated sensor object to OnePanel

SENSOR_STATUS_ASSIGNMENT.v1:
ForEachSensor:
if HealthScore >= HealthyMinEquivalent:
SensorState = Stable
else if WarningMinEquivalent <= HealthScore < HealthyMinEquivalent:
SensorState = Warning
else if HardFailMinEquivalent <= HealthScore < WarningMinEquivalent:
SensorState = PreFence
else:
SensorState = Breach

SENSOR_CONFLICT_RULE.v1:
Meaning:
Surface says “fine” but structural sensor says “weak”
TriggerExamples:
– S08 strong but S11 weak
– S12 appears stable but S04 degrading
– Z5/Z6 positive while Z0/Z1 negative
Output:
ConflictFlag = True
Effect:
Reduce ConfidenceBand by one level
Increase weight on L09 BorrowedLift and L11 VesselFirst

VELOCITY_RULES.v1:
Meaning:
Direction matters, not just absolute threshold
States:
Improving
Flat
Narrowing
Deteriorating
AcceleratingDeterioration
Trigger:
If HealthScore is dropping fast enough to cross one band before repair window closes:
mark AcceleratingDeterioration
raise PreFence priority

BACKTEST_UPDATE_RULES.v1:
Purpose:
Prevent arbitrary threshold drift
AllowedAdjustment:
SmallStepOnly
MaximumChangePerVerifiedCycle:
NumericThresholds:
– ratios: +/-0.03
– score floors: +/-3
– time windows: +/-15%
ConditionsToAdjust:
– at least 3 consistent verified cycles
– no unresolved sensor conflict
– change improves diagnosis accuracy
Forbidden:
– changing thresholds to protect surface optics
– widening frontier thresholds while base remains weak
– lowering trust thresholds merely to classify “healthy”

VERIFICATION_UNDER_LOAD_RULE.v1:
Meaning:
A calibration is only trusted if it still diagnoses correctly during stress.
MinimumCheck:
– one normal cycle
– one moderate stress cycle
– one recovery cycle
Pass:
Correctly distinguishes CM1/CM2/CM3 in all three
Fail:
Misclassifies CM2 as CM1 repeatedly
OR ignores CM3 while wrong repair persists

=============================================================================

ONE-PANEL OUTPUT HOOKS

=============================================================================

PANEL_HOOKS.v1:
WeakestSensor3:
Input = lowest weighted HealthScores after calibration
TimeToThreshold:
Derived from:
– current headroom
– deterioration velocity
– RepairLatency_max_by_Z
TopLawStress3:
Hints:
– low S01/S02 -> elevate L01
– low S04 / high cp -> elevate L02, L08, L09
– low S03 / low S06 / low S10 -> elevate L03, L04, L11, CM3 pathways
– high rho -> elevate L05/L06
– low S11 -> elevate L11 and possibly L09 if surface remains strong
– high ed -> elevate L08, L12, L13 under external shock conditions

CITY_BAND_HINTS.v1:
If Z0-Z2 weighted average < 45:
Downgrade overall city band by 1 level
If Z3-Z4 weighted average < 40:
Raise macro intervention flag
If Z5-Z6 strong but Z0-Z2 weak:
Auto-flag BorrowedLiftRisk = True
If 2 primary CM sensors are in Breach:
DominantCollapseMode cannot remain CM0

=============================================================================

DEFAULT BLANK CALIBRATION OBJECT

=============================================================================

CalibrationObject:
CityID:
TimeSlice:
ZLevel:

RawInputs:
S01_raw: <0..100 or mapped>
S02_raw: <0..100 or mapped>
S03_time_to_effective_repair:
S04_runway:
S05_rho:
S06_raw: <0..100 or mapped>
S07_raw: <0..100 or mapped>
S08_raw: <0..100 or mapped>
S09_cp:
S10_raw: <0..100 or mapped>
S11_raw: <0..100 or mapped>
S12_ed:

ThresholdsApplied:
RepairLatency: {SafeMax, WarnMax, FailMax}
ChoiceLoad: {rho_safe, rho_warn, rho_fail}
BufferDepth: {HealthyMin, WarningMin, HardFailMin}
TrustSignal: {HealthyMin, WarningMin, HardFailMin}
CostPressure: {cp_safe, cp_warn, cp_fail}
ExternalDependency: {ed_safe, ed_warn, ed_fail}

HealthScores:
S01: <0..100>
S02: <0..100>
S03: <0..100>
S04: <0..100>
S05: <0..100>
S06: <0..100>
S07: <0..100>
S08: <0..100>
S09: <0..100>
S10: <0..100>
S11: <0..100>
S12: <0..100>

SensorStates:
S01:
S02:
S03:
S04:
S05:
S06:
S07:
S08:
S09:
S10:
S11:
S12:

Flags:
CriticalBreaches: [, , ]
ConflictFlag:
VelocityFlag:

OutputHooks:
WeakestSensor3: [, , ]
SuggestedCM:
TimeToThreshold:
ConfidencePenalty: <0|1|2>

PASS_CONDITION.v1:
This spec is working if:
– any raw city input can be normalized into the same 12-sensor language
– threshold bands are explicit by Z
– city deltas remain bounded and not ad hoc
– OnePanel can reliably rank weakest sensors
– CM1 / CM2 / CM3 become easier to separate, not harder

FAIL_CONDITION.v1:
This spec fails if:
– thresholds are too loose and miss base hollowing
– thresholds are too strict and mark everything Neg
– city deltas override the universal spine
– frontier-facing shell metrics hide Z0-Z2 collapse
– calibration changes are made without verified backtests

NEXT_DEPENDENCY:
After this, the next required spec is:
CivOS.CityFENCE.TriggerMap.Z0-Z6.v1.0
“`

“`text id=”c8m4qe”
SPEC_ID: CivOS.CityFENCE.TriggerMap.Z0-Z6.v1.0
TITLE: Universal FENCE Trigger Map for Any City (Z0-Z6)
MODE: Almost-Code
OUTPUT_RULE: Code-Only
VERSION: v1.0
STATUS: Canonical Boundary / Actuation Trigger Engine
DEPENDS_ON:

• CivOS.CityControlTower.OnePanel.v1.0
• CivOS.CitySensorThresholds.Calibration.v1.0
• CivOS.CityLawPack.Global.Z3-Z6.CF.v1.0
• CivOS.CityOS.Pack6.Z0-Z6.CF.v1.0

PURPOSE:
Define exactly:
– when FENCE enters warning
– when FENCE must activate
– what must be truncated
– what must be preserved
– how stitching / downgrade / re-entry occurs
so the City One-Panel can prevent irreversible corridor loss.

CORE_FUNCTION:
DetectApproach -> PreFence -> ActiveFence -> APRC -> Recovery -> VerifiedReentry

CANONICAL_DEFINITION:
FENCE is the boundary-and-actuation control layer that prevents a city corridor
from crossing from reversible strain into irreversible damage.
It does not solve everything.
It buys time, preserves the core, truncates overload, and creates a valid repair window.

RUNTIME_INHERITANCE:

• Lattice
• VeriWeft (VWF)
• Stacked Invariant Ledger (SIL)
• ChronoFlight (CF)
• AVOO
• ERCO
• ChronoHelmAI

FENCE_PRIMITIVES.v1:
P1 DetectThresholdApproach
P2 TriggerBoundary
P3 TruncateOverload
P4 PreserveCoreContinuity
P5 RouteMinimalSafeCorridor
P6 StitchBackInPhases
P7 VerifyUnderLoadBeforeReentry

FENCE_STATE_MACHINE.v1:
F0:
Name: Standby
Meaning: No active boundary intervention needed
F1:
Name: PreFence
Meaning: Threshold approach detected; normal repair may be too slow
F2:
Name: ActiveFence
Meaning: Boundary crossed or crossing imminent; truncation required now
F3:
Name: StabilizedHold
Meaning: Overload truncated; system held in minimal safe corridor
F4:
Name: StitchingRecovery
Meaning: Controlled re-connection and phased restoration underway
F5:
Name: VerifiedReentry
Meaning: Corridor restored and validated under load
Transitions:
F0 -> F1:
if WarningTrigger = True
F1 -> F2:
if HardTrigger = True OR TimeToThreshold <= RepairLatencyWindow F2 -> F3:
after overload truncated AND core preserved
F3 -> F4:
when repair corridor R3-R5 shows positive traction
F4 -> F5:
after verification under live load
F5 -> F0:
after sustained stability across recheck window
AnyState -> F2:
if irreversible crossing risk becomes immediate

TRIGGER_CLASSES.v1:
T0:
Name: Advisory
Meaning: signal to prepare, not yet boundary actuation
T1:
Name: Warning
Meaning: PreFence required; expansion restrictions begin
T2:
Name: HardTrigger
Meaning: ActiveFence mandatory; overload truncation begins
T3:
Name: EmergencyTrigger
Meaning: Immediate protection of core nodes; non-core load dropped first

CANONICAL_TRIGGER_LOGIC.v1:
WarningTrigger = True if ANY:
– 2 or more priority sensors in PreFence
– 1 priority sensor deteriorating fast enough to hit Breach before repair window closes
– same collapse mode detected across 2 adjacent Z-levels
– shell/base divergence persists for 2 cycles
HardTrigger = True if ANY:
– 1 critical priority sensor in Breach with no compensating buffer
– 2 primary collapse-mode sensors in Breach
– critical ledger breach unreconciled across 1 full repair window
– TimeToThreshold <= 1/2 of required effective repair latency
EmergencyTrigger = True if ANY:
– Z0/Z1 basic life corridor fails now
– Z3 core infrastructure continuity fails now
– Z4 wrong-model correction is amplifying damage now
– Z5 external shock severs critical supply corridor with no reserve route

PRIORITY_SENSOR_GROUPS.v1:
HumanCarrier:
Sensors: {S03, S04, S06, S09, S11}
TransferIntegrity:
Sensors: {S01, S02, S06, S08}
SystemContinuity:
Sensors: {S03, S04, S07, S10}
ExternalStability:
Sensors: {S04, S08, S12}
ChoiceShear:
Sensors: {S05, S06, S10}

CANONICAL_FENCE_ACTIONS.v1:
A01: FreezeExpansion
A02: DropOptionalLoad
A03: ProtectCoreNodes
A04: ProtectMinimumBuffers
A05: SlowDecisionVelocity
A06: SimplifyOperatorChoiceSet
A07: RingFenceCriticalResources
A08: SwitchToFallbackRoute
A09: PausePrestigeOrFrontierProjects
A10: ForceTruthAudit
A11: DowngradeToSafeMode
A12: StageReentry

APRC_PROTOCOL.v1:
A:
Name: Assess
Goal: confirm true trigger type and dominant collapse mode
P:
Name: Preserve
Goal: hold core continuity first; do not widen scope during active threat
R:
Name: Reroute
Goal: move load into minimal safe corridors / fallback paths
C:
Name: Cut
Goal: truncate non-essential complexity, demand, speed, or ambition
Output:
– protected core set
– downgraded service mode
– recheck window
– stitch order for reentry

FENCE_PRIORITY_RULES.v1:
Rule1:
Protect Z0-Z2 before protecting prestige shell
Rule2:
Protect core node continuity before preserving optional complexity
Rule3:
Protect truthful telemetry before trusting executive dashboards
Rule4:
Protect repair bandwidth before allocating resources to growth
Rule5:
Under uncertainty, downgrade earlier rather than rupture later

=============================================================================

Z-LEVEL FENCE TRIGGER MAP

=============================================================================

Z0.FENCE.v1:
Scope:
Person-day survival corridor
PrioritySensors:
– S03 RepairLatency
– S04 BufferDepth
– S06 TrustSignal
– S09 CostPressure
– S11 SocialRegeneration
WarningTriggers:
WT.Z0.01:
if S04 in PreFence for 1 cycle
WT.Z0.02:
if cp > cp_warn
WT.Z0.03:
if S11 falls one full band in one cycle
WT.Z0.04:
if S03 exceeds SafeMax and deterioration is accelerating
HardTriggers:
HT.Z0.01:
if S04 <= HardFailMin HT.Z0.02: if cp >= cp_fail
HT.Z0.03:
if S03 > FailMax
HT.Z0.04:
if S06 < HardFailMin and daily planning collapses EmergencyTriggers: ET.Z0.01: if basic shelter / food / safety / access breaks immediately FencePoints: – PersonalDebtSpiral – HomelessnessCliff – BurnoutCollapse – AcuteSafetyLoss MandatoryActions: – A02 DropOptionalLoad – A03 ProtectCoreNodes – A04 ProtectMinimumBuffers – A06 SimplifyOperatorChoiceSet – A11 DowngradeToSafeMode ProtectedCore: – shelter continuity – food continuity – safety continuity – minimal mobility – immediate care access CutFirst: – optional commitments – prestige outputs – non-essential complexity ReentryCondition: – S04 > WarningMin
– S03 <= WarnMax – S06 >= WarningMin
– no active basic access break

Z1.FENCE.v1:
Scope:
Household / school / workplace corridor
PrioritySensors:
– S02 BindQuality
– S03 RepairLatency
– S04 BufferDepth
– S09 CostPressure
– S11 SocialRegeneration
WarningTriggers:
WT.Z1.01:
if 2 of {S02,S04,S11} enter PreFence
WT.Z1.02:
if cp > cp_warn
WT.Z1.03:
if household continuity risk persists for 1 cycle
HardTriggers:
HT.Z1.01:
if S02 < HardFailMin and a named bind breaks HT.Z1.02: if S04 <= HardFailMin HT.Z1.03: if S03 > FailMax and the routine cannot be restored in time
EmergencyTriggers:
ET.Z1.01:
if eviction / routine collapse / schooling continuity breaks immediately
FencePoints:
– EvictionThreshold
– CommuteFailureCascade
– WorkRoutineSnap
– CareLoadOverrun
MandatoryActions:
– A01 FreezeExpansion
– A02 DropOptionalLoad
– A03 ProtectCoreNodes
– A08 SwitchToFallbackRoute
– A11 DowngradeToSafeMode
ProtectedCore:
– work-housing continuity
– school continuity
– care continuity
– minimal routine predictability
CutFirst:
– non-essential schedule load
– performance-maximizing but non-core tasks
– optional travel / optional commitments
ReentryCondition:
– key named bind restored
– S04 > WarningMin
– S02 >= WarningMin
– no unresolved household continuity breach

Z2.FENCE.v1:
Scope:
Community / district corridor
PrioritySensors:
– S01 NodeContinuity
– S02 BindQuality
– S06 TrustSignal
– S10 GovernanceCoherence
– S11 SocialRegeneration
WarningTriggers:
WT.Z2.01:
if S06 and S10 both enter PreFence
WT.Z2.02:
if district service continuity narrows for 1 cycle
WT.Z2.03:
if S01 or S02 deteriorates one band rapidly
HardTriggers:
HT.Z2.01:
if S01 < HardFailMin HT.Z2.02: if S02 < HardFailMin and district transfer visibly breaks HT.Z2.03: if S06 and S10 both < HardFailMin EmergencyTriggers: ET.Z2.01: if community coordination fails during stress and local repair cannot be trusted FencePoints: – NeighborhoodHollowing – ServiceCoordinationBreak – TrustCollapsePocket – LocalSignalFailure MandatoryActions: – A01 FreezeExpansion – A03 ProtectCoreNodes – A05 SlowDecisionVelocity – A10 ForceTruthAudit – A11 DowngradeToSafeMode ProtectedCore: – core local services – basic trust corridor – district repair coordination CutFirst: – non-core programs – disputed optional initiatives – high-complexity non-essential service changes ReentryCondition: – S01 and S02 >= WarningMin
– S06 >= WarningMin
– local truth channel working again

Z3.FENCE.v1:
Scope:
City system corridor
PrioritySensors:
– S03 RepairLatency
– S04 BufferDepth
– S07 InfrastructureRedundancy
– S10 GovernanceCoherence
WarningTriggers:
WT.Z3.01:
if S07 enters PreFence on a critical system
WT.Z3.02:
if S03 exceeds WarnMax
WT.Z3.03:
if S04 falls to WarningMin
WT.Z3.04:
if maintenance backlog grows faster than repair closes
HardTriggers:
HT.Z3.01:
if S07 < HardFailMin on critical infrastructure HT.Z3.02: if S03 > FailMax for core systems
HT.Z3.03:
if S04 <= HardFailMin HT.Z3.04: if S10 < HardFailMin and wrong repair loops persist EmergencyTriggers: ET.Z3.01: if a critical system loses continuity now Examples: – utility grid – water corridor – transport backbone – hospital continuity FencePoints: – MaintenanceDebtCliff – SystemOverload – RedundancyLoss – InfrastructureSinglePointFragility MandatoryActions: – A01 FreezeExpansion – A03 ProtectCoreNodes – A07 RingFenceCriticalResources – A08 SwitchToFallbackRoute – A09 PausePrestigeOrFrontierProjects – A11 DowngradeToSafeMode ProtectedCore: – utilities continuity – emergency services – critical transport – water / energy continuity – repair command channels CutFirst: – expansionary capital projects – non-essential upgrades – cosmetic / prestige spend ReentryCondition: – critical continuity restored – S07 >= WarningMin
– S03 <= WarnMax
– fallback routes stable under load

Z4.FENCE.v1:
Scope:
Macro governance / institutional corridor
PrioritySensors:
– S03 RepairLatency
– S04 BufferDepth
– S10 GovernanceCoherence
– S06 TrustSignal
WarningTriggers:
WT.Z4.01:
if S10 enters PreFence
WT.Z4.02:
if S03 exceeds WarnMax on macro correction loops
WT.Z4.03:
if policy-execution mismatch persists for 1 cycle
HardTriggers:
HT.Z4.01:
if S10 < HardFailMin HT.Z4.02: if S03 > FailMax and wrong-model repair is active
HT.Z4.03:
if reserve drawdown continues while policy still expands load
EmergencyTriggers:
ET.Z4.01:
if macro policy is actively amplifying system damage
FencePoints:
– GovernanceGridlock
– WrongModelEscalation
– ReserveMisallocation
– MacroLegitimacyBreak
MandatoryActions:
– A01 FreezeExpansion
– A05 SlowDecisionVelocity
– A09 PausePrestigeOrFrontierProjects
– A10 ForceTruthAudit
– A11 DowngradeToSafeMode
ProtectedCore:
– truthful telemetry
– repair authorization channels
– reserve allocation discipline
– minimum legitimacy corridor
CutFirst:
– policy churn
– symbolic escalation
– large-scale commitments not tied to core repair
ReentryCondition:
– wrong-model loop stopped
– S10 >= WarningMin
– S03 <= WarnMax
– reserve allocation reconciled in ledger

Z5.FENCE.v1:
Scope:
Global interface corridor
PrioritySensors:
– S04 BufferDepth
– S08 TalentTransfer
– S12 ExternalDependency
– S06 TrustSignal
WarningTriggers:
WT.Z5.01:
if S12 enters PreFence
WT.Z5.02:
if S08 drops one full band over 2 cycles
WT.Z5.03:
if shell remains strong while base weakens for 2 cycles
HardTriggers:
HT.Z5.01:
if S12 >= ed_fail equivalent
HT.Z5.02:
if S04 <= HardFailMin and external corridor is concentrated
HT.Z5.03:
if Z5 performance depends on unreconciled base drawdown
EmergencyTriggers:
ET.Z5.01:
if critical external supply / finance / talent corridor severs with no reserve route
FencePoints:
– ExternalDependencyConcentration
– TalentDrain
– ShellBaseDetachment
– ConfidenceShockInterface
MandatoryActions:
– A01 FreezeExpansion
– A07 RingFenceCriticalResources
– A08 SwitchToFallbackRoute
– A09 PausePrestigeOrFrontierProjects
– A11 DowngradeToSafeMode
ProtectedCore:
– base-facing imports / reserves
– minimum external continuity needed for domestic stability
– key talent retention / replacement corridors
CutFirst:
– discretionary frontier projection
– non-essential global commitments
– shell-strength signaling that consumes buffer
ReentryCondition:
– dependency concentration reduced below warning
– reserves replenished above warning
– shell/base divergence reconciled for 2 cycles

Z6.FENCE.v1:
Scope:
Civilisation-node corridor
PrioritySensors:
– S04 BufferDepth
– S08 TalentTransfer
– S10 GovernanceCoherence
– S12 ExternalDependency
WarningTriggers:
WT.Z6.01:
if the city exports more complexity than it can safely carry
WT.Z6.02:
if model influence rises while base verification weakens
WT.Z6.03:
if long-horizon buffer drawdown persists for 2 cycles
HardTriggers:
HT.Z6.01:
if civilisational-node role is being maintained by BorrowedLift
HT.Z6.02:
if long-horizon reserves fall below HardFailMin
HT.Z6.03:
if exported model is no longer validated by domestic load-bearing reality
EmergencyTriggers:
ET.Z6.01:
if prestige / symbolic shell is causing macro self-cannibalization now
FencePoints:
– PrestigeShellOverreach
– ModelExportWithoutBaseProof
– LongHorizonReserveBreach
– CivilisationNodeHollowing
MandatoryActions:
– A01 FreezeExpansion
– A09 PausePrestigeOrFrontierProjects
– A10 ForceTruthAudit
– A11 DowngradeToSafeMode
– A12 StageReentry
ProtectedCore:
– long-horizon reserves
– base verification
– succession continuity
– credible exported model set
CutFirst:
– symbolic overprojection
– speculative frontier commitments
– non-rent-paying P4-style excursions
ReentryCondition:
– base validated under load
– reserve status no longer Borrowing/Breached
– exported model reconciled with domestic reality

=============================================================================

COLLAPSE-MODE-SPECIFIC FENCE OVERRIDES

=============================================================================

CM1.FENCE_OVERRIDE.v1:
Name: TransferBreakOverride
TriggerBias:
Faster escalation to F2 if named bind is broken
Recognition:
– S01 or S02 in Breach
– visible corridor decoupling
MandatoryActions:
– A03 ProtectCoreNodes
– A08 SwitchToFallbackRoute
– A11 DowngradeToSafeMode
CutFirst:
– all non-essential pathways dependent on broken bind
ProtectedCore:
– minimum viable corridor across the broken transfer
StitchingRule:
– reattach one bind at a time
– verify each bind under load before adding another
MustNotDo:
– add complexity before bind repair
– assume shell strength heals broken transfer
– reopen all pathways at once

CM2.FENCE_OVERRIDE.v1:
Name: BufferBreachOverride
TriggerBias:
Fast escalation when runway is collapsing
Recognition:
– S04 in Breach
– cp >= fail
– reserves falling faster than replenishment
MandatoryActions:
– A02 DropOptionalLoad
– A04 ProtectMinimumBuffers
– A07 RingFenceCriticalResources
– A09 PausePrestigeOrFrontierProjects
CutFirst:
– frontier / prestige / optional loads
– non-core capital commitments
– demand growth without new buffer
ProtectedCore:
– minimum operating runway
– maintenance essentials
– human carrier essentials
StitchingRule:
– restore runway first
– no reexpansion until 2 cycles of stable headroom
MustNotDo:
– spend reserves on optics
– conceal depletion
– widen scope while borrowing

CM3.FENCE_OVERRIDE.v1:
Name: SignalCorruptionOverride
TriggerBias:
Highest precedence when wrong repair is amplifying damage
Recognition:
– S03 in Breach
– S06/S10 weak
– visible mismatch between policy and outcomes
MandatoryActions:
– A05 SlowDecisionVelocity
– A10 ForceTruthAudit
– A11 DowngradeToSafeMode
CutFirst:
– wrong-model interventions
– punitive symptom management without root correction
– dashboard-only governance
ProtectedCore:
– truthful sensing channels
– independent outcome verification
– repair authority that can change course
StitchingRule:
– restore truthful model first
– then restart repair loops slowly
MustNotDo:
– punish symptoms while preserving wrong model
– suppress telemetry
– trust surface performance over base signals

CM_PRECEDENCE.v1:
If multiple collapse modes are active:
PriorityOrder:
1: CM3
2: CM2
3: CM1
Reason:
Wrong model causes false repair;
buffer loss closes time windows;
transfer breaks often become easier to repair once model and runway are stabilized.

=============================================================================

FENCE INEQUALITIES

=============================================================================

FENCE_INEQUALITY_SET.v1:
I.F1:
Name: ThresholdApproachRatio
Formula: Theta = TimeToThreshold / EffectiveRepairTime
Meaning:
If Theta <= 1, normal repair will not arrive before threshold crossing Trigger: Theta <= 1 -> F1 minimum
Theta <= 0.5 -> F2 mandatory

I.F2:
Name: BufferCoverRatio
Formula: Beta = AvailableBuffer / RequiredShockCover
Meaning:
If Beta < 1, system cannot absorb expected shock Trigger: Beta < 1 -> Warning
Beta < 0.5 -> HardTrigger

I.F3:
Name: SignalValidityRatio
Formula: Sigma = TruthQuality / RequiredTruthQuality
Meaning:
If Sigma < 1, repair decisions are operating below valid sensing threshold Trigger: Sigma < 1 -> Warning
Sigma < 0.7 -> HardTrigger
Sigma < 0.5 -> CM3 precedence

I.F4:
Name: BaseShellRatio
Formula: Psi = BaseHealth / ShellHealth
Meaning:
If Psi too low, shell performance is masking hollowed base
Trigger:
Psi < 0.85 for 2 cycles -> Warning
Psi < 0.70 for 2 cycles -> HardTrigger
Psi < 0.55 -> BorrowedLift lock + expansion freeze

I.F5:
Name: ChoiceShearRatio
Formula: rho = ChoiceLoad / ChoiceCapacity
Meaning:
If rho exceeds Z-budget, operator corridors destabilize
Trigger:
rho > rho_warn -> Warning
rho > rho_fail -> HardTrigger

=============================================================================

REENTRY / STITCHING MAP

=============================================================================

STITCHING_ORDER.v1:
Principle:
Reconnect lowest-risk, highest-core-value corridors first.
Order:
S1:
restore protected core continuity
S2:
restore minimal viable buffers
S3:
restore one broken bind at a time
S4:
restore simplified operator complexity
S5:
restore redundancy
S6:
reopen selective expansion only after proof
ReentryLocks:
RL1:
No frontier permission during F3 or F4
RL2:
No full reentry if any critical ledger breach remains unreconciled
RL3:
No shell expansion if Z0-Z2 still below Neu
RL4:
No return to F0 until recheck window passes under real load

REENTRY_VERIFICATION.v1:
MinimumChecks:
– one normal cycle
– one moderate load cycle
– no recurrence of same trigger in that window
Pass:
– protected core stable
– trigger inequalities back above warning corridor
– no hidden buffer drawdown
Fail:
– repeated trigger on same corridor
– apparent recovery only due to suppressed load
– shell recovery while base remains downgraded

=============================================================================

CITY-SPECIFIC FENCE BIASES

=============================================================================

CITY_FENCE_PROFILE.v1:

NewYork:
DominantBias:
– accelerate on L05/L06 choice shear at Z0-Z2
– accelerate on shell/base divergence at Z5
EarlyFencePoints:
– AffordabilitySpiral
– TransitWorkDecoupling
– PrestigeMaskingBaseDrift
DefaultCutFirst:
– optional complexity
– prestige signaling
– non-core growth commitments
DefaultProtectedCore:
– access continuity
– base throughput
– mixed-income transfer corridors

Singapore:
DominantBias:
– accelerate on dependency concentration and overcompression
– maintain higher reserve protection thresholds
EarlyFencePoints:
– ExternalSupplyConcentration
– CorrelatedFragility
– HumanRegenerationCompression
DefaultCutFirst:
– non-essential optimization
– over-tight performance regimes
– frontier pilots without reserve cover
DefaultProtectedCore:
– strategic reserves
– utilities continuity
– repair latency advantage
– human slack floor

Beijing:
DominantBias:
– accelerate on truth-lag and wrong-model escalation
– prioritize CM3 precedence more aggressively
EarlyFencePoints:
– TelemetrySuppression
– ComplianceWithoutCorrection
– PolicyCascadeAmplification
DefaultCutFirst:
– wrong-model directives
– expansion based on distorted telemetry
DefaultProtectedCore:
– truthful upward signal channels
– local repair bandwidth
– macro reserve integrity

Tokyo:
DominantBias:
– earlier fencing for slow regeneration erosion and slow drift
– stronger protection for maintenance loops
EarlyFencePoints:
– SilentHollowing
– MaintenanceStaffingNarrowing
– RenewalDelay
DefaultCutFirst:
– optional legacy overhead
– delayed adaptation rituals that consume repair time
DefaultProtectedCore:
– maintenance continuity
– trustable routine
– regeneration corridors

London:
DominantBias:
– accelerate when legacy shell diverges from everyday throughput
– earlier trust / legitimacy trigger at Z2-Z4
EarlyFencePoints:
– LegacyBorrowedLift
– CivicThroughputNarrowing
– FragmentationShear
DefaultCutFirst:
– prestige-first commitments
– symbolic reform without throughput repair
DefaultProtectedCore:
– daily civic function
– affordability-linked access
– shared legitimacy corridor

Seoul:
DominantBias:
– accelerate for regeneration stress and performance overload
– stronger fencing on choice compression at Z0-Z2
EarlyFencePoints:
– BurnoutCascade
– RegenerationPenalty
– ExportShellBaseStrain
DefaultCutFirst:
– performance-maximizing non-core load
– comparison-driven escalation
– frontier signaling without base slack
DefaultProtectedCore:
– human slack
– health / family-capable corridor
– sustainable skill transfer

=============================================================================

ONE-PANEL HOOKS

=============================================================================

PANEL_HOOKS.v1:
FenceState:
derived from FENCE_STATE_MACHINE
TriggeredFencePoints:
output top 1-3 named active fence points
DowngradeOrReentry:
Hold:
if F2 or F3 active
Downgrade:
if HardTrigger with unresolved breach
PartialReentry:
if F4 and only core restored
FullReentry:
only at F5 after verification
TopRepairMoves3:
must respect active FENCE state:
– one immediate protect move
– one repair move
– one anti-relapse move
MustNotDo:
pull from active collapse-mode override + active Z-level FENCE rules

FENCE_TO_LAW_MAP.v1:
Low S04 / Buffer danger:
elevate L02, L08, L09
High rho / choice shear:
elevate L05, L06
Truth failure / delayed repair:
elevate L03, L04, L11
Shell/base divergence:
elevate L07, L09, L11
Repeated trigger near rupture:
elevate L15

=============================================================================

DEFAULT BLANK FENCE OBJECT

=============================================================================

FenceObject:
CityID:
TimeSlice:
ZLevel:
ActiveCollapseMode:

TriggerInputs:
WarningTrigger:
HardTrigger:
EmergencyTrigger:
TriggerRatios:
Theta:
Beta:
Sigma:
Psi:
rho:

FenceState:
Current:
TriggeredFencePoints: [, , ]

APRC:
AssessRead:
PreserveCore: [, , ]
RerouteTo: [, , ]
CutFirst: [, , ]

Actions:
MandatoryActions: [, , ]
DowngradeMode:
ExpansionStatus:

Reentry:
StitchStage:
ReentryConditionMet:
VerificationStatus:

PASS_CONDITION.v1:
This spec is working if:
– every Z-level has explicit warning / hard / emergency triggers
– ActiveFence starts before irreversible crossings, not after
– APRC preserves core and cuts non-core first
– reentry is staged and load-verified
– shell expansion is frozen when base is weak

FAIL_CONDITION.v1:
This spec fails if:
– FENCE triggers too late to preserve continuity
– FENCE cuts core before non-core
– CM3 is treated like CM1 and wrong repair continues
– reentry happens without verification
– frontier / prestige projects continue during buffer breach

NEXT_DEPENDENCY:
After this, the next required spec is:
CivOS.CityInvariantLedger.StackedTemplates.v1.0
“`

“`text id=”r4y8mk”
SPEC_ID: CivOS.CityInvariantLedger.StackedTemplates.v1.0
TITLE: Universal Stacked Invariant Ledger Templates for Any City (Z0-Z6)
MODE: Almost-Code
OUTPUT_RULE: Code-Only
VERSION: v1.0
STATUS: Canonical Ledger Engine
DEPENDS_ON:

• CivOS.CityControlTower.OnePanel.v1.0
• CivOS.CitySensorThresholds.Calibration.v1.0
• CivOS.CityFENCE.TriggerMap.Z0-Z6.v1.0
• CivOS.CityLawPack.Global.Z3-Z6.CF.v1.0
• CivOS.CityOS.Pack6.Z0-Z6.CF.v1.0

PURPOSE:
Convert city stability from vague narrative into ledger-valid control logic.
The ledger stack records:
– what must remain invariant
– what has changed
– whether the change is allowed
– whether the system is borrowing, breaching, or reconciling
– what repair corridor is required for re-entry

CORE_FUNCTION:
DefineInvariant -> RecordStateChange -> CompareAgainstBounds -> FlagBreach ->
ComputeGap -> RouteRepair -> VerifyReconciliation

CANONICAL_DEFINITION:
A city invariant ledger is the authoritative reconciliation record of what must remain valid
across permitted city transformations through time.
The ledger does not create value from nowhere.
It tracks whether continuity, trust, capacity, and corridor validity remain intact
while the city changes under load.

RUNTIME_INHERITANCE:

• Lattice
• VeriWeft (VWF)
• ChronoFlight (CF)
• FENCE
• AVOO
• ERCO
• ChronoHelmAI

LEDGER_POSITION_IN_STACK.v1:
VWF:
Role: defines allowed relationship structure
SIL:
Role: records and reconciles actual state against allowed structure
FENCE:
Role: prevents irreversible crossings when ledgers breach faster than repair
OnePanel:
Role: surfaces active breaches, unreconciled gaps, reserve status, and verification state

CANONICAL_LEDGER_LAW.v1:
A city remains ledger-valid when:
– permitted transformations do not break protected invariants
– borrowing remains inside declared and repayable bounds
– core obligations remain visible and reconciled
– repair closes gaps faster than drift opens new ones

CANONICAL_INEQUALITIES.v1:
I.LGR.01:
Name: Reconciliation Dominance
Formula: ReconciliationRate >= BreachAccumulationRate
I.LGR.02:
Name: Reserve Validity
Formula: ReserveUsable >= CommittedCoreObligations + ShockAllowance
I.LGR.03:
Name: Truth Before Correction
Formula: VerifiedSignalLatency <= RepairDecisionLatency I.LGR.04: Name: Base Before Shell Formula: BaseLedgerHealth >= MinimumBaseFloor
I.LGR.05:
Name: Rent To Base
Formula: FrontierOrPrestigeOutflow <= SurplusAfterBaseMaintenance

LEDGER_STATE_SET.v1:
L0:
Name: Healthy
Meaning: Invariants hold with headroom; obligations are visible and reconciled
L1:
Name: Tight
Meaning: Invariants still hold, but headroom is narrow
L2:
Name: Borrowing
Meaning: Present continuity depends on reserve drawdown, delayed maintenance, or future transfer
L3:
Name: Breached
Meaning: Protected invariant already crossed or unreconcilable under current mode
L4:
Name: Reconciling
Meaning: Repair is active and the gap is closing
L5:
Name: Verified
Meaning: Reconciliation has held under load across the required recheck window

LEDGER_FLAG_SET.v1:
F01: HiddenBorrowing
F02: DelayedMaintenance
F03: ShellBaseDivergence
F04: TruthGap
F05: CapacityMispricing
F06: UnfundedObligation
F07: TransferDiscontinuity
F08: RegenerationErosion
F09: DependencyConcentration
F10: LegitimacyMismatch

STACKED_LEDGER_ARCHITECTURE.v1:
RequiredLedgers:
– LGR.BaseLife
– LGR.CivicThroughput
– LGR.InfrastructureContinuity
– LGR.GovernanceLegitimacy
– LGR.ExternalInterface
– LGR.Regeneration
OptionalDerivedLedgers:
– LGR.FrontierPermission
– LGR.PrestigeVsBase
– LGR.TalentSuccession
– LGR.TruthAndTelemetry

LEDGER_COMMON_FIELDS.v1:
All ledgers must contain:
LedgerID
TimeSlice
CityID
Scope
ZCoverage
ProtectedInvariants
MeasuredState
AllowedRange
CurrentGap
StateClass
Flags
BorrowingStatus
RepairRoute
VerificationStatus
OwnerLayer
NextRecheckWindow

OWNER_LAYER_GRAMMAR.v1:
Z0-Z1:
OwnerLayer = HumanCarrier / household / frontline operator
Z2-Z3:
OwnerLayer = district / city system operator
Z4:
OwnerLayer = macro governance / institutional control
Z5-Z6:
OwnerLayer = external interface / civilisation-node steward

=============================================================================

LEDGER 1: BASE LIFE

=============================================================================

LEDGER_TEMPLATE:
LedgerID: LGR.BaseLife
Title: Base Life Ledger
Scope:
Tracks the non-negotiable minimum conditions for everyday human continuity.
ZCoverage:
Primary: {Z0, Z1}
Secondary: {Z2}
WhyItExists:
A city that looks strong at the shell can still be invalid if basic life corridors fail.
ProtectedInvariants:
BLI.01: shelter continuity remains accessible
BLI.02: food and basic daily access remain viable
BLI.03: minimum safe mobility remains intact
BLI.04: daily planning remains possible
BLI.05: essential routine does not collapse faster than repair
PrimarySensors:
– S03 RepairLatency
– S04 BufferDepth
– S06 TrustSignal
– S09 CostPressure
SecondarySensors:
– S01 NodeContinuity
– S11 SocialRegeneration
AllowedTransformations:
– change in work pattern
– cost adjustments within runway
– routine compression within safe limits
– temporary fallback routing
ForbiddenTransformations:
– housing/work decoupling without replacement route
– essential cost overload beyond cp_fail
– removal of basic access without protected substitute
– routine collapse without emergency corridor
BorrowingModes:
– deferred basic maintenance
– unsustainable household debt
– time starvation traded for short-term continuity
StateClassRules:
Healthy:
if all protected invariants hold and no primary sensor in PreFence
Tight:
if 1-2 primary sensors in Warning / PreFence
Borrowing:
if continuity is being preserved by unstable debt, time depletion, or hidden drawdown
Breached:
if any BLI invariant fails directly
TypicalFlags:
– F01 HiddenBorrowing
– F06 UnfundedObligation
– F07 TransferDiscontinuity
RepairRoute:
– restore minimum runway
– reduce non-core load
– repair broken access bind
– re-establish daily planning predictability
ReentryRequirement:
– S04 above WarningMin
– S03 within WarnMax
– no unresolved basic access break
OnePanelOutputHooks:
– HumanCarrierBand
– ActiveLedgerBreaches
– ReserveRentStatus (base floor precedence)

=============================================================================

LEDGER 2: CIVIC THROUGHPUT

=============================================================================

LEDGER_TEMPLATE:
LedgerID: LGR.CivicThroughput
Title: Civic Throughput Ledger
Scope:
Tracks whether the city’s ordinary daily transfer corridors still move people, services, and obligations reliably.
ZCoverage:
Primary: {Z2, Z3}
Secondary: {Z1, Z4}
WhyItExists:
Cities often fail not by symbolic collapse first, but by throughput narrowing underneath the shell.
ProtectedInvariants:
CTL.01: work-housing-service corridors remain coupled
CTL.02: district-level services remain reachable
CTL.03: ordinary delays remain inside tolerable corridor
CTL.04: basic coordination remains predictable enough for compliance and planning
CTL.05: service strain does not compound faster than repair
PrimarySensors:
– S01 NodeContinuity
– S02 BindQuality
– S03 RepairLatency
– S09 CostPressure
SecondarySensors:
– S06 TrustSignal
– S10 GovernanceCoherence
AllowedTransformations:
– temporary rerouting
– staged service changes
– controlled demand prioritization
ForbiddenTransformations:
– core service reduction without fallback corridor
– throughput compression hidden by shell metrics
– persistent commute-service mismatch without repair
BorrowingModes:
– deferring service maintenance
– pushing delay into public time budgets
– preserving shell performance while everyday corridor narrows
StateClassRules:
Healthy:
if core service couplings remain intact and delay pressure is bounded
Tight:
if throughput still functions but repairs lag
Borrowing:
if ordinary continuity depends on hidden delay accumulation or service strain
Breached:
if named corridor visibly decouples
TypicalFlags:
– F02 DelayedMaintenance
– F03 ShellBaseDivergence
– F07 TransferDiscontinuity
– F10 LegitimacyMismatch
RepairRoute:
– restore service coupling
– reduce congestion / delay load
– prioritize core throughput over symbolic surface outputs
ReentryRequirement:
– key named corridor restored
– service latency inside safe corridor
– no active district transfer snap
OnePanelOutputHooks:
– ZBandStatus
– DominantCrossZFailure
– ActiveBindBreak

=============================================================================

LEDGER 3: INFRASTRUCTURE CONTINUITY

=============================================================================

LEDGER_TEMPLATE:
LedgerID: LGR.InfrastructureContinuity
Title: Infrastructure Continuity Ledger
Scope:
Tracks whether critical city systems remain continuous, redundant, and repairable.
ZCoverage:
Primary: {Z3}
Secondary: {Z4, Z5}
WhyItExists:
A city may appear functional until a critical backbone loses continuity.
ProtectedInvariants:
ICL.01: utilities continuity remains intact
ICL.02: core redundancy stays above hard-fail floor
ICL.03: maintenance obligations remain visible and funded
ICL.04: fallback routes remain valid under stress
ICL.05: repair bandwidth remains available for core systems
PrimarySensors:
– S03 RepairLatency
– S04 BufferDepth
– S07 InfrastructureRedundancy
– S10 GovernanceCoherence
SecondarySensors:
– S12 ExternalDependency
– S06 TrustSignal
AllowedTransformations:
– staged upgrades
– controlled temporary load shedding
– fallback routing during repair
ForbiddenTransformations:
– expanding load while redundancy is degraded
– converting reserves to prestige while maintenance debt grows
– losing repair command channel integrity
BorrowingModes:
– delayed maintenance
– use of emergency redundancy as normal mode
– invisible backlog accumulation
StateClassRules:
Healthy:
if critical systems hold with usable redundancy and repair headroom
Tight:
if redundancy or repair speed narrows but continuity still holds
Borrowing:
if continuity depends on depleting maintenance reserves or emergency patching
Breached:
if critical continuity or redundancy falls below hard minimum
TypicalFlags:
– F02 DelayedMaintenance
– F05 CapacityMispricing
– F06 UnfundedObligation
– F09 DependencyConcentration
RepairRoute:
– protect critical nodes
– ring-fence maintenance resources
– re-establish fallback routes
– defer non-core expansion
ReentryRequirement:
– critical continuity restored
– S07 above WarningMin
– maintenance backlog no longer growing net
OnePanelOutputHooks:
– SystemBand
– TriggeredFencePoints
– ReserveRentStatus

=============================================================================

LEDGER 4: GOVERNANCE LEGITIMACY

=============================================================================

LEDGER_TEMPLATE:
LedgerID: LGR.GovernanceLegitimacy
Title: Governance Legitimacy Ledger
Scope:
Tracks whether rules, decisions, and institutions remain sufficiently trusted and coherent to support valid correction.
ZCoverage:
Primary: {Z3, Z4}
Secondary: {Z2, Z5}
WhyItExists:
If the city cannot distinguish real conditions from the wrong model, repair becomes misrepair.
ProtectedInvariants:
GLL.01: rules remain reconcilable with lived outcomes
GLL.02: truth can move upward in time to matter
GLL.03: correction channels remain usable
GLL.04: authority and outcomes do not diverge beyond tolerance
GLL.05: repair decisions remain grounded in verified telemetry
PrimarySensors:
– S03 RepairLatency
– S06 TrustSignal
– S10 GovernanceCoherence
SecondarySensors:
– S01 NodeContinuity
– S02 BindQuality
– S12 ExternalDependency
AllowedTransformations:
– policy change with visible rationale
– staged reform with measured corrections
– temporary downgrade if openly ledgered
ForbiddenTransformations:
– policy oscillation without reconciliation
– compliance theatre replacing actual correction
– suppressing adverse telemetry while continuing same model
BorrowingModes:
– spending inherited legitimacy
– masking error with symbolic confidence
– using coercive compliance to hide incoherence
StateClassRules:
Healthy:
if trust, coherence, and correction remain aligned
Tight:
if trust or coherence narrows, but truth still moves
Borrowing:
if authority is being maintained by legacy or force while lived outcomes diverge
Breached:
if wrong-model correction persists or truth channels are functionally unusable
TypicalFlags:
– F04 TruthGap
– F10 LegitimacyMismatch
– F05 CapacityMispricing
RepairRoute:
– force truth audit
– stop wrong-model loops
– restore signal legitimacy
– re-sequence reforms to match actual corridor width
ReentryRequirement:
– verified signal latency restored
– S06 and S10 above WarningMin
– no active wrong-model escalation
OnePanelOutputHooks:
– SignalQuality
– TruthLatencyRisk
– VerificationStatus

=============================================================================

LEDGER 5: EXTERNAL INTERFACE

=============================================================================

LEDGER_TEMPLATE:
LedgerID: LGR.ExternalInterface
Title: External Interface Ledger
Scope:
Tracks whether the city’s global-facing corridors remain beneficial, diversified, and base-supporting.
ZCoverage:
Primary: {Z5}
Secondary: {Z4, Z6}
WhyItExists:
External power that detaches from the base can create shell strength while hollowing the core.
ProtectedInvariants:
EIL.01: critical external corridors remain diversified enough to avoid concentration traps
EIL.02: external inflows reinforce, not cannibalise, the base
EIL.03: talent transfer remains net-supportive or replaceable
EIL.04: external confidence is not being purchased by hidden drawdown
EIL.05: shell performance remains reconciled with domestic load-bearing reality
PrimarySensors:
– S04 BufferDepth
– S08 TalentTransfer
– S12 ExternalDependency
SecondarySensors:
– S06 TrustSignal
– S10 GovernanceCoherence
AllowedTransformations:
– selective external concentration with reserve cover
– temporary external rerouting
– controlled export-facing expansion after base verification
ForbiddenTransformations:
– expanding external shell while base weakens
– concentrating critical dependency beyond ed_fail
– using prestige shell to hide reserve depletion
BorrowingModes:
– reputation drawdown
– overconcentrated dependency accepted for short-term gain
– talent drain hidden by surface inflows
StateClassRules:
Healthy:
if external corridors strengthen resilience and remain diversified
Tight:
if concentration or dependence narrows, but reserves cover it
Borrowing:
if external shell is being sustained by base drawdown or hidden concentration risk
Breached:
if critical external corridor threatens domestic stability directly
TypicalFlags:
– F03 ShellBaseDivergence
– F09 DependencyConcentration
– F01 HiddenBorrowing
RepairRoute:
– diversify critical corridors
– ring-fence base-serving reserves
– pause non-rent-paying global expansion
ReentryRequirement:
– dependency concentration below warning
– shell/base divergence reconciled
– reserves restored above warning
OnePanelOutputHooks:
– ExternalInterfaceBand
– BorrowedLiftFlag
– FrontierPermission

=============================================================================

LEDGER 6: REGENERATION

=============================================================================

LEDGER_TEMPLATE:
LedgerID: LGR.Regeneration
Title: Regeneration Ledger
Scope:
Tracks whether the city is restoring the human and institutional carriers required for continuity through time.
ZCoverage:
Primary: {Z0, Z1, Z2}
Secondary: {Z3, Z4}
WhyItExists:
High-output cities can silently consume their own future if regeneration stays below replacement.
ProtectedInvariants:
RGL.01: human carriers recover enough to remain functional
RGL.02: family-capable / renewal-capable slack remains above floor
RGL.03: institutional succession remains viable
RGL.04: learning-to-work-to-life transfer remains sustainable
RGL.05: today’s performance does not cannibalise tomorrow’s corridor
PrimarySensors:
– S04 BufferDepth
– S08 TalentTransfer
– S11 SocialRegeneration
SecondarySensors:
– S03 RepairLatency
– S09 CostPressure
– S06 TrustSignal
AllowedTransformations:
– temporary intensive periods with explicit recovery
– targeted skill acceleration with protected slack
– staged succession programs
ForbiddenTransformations:
– sustained high performance without recovery
– taking from future demographic / human reserves to preserve current shell
– draining training pipelines without replenishment
BorrowingModes:
– human stamina drawdown
– deferred family / recovery / succession capacity
– institutional continuity maintained by aging stock without renewal
StateClassRules:
Healthy:
if regeneration stays above replacement and recovery is real
Tight:
if output remains strong but recovery corridor narrows
Borrowing:
if present performance depends on future carrier depletion
Breached:
if regeneration falls below replacement long enough to threaten continuity
TypicalFlags:
– F01 HiddenBorrowing
– F08 RegenerationErosion
– F06 UnfundedObligation
RepairRoute:
– protect slack as infrastructure
– reduce load intensity
– restore renewal/succession corridors
– realign metrics away from short-horizon shell-only success
ReentryRequirement:
– S11 above WarningMin
– visible recovery window restored
– no continued extraction from future carrier base
OnePanelOutputHooks:
– HumanCarrierBand
– MustNotDo
– Next30Days

=============================================================================

OPTIONAL DERIVED LEDGERS

=============================================================================

LEDGER_TEMPLATE:
LedgerID: LGR.FrontierPermission
Title: Frontier Permission Ledger
Scope:
Determines whether the city may safely open new frontier / prestige / P4-like corridors.
ZCoverage:
Primary: {Z5, Z6}
Dependencies:
– LGR.BaseLife
– LGR.InfrastructureContinuity
– LGR.Regeneration
– LGR.ExternalInterface
PermissionRule:
Open only if:
– no critical breach in base ledgers
– ReserveRentStatus = Healthy
– BaseLedgerHealth >= Neu minimum across Z0-Z3
– no active FENCE state above F1
States:
Blocked
Narrow
Conditional
Open
OnePanelOutputHooks:
– FrontierPermission

LEDGER_TEMPLATE:
LedgerID: LGR.PrestigeVsBase
Title: Prestige vs Base Ledger
Scope:
Tracks divergence between shell strength and ordinary corridor strength.
ZCoverage:
Primary: {Z3, Z5, Z6}
CoreInvariant:
PBL.01: shell cannot remain classified healthy while base is persistently weak
FlagRule:
if Psi = BaseHealth / ShellHealth < threshold:
flag F03 ShellBaseDivergence
OnePanelOutputHooks:
– BorrowedLiftFlag
– CityBand downgrade logic

LEDGER_TEMPLATE:
LedgerID: LGR.TruthAndTelemetry
Title: Truth and Telemetry Ledger
Scope:
Tracks whether the city’s sensing layer remains fit for repair.
ZCoverage:
Primary: {Z2, Z3, Z4}
CoreInvariant:
TTL.01: reality must reach the decision layer before repair windows close
OnePanelOutputHooks:
– SignalQuality
– TruthLatencyRisk
– ConfidenceBand

=============================================================================

STACKING RULES

=============================================================================

LEDGER_STACK_ORDER.v1:
Order:
1: LGR.BaseLife
2: LGR.Regeneration
3: LGR.CivicThroughput
4: LGR.InfrastructureContinuity
5: LGR.GovernanceLegitimacy
6: LGR.ExternalInterface
7: OptionalDerivedLedgers
Rule:
Lower/base ledgers take precedence over higher/shell ledgers.
Consequence:
If a lower ledger is Breached, higher ledgers cannot justify “healthy” classification by shell performance alone.

STACK_INTERACTION_RULES.v1:
Rule1:
BaseLife breach auto-downgrades CivicThroughput by at least one state
Rule2:
Regeneration borrowing for 2 cycles auto-flags HiddenBorrowing in ExternalInterface if shell remains strong
Rule3:
InfrastructureContinuity borrowing auto-forces ReserveRentStatus = Tight or worse
Rule4:
GovernanceLegitimacy breach raises CM3 priority regardless of shell metrics
Rule5:
ExternalInterface cannot be Healthy if PrestigeVsBase is flagged for 2 cycles
Rule6:
FrontierPermission blocked if any of:
– BaseLife = Breached
– Regeneration = Borrowing/Breached
– InfrastructureContinuity = Borrowing/Breached
– GovernanceLegitimacy = Breached

LEDGER_PRECEDENCE.v1:
HighestPrecedence:
– LGR.BaseLife
– LGR.GovernanceLegitimacy (if CM3 active)
MediumPrecedence:
– LGR.InfrastructureContinuity
– LGR.Regeneration
LowerPrecedence:
– LGR.CivicThroughput
– LGR.ExternalInterface
Explanation:
Basic life and valid truth are preconditions for safe correction.
Shell success without them is not ledger-valid.

=============================================================================

RECONCILIATION ENGINE

=============================================================================

RECONCILIATION_WORKFLOW.v1:
Step1:
Read current ledger state and identify all active gaps
Step2:
Classify each gap:
– reversible
– borrowing
– hard breach
Step3:
Order repair by precedence:
– base first
– signal before growth
– buffers before prestige
Step4:
Assign repair routes:
– R1/R2 for immediate preservation
– R3/R4 for structural reconciliation
– R5/R6 for re-entry
Step5:
Recompute state after one cycle
Step6:
If gap shrinks:
move from Borrowing/Breached -> Reconciling
Else:
escalate FENCE and downgrade shell permissions
Step7:
Require verification under load before marking Verified

GAP_GRAMMAR.v1:
GapTypes:
G1: CapacityGap
G2: TruthGap
G3: ContinuityGap
G4: ReserveGap
G5: RegenerationGap
G6: LegitimacyGap
ForEachGap:
Must define:
– magnitude
– trend
– Z coverage
– whether hidden or explicit
– estimated closure path

VERIFICATION_RULE.v1:
A ledger moves to Verified only if:
– gap has closed below warning threshold
– no hidden borrowing flag remains unresolved
– state holds across one normal cycle + one moderate load cycle
– no higher-precedence ledger has downgraded in the same window

=============================================================================

CITY-SPECIFIC LEDGER BIASES

=============================================================================

CITY_LEDGER_PROFILE.v1:

NewYork:
Bias:
– tighten LGR.BaseLife and LGR.CivicThroughput tolerance for shell/base divergence
ExpectedFlagBias:
– F03 ShellBaseDivergence
– F01 HiddenBorrowing
– F07 TransferDiscontinuity
PriorityLedgers:
– LGR.BaseLife
– LGR.CivicThroughput
– LGR.PrestigeVsBase

Singapore:
Bias:
– tighten LGR.InfrastructureContinuity and LGR.ExternalInterface on reserve and dependency thresholds
ExpectedFlagBias:
– F09 DependencyConcentration
– F05 CapacityMispricing
– F08 RegenerationErosion
PriorityLedgers:
– LGR.InfrastructureContinuity
– LGR.ExternalInterface
– LGR.Regeneration

Beijing:
Bias:
– tighten LGR.GovernanceLegitimacy and LGR.TruthAndTelemetry due to macro amplification risk
ExpectedFlagBias:
– F04 TruthGap
– F10 LegitimacyMismatch
– F05 CapacityMispricing
PriorityLedgers:
– LGR.GovernanceLegitimacy
– LGR.TruthAndTelemetry
– LGR.InfrastructureContinuity

Tokyo:
Bias:
– tighten LGR.Regeneration and LGR.InfrastructureContinuity for slow drift visibility
ExpectedFlagBias:
– F08 RegenerationErosion
– F02 DelayedMaintenance
PriorityLedgers:
– LGR.Regeneration
– LGR.InfrastructureContinuity
– LGR.CivicThroughput

London:
Bias:
– tighten LGR.PrestigeVsBase and LGR.GovernanceLegitimacy where legacy shell diverges from daily throughput
ExpectedFlagBias:
– F03 ShellBaseDivergence
– F10 LegitimacyMismatch
– F01 HiddenBorrowing
PriorityLedgers:
– LGR.PrestigeVsBase
– LGR.CivicThroughput
– LGR.GovernanceLegitimacy

Seoul:
Bias:
– tighten LGR.Regeneration and LGR.BaseLife because high performance can borrow from future carriers
ExpectedFlagBias:
– F08 RegenerationErosion
– F01 HiddenBorrowing
– F06 UnfundedObligation
PriorityLedgers:
– LGR.Regeneration
– LGR.BaseLife
– LGR.PrestigeVsBase

=============================================================================

ONE-PANEL HOOKS

=============================================================================

PANEL_HOOKS.v1:
ActiveLedgerBreaches:
Output:
top 1-3 breached ledgers by precedence
MostImportantUnreconciledGap:
Output:
highest-precedence active gap preventing safer classification
ReserveRentStatus:
DerivedFrom:
– LGR.InfrastructureContinuity
– LGR.ExternalInterface
– LGR.PrestigeVsBase
– LGR.FrontierPermission
Values:
Healthy
Tight
Borrowing
Breached
LedgerDirection:
DerivedFrom:
– gap trend across stack
Values:
Reconciling
Flat
Diverging
VerificationStatus:
Healthy if:
highest active repair ledger = Verified
Partial if:
repair active but not yet load-verified
Unverified if:
no valid reconciliation proof exists

FENCE_HOOKS.v1:
If any precedence ledger = Breached:
raise FENCE priority by 1 class
If BaseLife or GovernanceLegitimacy = Breached:
minimum FENCE state = F2
If Borrowing persists in 2+ ledgers:
auto-freeze expansion
If FrontierPermission blocked:
A09 PausePrestigeOrFrontierProjects becomes mandatory

LAW_HOOKS.v1:
L02 RateDominanceLaw:
validated through ReconciliationRate vs BreachAccumulationRate
L07 SingleCorridorLaw:
rises when multiple ledgers degrade and only one valid repair corridor remains
L08 ReserveRentLaw:
validated through reserve-bearing ledgers
L09 BorrowedLiftLaw:
triggered when shell ledger states exceed base ledger states persistently
L11 VesselFirstLaw:
triggered when BaseLife or Regeneration or GovernanceLegitimacy is weak
L12 FrontierApertureLaw:
governed by LGR.FrontierPermission
L15 EnvelopeRuptureEvent:
likely when precedence ledgers are Breached and FENCE is late or bypassed

=============================================================================

DEFAULT BLANK STACKED LEDGER OBJECT

=============================================================================

LedgerObject:
LedgerID:
TimeSlice:
CityID:
Scope:
ZCoverage: [, , ]

ProtectedInvariants:
–
–
–

MeasuredState:
PrimarySensors:
Sxx:
Syy:
Szz:
SecondarySensors:
Saa:
Sbb:

AllowedRange:
StateFloor:
BorrowingBoundary:
BreachBoundary:

CurrentGap:
GapType:
Magnitude:
Trend:
HiddenOrExplicit:

StateClass:
Flags: [, , ]
BorrowingStatus:
RepairRoute: [, , ]
VerificationStatus:
OwnerLayer:
NextRecheckWindow:

=============================================================================

PASS / FAIL

=============================================================================

PASS_CONDITION.v1:
This spec is working if:
– every city can be described through the same ledger spine
– lower/base ledgers constrain higher/shell ledgers
– borrowing is made visible instead of hidden
– unreconciled gaps route directly into repair and FENCE logic
– frontier permission becomes a derived outcome, not an assumption

FAIL_CONDITION.v1:
This spec fails if:
– shell metrics can still classify the city as healthy while base ledgers are breached
– hidden borrowing is not surfaced
– truth gaps do not change repair priority
– ledgers exist but do not alter decisions
– verification is declared without load proof

NEXT_DEPENDENCY:
After this, the next required spec is:
CivOS.CityFailureAtlas.3Modes.Z0-Z6.v1.0
“`

“`text id=”t9v6hf”
SPEC_ID: CivOS.CityFailureAtlas.3Modes.Z0-Z6.v1.0
TITLE: Universal City Failure Atlas (3 Collapse Modes) for Any City (Z0-Z6)
MODE: Almost-Code
OUTPUT_RULE: Code-Only
VERSION: v1.0
STATUS: Canonical Fast-Diagnosis Atlas
DEPENDS_ON:

• CivOS.CityControlTower.OnePanel.v1.0
• CivOS.CitySensorThresholds.Calibration.v1.0
• CivOS.CityFENCE.TriggerMap.Z0-Z6.v1.0
• CivOS.CityInvariantLedger.StackedTemplates.v1.0
• CivOS.CityLawPack.Global.Z3-Z6.CF.v1.0
• CivOS.CityOS.Pack6.Z0-Z6.CF.v1.0

PURPOSE:
Compress city failure diagnosis into 3 executable collapse modes so the system can:
– identify what is failing first
– avoid wrong repair
– choose the right FENCE bias
– route into the correct repair corridor fast
The atlas is designed for speed, clarity, and low diagnostic ambiguity.

CORE_FUNCTION:
ObserveSymptoms -> MatchSignature -> SelectDominantCM ->
ConfirmWithFastDiscriminators -> TriggerFENCEBias ->
RouteRepair -> VerifyNoMisclassification

CANONICAL_RULE:
All city failures must first be read through one dominant mode:
– CM1 TransferBreak
– CM2 BufferBreach
– CM3 SignalCorruption
Secondary modes may coexist, but action starts from the dominant mode only.

WHY_3_MODES_ONLY.v1:
Reason1:
Too many categories creates diagnostic blur and slows action.
Reason2:
Most visible failures are downstream mixtures of these 3 roots.
Reason3:
The One-Panel must converge to action, not taxonomy sprawl.
Rule:
Any observed event must map to:
– one dominant mode
– at most one secondary mode
– one primary repair corridor

COLLAPSE_MODE_SET.v1:
CM0:
Name: NoneActive
Meaning: No dominant collapse mode currently active
CM1:
Name: TransferBreak
Definition: Critical node/bind continuity fails; corridor snaps, decouples, or cannot carry load.
CM2:
Name: BufferBreach
Definition: Usable runway, reserves, slack, maintenance, or regenerative cover falls below safe floor.
CM3:
Name: SignalCorruption
Definition: The system is sensing wrongly, too slowly, or through distorted legitimacy, causing false repair.

ATLAS_OUTPUTS (must always exist):
O1: DominantCollapseMode
O2: SecondaryCollapseMode (optional)
O3: SignatureMatchConfidence
O4: FastDiscriminatorRead
O5: FirstWrongMoveToAvoid
O6: First3RepairMoves
O7: FENCEBias
O8: EscalationLevel
O9: VerificationCheck
O10: RelapseRisk

=============================================================================

CM1: TRANSFER BREAK

=============================================================================

CM1.ENTRY.v1:
Name: TransferBreak
CoreQuestion:
“Did the corridor itself snap?”
CanonicalSequence:
bind weakens -> continuity narrows -> named transfer fails ->
fallback absent/weak -> load piles up elsewhere -> visible snap
PrimarySensors:
– S01 NodeContinuity
– S02 BindQuality
SecondarySensors:
– S06 TrustSignal
– S08 TalentTransfer
– S03 RepairLatency
TypicalLedgerBreaches:
– LGR.BaseLife
– LGR.CivicThroughput
– LGR.InfrastructureContinuity
CanonicalInequalities:
I.CM1.01:
Formula: NodeContinuity >= MinimumContinuityFloor
I.CM1.02:
Formula: BindQuality >= MinimumBindFloor
I.CM1.03:
Formula: FallbackRouteExists = True for critical corridors
SignaturePattern:
– specific named corridor fails
– decoupling is visible and localized enough to name
– work<->housing, service<->demand, policy<->execution, or supply<->delivery breaks
FastDiscriminators:
FD.CM1.01:
if S01 or S02 is in Breach AND a named corridor break can be identified -> strong CM1
FD.CM1.02:
if restoring one bind materially improves function -> confirms CM1
FD.CM1.03:
if buffers are present but transfer still fails -> CM1 more likely than CM2
CommonFalseRead:
– confusing corridor snap with general “stress”
– treating it as only a budget issue when the route itself is broken
FirstWrongMoveToAvoid:
– adding more load into the broken corridor
– assuming shell strength will heal transfer automatically
– reopening all paths before bind repair
FENCEBias:
– prioritize CM1.FENCE_OVERRIDE
– fallback routes first
– one-bind-at-a-time stitching
RepairCorridor:
R.CM1.01: identify exact broken bind
R.CM1.02: protect minimum viable route
R.CM1.03: reduce optional complexity dependent on broken route
R.CM1.04: restore one coupling at a time
R.CM1.05: verify each restored link under real load
RelapseRisk:
High if:
– hidden overload remains on restored route
– adjacent binds were not checked
– shell metrics improve while the same corridor remains fragile

=============================================================================

CM2: BUFFER BREACH

=============================================================================

CM2.ENTRY.v1:
Name: BufferBreach
CoreQuestion:
“Did the system run out of usable runway?”
CanonicalSequence:
reserves narrow -> hidden drawdown starts -> maintenance deferred ->
slack disappears -> ordinary shock becomes system stress -> runway fails
PrimarySensors:
– S04 BufferDepth
– S09 CostPressure
– S07 InfrastructureRedundancy
SecondarySensors:
– S11 SocialRegeneration
– S03 RepairLatency
– S12 ExternalDependency
TypicalLedgerBreaches:
– LGR.BaseLife
– LGR.InfrastructureContinuity
– LGR.Regeneration
– LGR.ExternalInterface
CanonicalInequalities:
I.CM2.01:
Formula: AvailableBuffer >= RequiredShockCover
I.CM2.02:
Formula: ReserveUsable >= CoreObligations + MaintenanceFloor
I.CM2.03:
Formula: cp = EssentialLoad / EffectiveCapacity <= cp_fail SignaturePattern: – visible “nothing left to absorb the hit” – maintenance, reserves, time, money, attention, or human slack runs too thin – system survives only by cutting tomorrow to pay today FastDiscriminators: FD.CM2.01: if S04 is in Breach -> strong CM2
FD.CM2.02:
if cp >= cp_fail AND multiple optional loads still active -> strong CM2
FD.CM2.03:
if dropping non-core load improves stability quickly -> confirms CM2
CommonFalseRead:
– confusing depletion with laziness or poor execution alone
– trying to “push harder” instead of restoring runway
FirstWrongMoveToAvoid:
– spending remaining reserves on optics / prestige
– delaying maintenance further
– forcing expansion during runway collapse
FENCEBias:
– prioritize CM2.FENCE_OVERRIDE
– freeze expansion
– ring-fence critical resources
RepairCorridor:
R.CM2.01: stop non-core drawdown now
R.CM2.02: protect minimum viable reserves
R.CM2.03: restore buffer runway first
R.CM2.04: reprice obligations to real capacity
R.CM2.05: re-open only after 2 stable cycles of headroom
RelapseRisk:
High if:
– recovery is only temporary because pressure drivers are unchanged
– reserve rebuild is cosmetic
– hidden borrowing remains unresolved

=============================================================================

CM3: SIGNAL CORRUPTION

=============================================================================

CM3.ENTRY.v1:
Name: SignalCorruption
CoreQuestion:
“Is the system acting on the wrong reality model?”
CanonicalSequence:
signal degrades -> truth arrives late or distorted ->
wrong diagnosis -> wrong repair -> damage amplifies ->
dashboards diverge from lived reality -> trust and coherence erode
PrimarySensors:
– S03 RepairLatency
– S06 TrustSignal
– S10 GovernanceCoherence
SecondarySensors:
– S05 ChoiceLoad
– S12 ExternalDependency
– S01 NodeContinuity
TypicalLedgerBreaches:
– LGR.GovernanceLegitimacy
– LGR.TruthAndTelemetry
– LGR.CivicThroughput
CanonicalInequalities:
I.CM3.01:
Formula: VerifiedSignalLatency <= RepairDecisionLatency I.CM3.02: Formula: TruthQuality >= MinimumTruthQuality
I.CM3.03:
Formula: GovernanceCoherence >= MinimumCoherenceFloor
SignaturePattern:
– repairs are happening but conditions worsen
– policy and outcomes diverge
– surface dashboards say “fine” while lived corridor weakens
– compliance replaces correction
FastDiscriminators:
FD.CM3.01:
if S03 > FailMax AND the wrong repair persists -> strong CM3
FD.CM3.02:
if S06 and S10 are both below hard floor -> strong CM3
FD.CM3.03:
if “fixes” intensify the problem -> CM3 takes precedence
CommonFalseRead:
– reading the failure as “people not trying hard enough”
– treating symptoms as causes
– trusting polished reporting over structural signals
FirstWrongMoveToAvoid:
– punish symptoms while preserving the same wrong model
– speed up wrong decisions
– suppress contradictory telemetry
FENCEBias:
– prioritize CM3.FENCE_OVERRIDE
– force truth audit
– slow decision velocity
RepairCorridor:
R.CM3.01: stop wrong-model intervention
R.CM3.02: restore truthful sensing channels
R.CM3.03: reconcile outcomes vs claims
R.CM3.04: rebuild legitimacy for correction
R.CM3.05: restart repair loops slowly under verified telemetry
RelapseRisk:
Very high if:
– same decision layer remains uncorrected
– telemetry is still filtered
– “recovery” is declared before signal validity is restored

=============================================================================

DIAGNOSTIC PRECEDENCE

=============================================================================

CM_PRECEDENCE.v1:
Rule:
If multiple modes appear active:
1: CM3
2: CM2
3: CM1
Logic:
Wrong model causes false repair;
runway loss closes remaining repair time;
corridor breaks are often easier to repair once truth and buffers are stabilized.

SECONDARY_MODE_RULE.v1:
Allowed:
one secondary mode only
Selection:
choose the most immediate downstream amplification path
Examples:
– CM3 primary + CM2 secondary
– CM2 primary + CM1 secondary
– CM1 primary + no secondary
Forbidden:
using 3 active modes simultaneously as the working diagnosis

SIGNATURE_CONFIDENCE_BANDS.v1:
High:
fast discriminators align + ledger breach aligns + FENCE bias aligns
Medium:
main signature visible but one conflicting signal remains
Low:
surface and structural signals conflict OR insufficient telemetry
Rule:
Low confidence auto-raises verification requirements before expansion or re-entry

=============================================================================

Z0-Z6 SIGNATURE MAP

=============================================================================

Z_SIGNATURE_MAP.v1:

Z0:
Scope: Person-day survival corridor
CM1:
LooksLike:
– immediate access snap
– transit/work/access route fails
– daily routine becomes impossible to carry
TypicalNamedBreaks:
– shelter<->income
– transit<->work
– access<->basic care
First3RepairMoves:
– protect minimum route
– switch to fallback route
– cut non-essential commitments
CM2:
LooksLike:
– no runway left today
– money/time/energy depletion visible now
– one ordinary shock collapses the day
TypicalNamedBreaches:
– cash runway exhausted
– sleep/health collapse
– no time buffer
First3RepairMoves:
– stop non-core load
– restore minimum runway
– protect essentials first
CM3:
LooksLike:
– person is operating on false assumptions
– wrong plan repeated despite worsening outcome
– panic/denial replaces usable signal
TypicalNamedCorruptions:
– false affordability belief
– false route belief
– misleading safety read
First3RepairMoves:
– stop wrong plan
– reassess real constraints
– simplify decision set

Z1:
Scope: Household / school / workplace corridor
CM1:
LooksLike:
– household continuity breaks
– school/work routine snaps
– care-work bind fails
TypicalNamedBreaks:
– work<->childcare
– rent<->income
– school<->transport
First3RepairMoves:
– protect core routine
– restore key bind
– downgrade optional load
CM2:
LooksLike:
– household runs on depletion
– debt/time/health runway gone
– every schedule change becomes destabilizing
TypicalNamedBreaches:
– savings gone
– exhaustion chronic
– maintenance obligations deferred
First3RepairMoves:
– ring-fence core spend/time
– reduce load
– rebuild short runway
CM3:
LooksLike:
– wrong assumptions about capacity or fairness
– family/work/school signals misread
– repeated misrepair of routine
TypicalNamedCorruptions:
– false “can keep pushing”
– false “routine is stable”
– false “problem is attitude only”
First3RepairMoves:
– restore truthful scheduling model
– correct priority order
– verify lived reality before next adjustment

Z2:
Scope: Community / district corridor
CM1:
LooksLike:
– district transfer snaps
– services and demand decouple
– local coordination visibly breaks
TypicalNamedBreaks:
– community<->services
– local admin<->response
– school/clinic<->access
First3RepairMoves:
– name broken corridor
– protect critical local services
– re-stitch one service link at a time
CM2:
LooksLike:
– district services are overrun with no slack
– local reserves are too thin
– volunteer/admin bandwidth is exhausted
TypicalNamedBreaches:
– backlog explosion
– service delay cliff
– local repair capacity drained
First3RepairMoves:
– freeze non-core programs
– restore local service runway
– reallocate toward core demand
CM3:
LooksLike:
– trust pockets collapse
– local reports no longer match local reality
– coordination fails because the wrong situation is being acted on
TypicalNamedCorruptions:
– compliance theatre
– distorted reporting
– distrust blocks usable correction
First3RepairMoves:
– truth audit
– restore trusted local reporting
– slow policy churn

Z3:
Scope: City system corridor
CM1:
LooksLike:
– a core city system decouples
– transport, health, utilities, housing, or service routing breaks
TypicalNamedBreaks:
– grid<->delivery
– maintenance<->service continuity
– transit<->workforce flow
First3RepairMoves:
– protect core nodes
– activate fallback routes
– isolate failing subsystem
CM2:
LooksLike:
– maintenance debt becomes visible
– redundancy collapses
– core systems run on borrowed runway
TypicalNamedBreaches:
– reserve depletion
– emergency mode becomes normal mode
– spare capacity gone
First3RepairMoves:
– freeze expansion
– ring-fence maintenance resources
– restore minimum redundancy
CM3:
LooksLike:
– wrong city-system repair loops
– data says one thing, system reality says another
– repeated fixes worsen continuity
TypicalNamedCorruptions:
– dashboard-only governance
– delayed truth reaches repair teams too late
– policy misclassifies real failure
First3RepairMoves:
– force truth audit
– halt wrong intervention
– restore verified repair routing

Z4:
Scope: Macro governance / institutional corridor
CM1:
LooksLike:
– institution<->execution bind snaps
– interagency or macro coordination visibly fails
TypicalNamedBreaks:
– policy<->implementation
– reserve<->allocation
– command<->outcome
First3RepairMoves:
– restore decision-execution coupling
– reduce macro complexity
– sequence essential actions only
CM2:
LooksLike:
– macro reserves are committed beyond safe cover
– governance load exceeds fiscal/repair capacity
TypicalNamedBreaches:
– reserve misallocation
– overcommitted obligations
– funding shell over base
First3RepairMoves:
– pause expansionary commitments
– reconcile obligations vs reserves
– fund core first
CM3:
LooksLike:
– wrong model is being enforced at scale
– corrective authority amplifies damage
– legitimacy drops because reality and policy split
TypicalNamedCorruptions:
– compliance replaces correction
– policy oscillation without truth update
– executive model mismatch
First3RepairMoves:
– stop wrong-model escalation
– restore truthful telemetry
– rebuild correction legitimacy

Z5:
Scope: Global interface corridor
CM1:
LooksLike:
– external corridor detaches from domestic corridor
– talent/capital/trade no longer feeds base continuity
TypicalNamedBreaks:
– shell<->base
– export<->domestic renewal
– inflow<->real throughput
First3RepairMoves:
– re-link shell to base
– ring-fence base-serving flows
– reduce non-core global commitments
CM2:
LooksLike:
– external shock hits with insufficient reserves
– dependency concentration makes one failure oversized
TypicalNamedBreaches:
– overconcentrated supply route
– reserve too thin for external disruption
– reputation used as buffer substitute
First3RepairMoves:
– diversify corridors
– protect strategic reserves
– downgrade frontier exposure
CM3:
LooksLike:
– city misreads external reality
– shell confidence persists after structural conditions changed
– wrong external bet keeps being reinforced
TypicalNamedCorruptions:
– false confidence in external demand
– misread geopolitical / market shift
– prestige signal overruns truth
First3RepairMoves:
– truth-audit the external model
– stop overcommitment
– rebase decisions on actual corridor data

Z6:
Scope: Civilisation-node corridor
CM1:
LooksLike:
– exported model loses domestic validity
– succession or long-horizon continuity route breaks
TypicalNamedBreaks:
– model<->reality
– legacy<->current carrier
– shell identity<->base load-bearing
First3RepairMoves:
– restore base validity first
– cut symbolic overreach
– re-stitch model to proof
CM2:
LooksLike:
– long-horizon reserves are being consumed
– city maintains status by borrowing from future continuity
TypicalNamedBreaches:
– prestige shell funded by base depletion
– succession reserves too thin
– non-rent-paying frontier spend
First3RepairMoves:
– pause prestige/frontier load
– restore long-horizon reserves
– pay rent back to the base
CM3:
LooksLike:
– the city believes its role is intact when its proof base has degraded
– symbolic legitimacy outruns actual corridor truth
TypicalNamedCorruptions:
– false inevitability
– overexport of unverified model
– civilisational narrative detached from carrier reality
First3RepairMoves:
– force truth-and-proof audit
– downgrade symbolic claims
– revalidate under real domestic load

=============================================================================

FAST DISCRIMINATOR ENGINE

=============================================================================

FAST_DISCRIMINATOR_ENGINE.v1:
Question1:
“Can I name the broken corridor?”
Yes -> CM1 weight +++
Question2:
“Did usable runway/reserve/slack fall below floor?”
Yes -> CM2 weight +++
Question3:
“Are the fixes making it worse because the model is wrong?”
Yes -> CM3 weight ++++
Question4:
“If I drop optional load now, does stability improve quickly?”
Yes -> CM2 bias
Question5:
“If I restore one link, does function return quickly?”
Yes -> CM1 bias
Question6:
“If I force a truth audit, does the previous repair look invalid?”
Yes -> CM3 bias
SelectionRule:
Highest weight wins
TieBreakRule:
CM3 > CM2 > CM1

CONFUSION_TRAPS.v1:
Trap1:
Name: SymptomAsCause
Error:
treating congestion, burnout, or public anger as root cause without checking corridor, runway, or signal
Trap2:
Name: ShellMask
Error:
assuming shell strength disproves base failure
Trap3:
Name: OneBudgetExplainsEverything
Error:
forcing all failures into CM2 when CM1 or CM3 is dominant
Trap4:
Name: ActionBias
Error:
taking visible action fast instead of diagnosing which mode is dominant
Trap5:
Name: FalseRecovery
Error:
calling it fixed because optics improved while hidden borrowing or wrong-model repair continues

=============================================================================

MISREPAIR MATRIX

=============================================================================

MISREPAIR_MATRIX.v1:
If TrueMode = CM1 but TreatedAs = CM2:
Result:
more runway may be added, but the broken corridor remains broken
TypicalDamage:
hidden frustration, further decoupling, wasted reserves
If TrueMode = CM1 but TreatedAs = CM3:
Result:
lots of investigation, but core broken bind stays unrepaired
TypicalDamage:
prolonged outage
If TrueMode = CM2 but TreatedAs = CM1:
Result:
bind repair is attempted while runway is still collapsing
TypicalDamage:
repeated rebreak, exhaustion of repair teams
If TrueMode = CM2 but TreatedAs = CM3:
Result:
truth improves, but runway still runs out
TypicalDamage:
“we understood it too late”
If TrueMode = CM3 but TreatedAs = CM1:
Result:
visible binds get patched while wrong model keeps recreating failure
TypicalDamage:
serial repeat failures
If TrueMode = CM3 but TreatedAs = CM2:
Result:
more resources are injected into the wrong repair path
TypicalDamage:
amplified waste + faster legitimacy loss

RULE:
The atlas is working only if it reduces misrepair frequency over time.

=============================================================================

CITY-SPECIFIC FAILURE BIASES

=============================================================================

CITY_FAILURE_PROFILE.v1:

NewYork:
DominantTendencies:
– CM1 at Z0-Z3 (transfer and affordability decoupling)
– CM2 at Z0-Z2 when cost pressure compresses buffers
– CM3 at Z3-Z5 when shell metrics obscure base truth
FastBias:
if shell strong + base weak -> check CM1 + CM2 before trusting surface
TypicalFailureForm:
hollow-core bifurcation

Singapore:
DominantTendencies:
– CM2 at Z3-Z5 when dependency concentration or overcompression narrows runway
– CM3 if smooth dashboards hide correlated brittleness
– CM1 less frequent, but serious when a tightly coupled corridor snaps
FastBias:
if compact system stress spreads quickly -> check CM2 before CM1
TypicalFailureForm:
over-optimization brittleness

Beijing:
DominantTendencies:
– CM3 at Z2-Z5 due to truth-lag / wrong-model amplification risk
– CM2 secondary when projection outpaces real buffer
– CM1 often downstream after misrepair persists
FastBias:
if corrective power is high but outcomes worsen -> CM3 first
TypicalFailureForm:
large-scale rigidity after suppressed correction

Tokyo:
DominantTendencies:
– CM1 slow-form at Z1-Z3 through gradual corridor narrowing
– CM2 in maintenance/runway terms if redundancy and staffing thin
– CM3 less noisy, but can appear as delayed adaptation model
FastBias:
if surface stable but continuity narrows slowly -> check CM1/CM2 before declaring healthy
TypicalFailureForm:
graceful-looking hollowing

London:
DominantTendencies:
– CM1 at Z0-Z3 through throughput and affordability decoupling
– CM3 at Z2-Z4 when legitimacy and lived reality diverge
– CM2 when inherited reserves are silently spent
FastBias:
if legacy shell is still strong -> check CM1 + CM3 under it
TypicalFailureForm:
prestige shell / civic corridor split

Seoul:
DominantTendencies:
– CM2 at Z0-Z3 through human/regenerative runway depletion
– CM1 at Z1-Z3 when skill/life transfer corridors narrow under load
– CM3 when performance dashboards hide future-base drawdown
FastBias:
if output stays high while regeneration weakens -> CM2 first
TypicalFailureForm:
performance shell with regenerative shrinkage

=============================================================================

ONE-PANEL / FENCE / LEDGER HOOKS

=============================================================================

ONE_PANEL_HOOKS.v1:
ActiveCollapseMode:
from dominant CM selected by FastDiscriminatorEngine
DominantCrossZFailure:
Mapping:
CM1 -> MidStackDecoupling OR BaseHollowing
CM2 -> UpstreamCompression OR ExternalShock
CM3 -> WrongModelEscalation
TopRepairMoves3:
Must align to dominant CM repair corridor
MustNotDo:
Pull from dominant CM FirstWrongMoveToAvoid + FENCE override
ConfidenceBand:
Reduced if:
– mode confidence low
– shell/base conflict active
– telemetry incomplete

FENCE_HOOKS.v1:
If CM1:
– use CM1.FENCE_OVERRIDE
– prioritize route protection + staged stitching
If CM2:
– use CM2.FENCE_OVERRIDE
– prioritize reserve protection + load cuts
If CM3:
– use CM3.FENCE_OVERRIDE
– prioritize truth audit + decision slowdown
If CM3 active:
minimum FENCE precedence overrides CM1/CM2 until model validity is restored

LEDGER_HOOKS.v1:
CM1:
likely raises:
– F07 TransferDiscontinuity
– F03 ShellBaseDivergence
CM2:
likely raises:
– F01 HiddenBorrowing
– F02 DelayedMaintenance
– F06 UnfundedObligation
– F08 RegenerationErosion
CM3:
likely raises:
– F04 TruthGap
– F10 LegitimacyMismatch
– F05 CapacityMispricing

LAW_HOOKS.v1:
CM1 strongly stresses:
– L01 CoreLatticeLaw
– L03 LatticeDriftCondition
CM2 strongly stresses:
– L02 RateDominanceLaw
– L08 ReserveRentLaw
– L09 BorrowedLiftLaw
CM3 strongly stresses:
– L04 FenceIntegrityLaw
– L11 VesselFirstLaw
– L13 EnvelopeShiftLaw
Any mode nearing irreversible edge:
– elevate L15 EnvelopeRuptureEvent

=============================================================================

ESCALATION MAP

=============================================================================

ESCALATION_LEVELS.v1:
E0:
LocalRepairOnly
Condition:
one Z-level, one mode, no critical ledger breach
E1:
CrossZWatch
Condition:
same CM appears in 2 adjacent Z-levels
E2:
MacroIntervention
Condition:
Z3 or Z4 impacted OR precedence ledger breached
E3:
FullCityFence
Condition:
dominant CM active across base + system bands
E4:
RupturePrevention
Condition:
L15 elevated + FENCE late + shell/base divergence unresolved

ESCALATION_RULE.v1:
If CM3 at Z4:
minimum escalation = E2
If CM2 at Z3 with infrastructure reserves breached:
minimum escalation = E2
If CM1 at Z0-Z1 only and fallback exists:
may remain E0
If CM1/CM2/CM3 span Z0-Z3:
minimum escalation = E3

=============================================================================

VERIFICATION / ANTI-RELAPSE

=============================================================================

VERIFICATION_RULES.v1:
CM1_Verified:
– named corridor restored
– no rebreak across one normal + one moderate load cycle
CM2_Verified:
– buffers above warning floor
– hidden borrowing removed or explicitly reconciled
– no renewed drawdown during recheck window
CM3_Verified:
– wrong-model loop stopped
– corrected model predicts reality more accurately
– trust/telemetry usable enough for normal repair
GlobalRule:
No mode may be marked Verified while a higher-precedence mode remains unresolved

RELAPSE_INDICATORS.v1:
CM1:
– same corridor breaks again after load returns
CM2:
– reserves improve briefly, then immediately fall once activity resumes
CM3:
– same leadership / dashboard / logic recreates the old error pattern
AutoRule:
Repeat relapse in same mode within 2 cycles -> raise FENCE one level earlier next time

=============================================================================

DEFAULT BLANK FAILURE CASE OBJECT

=============================================================================

FailureCaseObject:
CityID:
TimeSlice:
ZLevel:

SymptomsObserved:
–
–
–

SensorRead:
S01:
S02:
S03:
S04:
S05:
S06:
S07:
S08:
S09:
S10:
S11:
S12:

CandidateModes:
CM1:
Weight: <0..100>
SignatureMatch:
CM2:
Weight: <0..100>
SignatureMatch:
CM3:
Weight: <0..100>
SignatureMatch:

DominantCollapseMode:
SecondaryCollapseMode:
FastDiscriminatorRead:
–
–
–

TypicalLedgerBreaches:
– > – >

FENCEBias:
FirstWrongMoveToAvoid:
First3RepairMoves:
–
–
–

EscalationLevel:
VerificationCheck:
RelapseRisk:

=============================================================================

PASS / FAIL

=============================================================================

PASS_CONDITION.v1:
This spec is working if:
– most visible city failures can be compressed into one dominant mode quickly
– wrong repair frequency decreases over repeated runs
– CM1 / CM2 / CM3 route into distinct repair actions
– shell strength no longer hides base failure classification
– CM3 is detected early enough to stop false repair cascades

FAIL_CONDITION.v1:
This spec fails if:
– teams still argue endlessly without converging on a dominant mode
– CM2 is repeatedly mistaken for CM1
– CM3 is repeatedly missed because dashboards look clean
– three-mode compression becomes a vague label system instead of an action system
– verification never changes future trigger timing or repair choice

NEXT_DEPENDENCY:
After this, the next required spec is:
CivOS.CityRepairPlaybook.Top20Moves.v1.0
“`

“`text id=”m2q8ls”
SPEC_ID: CivOS.CityRepairPlaybook.Top20Moves.v1.0
TITLE: Universal City Repair Playbook (Top 20 Moves) for Any City (Z0-Z6)
MODE: Almost-Code
OUTPUT_RULE: Code-Only
VERSION: v1.0
STATUS: Canonical Action Library
DEPENDS_ON:

• CivOS.CityControlTower.OnePanel.v1.0
• CivOS.CitySensorThresholds.Calibration.v1.0
• CivOS.CityFENCE.TriggerMap.Z0-Z6.v1.0
• CivOS.CityInvariantLedger.StackedTemplates.v1.0
• CivOS.CityFailureAtlas.3Modes.Z0-Z6.v1.0
• CivOS.CityLawPack.Global.Z3-Z6.CF.v1.0
• CivOS.CityOS.Pack6.Z0-Z6.CF.v1.0

PURPOSE:
Convert diagnosis into bounded action.
The playbook provides:
– a fixed move library
– clear triggers for each move
– move-to-collapse-mode mapping
– move sequencing rules
– anti-misuse rules
– re-entry and anti-relapse logic
so the system can move from:
Diagnose -> Act -> Verify -> Reclassify

CORE_FUNCTION:
ReadDominantCM -> SelectTopMoves -> SequenceMoves ->
ExecuteMinimalSafeSet -> VerifyEffect -> RemoveWrongMoves ->
RecomputeBand

CANONICAL_RULE:
The system must output no more than 3 active moves at any one time:
– 1 Immediate Stabiliser
– 1 Structural Repair
– 1 Anti-Relapse / Verification Move
More than 3 active moves at once usually creates operator shear and false progress.

MOVE_LIBRARY_PRINCIPLE.v1:
Same spine, different body.
The 20 moves are universal categories.
Their raw implementation differs by city, but their control logic stays fixed.

MOVE_CLASSES.v1:
C1:
Name: Stabilise
Goal: stop immediate worsening
C2:
Name: Repair
Goal: restore structure / runway / signal
C3:
Name: Protect
Goal: preserve core and prevent new damage
C4:
Name: Reconcile
Goal: close ledger gaps and revalidate truth
C5:
Name: Reopen
Goal: permit safe re-entry only after proof

MOVE_SELECTION_LIMIT.v1:
MaxActiveMoves: 3
RequiredComposition:
Slot1: ImmediateStabiliser
Slot2: StructuralRepair
Slot3: AntiRelapseOrVerification
Forbidden:
– 3 structural moves with no stabiliser
– 3 stabilisers with no structural repair
– reopening moves while FENCE >= F2
– frontier moves while FrontierPermission != Open

TOP20_MOVE_SET.v1:

Mv01:
Name: RestoreBuffer
Class: Stabilise
PrimaryUse:
rebuild time / money / reserve / maintenance runway
BestFor:
– CM2 primary
– CM2 secondary
BestZ:
– Z0
– Z1
– Z3
– Z4
– Z5
– Z6
Trigger:
– S04 below warning
– ReserveRentStatus = Tight/Borrowing/Breached
– cp near or above fail
ActionPattern:
– stop non-core drain
– rebuild minimum runway first
– declare base floor before any expansion
FirstEffectExpected:
TimeToThreshold extends
WrongUse:
adding buffers without removing the cause of drain
Verification:
runway stays above warning for 2 cycles

Mv02:
Name: RepairBind
Class: Repair
PrimaryUse:
restore a broken coupling or corridor link
BestFor:
– CM1 primary
BestZ:
– Z0
– Z1
– Z2
– Z3
– Z4
– Z5
– Z6
Trigger:
– named corridor break identified
– S01 or S02 breached
ActionPattern:
– identify exact snapped bind
– restore one link at a time
– verify under load before next link
FirstEffectExpected:
named function resumes
WrongUse:
attempting to reattach too many links at once
Verification:
no rebreak in one normal + one moderate load cycle

Mv03:
Name: ImproveSignal
Class: Reconcile
PrimaryUse:
restore truthful sensing and faster correction
BestFor:
– CM3 primary
BestZ:
– Z1
– Z2
– Z3
– Z4
– Z5
– Z6
Trigger:
– S03 too slow
– S06/S10 weak
– wrong repair loop visible
ActionPattern:
– improve telemetry path
– remove distortion layers
– shorten signal-to-decision delay
FirstEffectExpected:
repairs stop worsening conditions
WrongUse:
collecting more data without changing decision logic
Verification:
corrected signals predict outcomes better than prior model

Mv04:
Name: ReduceChoiceLoad
Class: Stabilise
PrimaryUse:
reduce operator overload and symmetry shear
BestFor:
– CM1/CM3 mixed
– high rho environments
BestZ:
– Z0
– Z1
– Z2
– Z3
Trigger:
– S05 near or above rho_warn
– confusion / inconsistency increasing
ActionPattern:
– remove optional branches
– simplify decision sets
– reduce simultaneous priorities
FirstEffectExpected:
fewer contradictions and faster execution
WrongUse:
turning simplification into blind suppression of truth
Verification:
operator consistency improves without creating truth gap

Mv05:
Name: AddRedundancy
Class: Protect
PrimaryUse:
reduce single-point fragility
BestFor:
– CM2
– CM1 at system scale
BestZ:
– Z3
– Z4
– Z5
– Z6
Trigger:
– S07 below warning
– fallback route missing
ActionPattern:
– add backup path
– separate critical dependencies
– stop using emergency mode as normal mode
FirstEffectExpected:
lower rupture sensitivity
WrongUse:
adding redundant shell without base maintenance
Verification:
loss of one corridor no longer causes system snap

Mv06:
Name: ProtectRegeneration
Class: Protect
PrimaryUse:
preserve human and institutional renewal capacity
BestFor:
– CM2
– long-horizon CM1 prevention
BestZ:
– Z0
– Z1
– Z2
– Z3
– Z4
Trigger:
– S11 below warning
– Regeneration ledger tight/borrowing
ActionPattern:
– protect rest/slack/recovery
– reduce sustained overload
– restore succession paths
FirstEffectExpected:
future collapse pressure slows
WrongUse:
symbolic wellness without real load reduction
Verification:
S11 improves without hidden shell borrowing

Mv07:
Name: ReduceExternalConcentration
Class: Protect
PrimaryUse:
lower dependency concentration and external corridor fragility
BestFor:
– CM2 at Z5/Z6
– CM3 when external model is wrong
BestZ:
– Z3
– Z4
– Z5
– Z6
Trigger:
– S12 near/above warning
– ExternalInterface borrowing
ActionPattern:
– diversify suppliers / inflows / interface paths
– ring-fence strategic dependencies
– reduce single-corridor reliance
FirstEffectExpected:
shock sensitivity drops
WrongUse:
superficial diversification without real replaceability
Verification:
key corridor loss becomes survivable

Mv08:
Name: DowngradeAmbition
Class: Stabilise
PrimaryUse:
reduce declared load to match actual corridor width
BestFor:
– CM2
– CM3
– any FENCE F2/F3 state
BestZ:
– Z1
– Z2
– Z3
– Z4
– Z5
– Z6
Trigger:
– obligations exceed runway
– wrong-model expansion persists
– shell outpaces base
ActionPattern:
– shrink active scope
– pause non-core initiatives
– align commitments to real capacity
FirstEffectExpected:
fewer self-created breaches
WrongUse:
cosmetic downgrade while keeping same hidden commitments
Verification:
reserve drain slows and repair latency improves

Mv09:
Name: MaintenanceFirst
Class: Repair
PrimaryUse:
restore maintenance as a protected ledger line
BestFor:
– CM2
– slow CM1 prevention
BestZ:
– Z2
– Z3
– Z4
– Z5
– Z6
Trigger:
– delayed maintenance flag active
– infrastructure continuity tight/borrowing
ActionPattern:
– fund maintenance before expansion
– clear backlog by risk order
– protect staffing / tools / repair windows
FirstEffectExpected:
system fragility stops rising
WrongUse:
maintenance rhetoric without budget/time protection
Verification:
backlog no longer grows net across recheck window

Mv10:
Name: ReconcileLegitimacy
Class: Reconcile
PrimaryUse:
close the gap between rules, claims, and lived outcomes
BestFor:
– CM3
BestZ:
– Z2
– Z3
– Z4
– Z5
Trigger:
– F10 LegitimacyMismatch
– GovernanceLegitimacy tight/borrowing/breached
ActionPattern:
– align policy with observed outcomes
– make tradeoffs visible
– restore believable correction channel
FirstEffectExpected:
compliance becomes usable again
WrongUse:
messaging upgrades without structural correction
Verification:
trust and coherence rise together, not separately

Mv11:
Name: ProtectCoreNodes
Class: Protect
PrimaryUse:
defend the minimum viable city functions
BestFor:
– all collapse modes during active FENCE
BestZ:
– Z0
– Z1
– Z2
– Z3
– Z4
– Z5
– Z6
Trigger:
– FENCE >= F1
– active core continuity risk
ActionPattern:
– designate protected core set
– isolate it from non-core load
– prevent cut-first damage to essentials
FirstEffectExpected:
core stays alive while repair proceeds
WrongUse:
protecting shell instead of true core
Verification:
protected functions remain continuous through stress window

Mv12:
Name: FreezeExpansion
Class: Stabilise
PrimaryUse:
stop adding new load while the system is unstable
BestFor:
– all collapse modes
– especially CM2/CM3
BestZ:
– Z1
– Z2
– Z3
– Z4
– Z5
– Z6
Trigger:
– FENCE F1/F2
– FrontierPermission blocked/narrow
– 2+ precedence ledgers weak
ActionPattern:
– stop new initiatives
– stop capacity-consuming growth
– hold current footprint
FirstEffectExpected:
deterioration slows
WrongUse:
freezing essentials or maintenance
Verification:
repair can occur without new parallel destabilizers

Mv13:
Name: RingFenceCriticalResources
Class: Protect
PrimaryUse:
reserve core resources for core obligations only
BestFor:
– CM2
– CM1 at core system level
BestZ:
– Z0
– Z1
– Z3
– Z4
– Z5
– Z6
Trigger:
– reserve misuse
– emergency resources being consumed by non-core activity
ActionPattern:
– isolate strategic reserves
– set protected allocation rules
– stop leakage to prestige / optional channels
FirstEffectExpected:
core runway becomes durable
WrongUse:
ring-fencing without clear priority ordering
Verification:
critical resources remain available through next stress cycle

Mv14:
Name: SwitchToFallbackRoute
Class: Stabilise
PrimaryUse:
reroute load through pre-declared minimal safe corridors
BestFor:
– CM1
– CM2 when primary corridor overloaded
BestZ:
– Z0
– Z1
– Z2
– Z3
– Z5
Trigger:
– named corridor break
– redundancy exists but is not activated
ActionPattern:
– redirect to fallback path
– lower throughput expectation temporarily
– keep continuity over optimality
FirstEffectExpected:
function resumes at degraded but survivable level
WrongUse:
fallback becomes permanent without structural repair
Verification:
continuity restored while main route is being repaired

Mv15:
Name: ForceTruthAudit
Class: Reconcile
PrimaryUse:
stop false repair by testing claims against actual outcomes
BestFor:
– CM3 primary
– CM3 suspected
BestZ:
– Z2
– Z3
– Z4
– Z5
– Z6
Trigger:
– fixes worsening conditions
– surface dashboards conflict with structural reads
– repeated policy-execution mismatch
ActionPattern:
– compare model claims vs observed outcomes
– expose hidden borrowing and lag
– rewrite the active diagnosis if needed
FirstEffectExpected:
wrong moves are stopped
WrongUse:
audit theatre without decision change
Verification:
at least one previously “good” metric is reclassified correctly

Mv16:
Name: SlowDecisionVelocity
Class: Stabilise
PrimaryUse:
prevent fast wrong decisions from compounding damage
BestFor:
– CM3
– high uncertainty / low confidence
BestZ:
– Z2
– Z3
– Z4
– Z5
– Z6
Trigger:
– ConfidenceBand low
– Sigma below valid threshold
– oscillating fixes
ActionPattern:
– reduce policy churn
– extend verification before escalation
– stop rapid sequence changes
FirstEffectExpected:
fewer new self-inflicted errors
WrongUse:
slowing action when an emergency core break needs immediate response
Verification:
decision reversals and correction churn decline

Mv17:
Name: RepriceObligations
Class: Repair
PrimaryUse:
align commitments with real capacity and reserve cover
BestFor:
– CM2
– CM3 when commitments were based on wrong model
BestZ:
– Z1
– Z3
– Z4
– Z5
– Z6
Trigger:
– F06 UnfundedObligation
– sustained reserve drawdown
– promised load exceeds real throughput
ActionPattern:
– separate core from optional obligations
– cut or defer obligations beyond corridor width
– relabel future promises to current truth
FirstEffectExpected:
load matches actual carrying ability
WrongUse:
repricing only on paper while execution remains unchanged
Verification:
obligation load falls below reserve floor for 2 cycles

Mv18:
Name: RebuildSuccession
Class: Repair
PrimaryUse:
restore future carrier continuity (people, skills, institutions)
BestFor:
– CM2 long-horizon
– CM1 slow-form prevention
BestZ:
– Z1
– Z2
– Z3
– Z4
– Z6
Trigger:
– talent transfer weak
– regeneration erosion persistent
– current function held by aging stock only
ActionPattern:
– rebuild training pipelines
– protect handover windows
– restore renewal incentives and channels
FirstEffectExpected:
long-term fragility reduces
WrongUse:
symbolic pipeline creation without real throughput or retention
Verification:
S08 improves and future dependency on legacy stock declines

Mv19:
Name: StageReentry
Class: Reopen
PrimaryUse:
reopen the system in phases after repair, instead of all at once
BestFor:
– all collapse modes after FENCE F3/F4
BestZ:
– Z0
– Z1
– Z2
– Z3
– Z4
– Z5
– Z6
Trigger:
– core continuity restored
– FENCE in StitchingRecovery
– verification partially complete
ActionPattern:
– reopen lowest-risk, highest-core-value routes first
– keep shell restricted until base verified
– test under load between stages
FirstEffectExpected:
continuity returns without immediate relapse
WrongUse:
full reentry before unresolved gaps close
Verification:
each stage survives one load check before next stage opens

Mv20:
Name: VerifyUnderLoad
Class: Reconcile
PrimaryUse:
confirm that the repair truly works under real conditions
BestFor:
– all collapse modes
– mandatory for closure
BestZ:
– Z0
– Z1
– Z2
– Z3
– Z4
– Z5
– Z6
Trigger:
– any move sequence claiming success
– any ledger state attempting to move to Verified
ActionPattern:
– test under normal load
– test under moderate stress
– confirm no hidden borrowing / rebreak / wrong-model recurrence
FirstEffectExpected:
false recovery is exposed early
WrongUse:
declaring success based on optics or suppressed load
Verification:
this move is itself the final verification gate

=============================================================================

MOVE-TO-COLLAPSE-MODE MAP

=============================================================================

MOVE_TO_CM_MAP.v1:
CM1.TransferBreak:
PrimaryMoves:
– Mv02 RepairBind
– Mv14 SwitchToFallbackRoute
– Mv11 ProtectCoreNodes
– Mv19 StageReentry
– Mv20 VerifyUnderLoad
SecondaryMoves:
– Mv04 ReduceChoiceLoad
– Mv05 AddRedundancy
– Mv12 FreezeExpansion
MustAvoid:
– Mv01 alone without corridor repair
– Mv16 if it delays emergency continuity action

CM2.BufferBreach:
PrimaryMoves:
– Mv01 RestoreBuffer
– Mv13 RingFenceCriticalResources
– Mv08 DowngradeAmbition
– Mv09 MaintenanceFirst
– Mv17 RepriceObligations
– Mv20 VerifyUnderLoad
SecondaryMoves:
– Mv06 ProtectRegeneration
– Mv07 ReduceExternalConcentration
– Mv12 FreezeExpansion
MustAvoid:
– Mv19 too early
– Mv05 if it consumes scarce runway before runway restoration

CM3.SignalCorruption:
PrimaryMoves:
– Mv03 ImproveSignal
– Mv15 ForceTruthAudit
– Mv16 SlowDecisionVelocity
– Mv10 ReconcileLegitimacy
– Mv20 VerifyUnderLoad
SecondaryMoves:
– Mv08 DowngradeAmbition
– Mv12 FreezeExpansion
– Mv11 ProtectCoreNodes
MustAvoid:
– Mv02 alone while wrong model remains active
– Mv01 alone if resources are still fed into the wrong system

=============================================================================

MOVE-TO-LAW MAP

=============================================================================

MOVE_TO_LAW_MAP.v1:
Mv01:
Supports:
– L02 RateDominanceLaw
– L08 ReserveRentLaw
Mv02:
Supports:
– L01 CoreLatticeLaw
– L03 LatticeDriftCondition recovery
Mv03:
Supports:
– L03 LatticeDriftCondition detection
– L11 VesselFirstLaw
Mv04:
Supports:
– L05 SymmetryChoiceLaw
– L06 SymmetryChoiceRateLaw
Mv05:
Supports:
– L04 FenceIntegrityLaw
– L13 EnvelopeShiftLaw
Mv06:
Supports:
– L11 VesselFirstLaw
– L09 BorrowedLiftLaw prevention
Mv07:
Supports:
– L08 ReserveRentLaw
– L12 FrontierApertureLaw
Mv08:
Supports:
– L07 SingleCorridorLaw
– L08 ReserveRentLaw
Mv09:
Supports:
– L02 RateDominanceLaw
– L13 EnvelopeShiftLaw
Mv10:
Supports:
– L11 VesselFirstLaw
– L04 FenceIntegrityLaw
Mv11:
Supports:
– L04 FenceIntegrityLaw
– L15 EnvelopeRuptureEvent prevention
Mv12:
Supports:
– L07 SingleCorridorLaw
– L15 rupture prevention
Mv13:
Supports:
– L08 ReserveRentLaw
– L11 VesselFirstLaw
Mv14:
Supports:
– L01 CoreLatticeLaw
– L04 FenceIntegrityLaw
Mv15:
Supports:
– L03 LatticeDriftCondition
– L11 VesselFirstLaw
Mv16:
Supports:
– L04 FenceIntegrityLaw
– L13 EnvelopeShiftLaw
Mv17:
Supports:
– L08 ReserveRentLaw
– L09 BorrowedLiftLaw correction
Mv18:
Supports:
– L10 LatentLiftLaw
– L11 VesselFirstLaw
Mv19:
Supports:
– L12 FrontierApertureLaw
– L13 EnvelopeShiftLaw
Mv20:
Supports:
– all laws as proof gate
– especially L15 prevention by preventing false recovery

=============================================================================

MOVE SEQUENCING ENGINE

=============================================================================

MOVE_SEQUENCE_RULES.v1:
Rule1:
Immediate stabiliser must come first
Rule2:
Structural repair comes second
Rule3:
Anti-relapse / verification move comes third
Rule4:
Reopen moves cannot appear before:
– active FENCE <= F4 – no precedence ledger in Breach Rule5: If CM3 is dominant: no structural move may proceed until at least one truth-restoring move is active Rule6: If CM2 is dominant: no reopening or expansion move may proceed until runway > warning floor
Rule7:
If CM1 is dominant:
no scale restoration until named bind is verified under load

STANDARD_TRIPLETS.v1:
CM1_Default:
Slot1: Mv14 SwitchToFallbackRoute
Slot2: Mv02 RepairBind
Slot3: Mv20 VerifyUnderLoad
CM2_Default:
Slot1: Mv12 FreezeExpansion
Slot2: Mv01 RestoreBuffer
Slot3: Mv17 RepriceObligations
CM3_Default:
Slot1: Mv16 SlowDecisionVelocity
Slot2: Mv15 ForceTruthAudit
Slot3: Mv03 ImproveSignal

ADVANCED_TRIPLETS.v1:
CM1_SystemScale:
Slot1: Mv11 ProtectCoreNodes
Slot2: Mv05 AddRedundancy
Slot3: Mv19 StageReentry
CM2_LongHorizon:
Slot1: Mv13 RingFenceCriticalResources
Slot2: Mv09 MaintenanceFirst
Slot3: Mv06 ProtectRegeneration
CM3_LegitimacyRepair:
Slot1: Mv12 FreezeExpansion
Slot2: Mv10 ReconcileLegitimacy
Slot3: Mv20 VerifyUnderLoad

TRIPLET_OVERRIDE_RULE.v1:
If any Slot move conflicts with FENCE mandatory action:
replace with FENCE-compatible move
If any Slot move exceeds runway cost:
downgrade to a lower-cost equivalent
If any Slot move depends on an unresolved higher-precedence move:
delay it and substitute a stabiliser

=============================================================================

Z-LEVEL MOVE PRIORITY

=============================================================================

Z_MOVE_PRIORITY.v1:

Z0:
HighestPriorityMoves:
– Mv01 RestoreBuffer
– Mv11 ProtectCoreNodes
– Mv14 SwitchToFallbackRoute
– Mv04 ReduceChoiceLoad
Avoid:
– complex structural redesign while daily continuity is failing

Z1:
HighestPriorityMoves:
– Mv01 RestoreBuffer
– Mv02 RepairBind
– Mv06 ProtectRegeneration
– Mv17 RepriceObligations
Avoid:
– shell-facing optimization that worsens household continuity

Z2:
HighestPriorityMoves:
– Mv02 RepairBind
– Mv03 ImproveSignal
– Mv10 ReconcileLegitimacy
– Mv12 FreezeExpansion
Avoid:
– policy churn during local truth failure

Z3:
HighestPriorityMoves:
– Mv11 ProtectCoreNodes
– Mv09 MaintenanceFirst
– Mv05 AddRedundancy
– Mv15 ForceTruthAudit
Avoid:
– capital expansion during continuity stress

Z4:
HighestPriorityMoves:
– Mv15 ForceTruthAudit
– Mv16 SlowDecisionVelocity
– Mv17 RepriceObligations
– Mv10 ReconcileLegitimacy
Avoid:
– macro escalation under wrong model

Z5:
HighestPriorityMoves:
– Mv07 ReduceExternalConcentration
– Mv13 RingFenceCriticalResources
– Mv08 DowngradeAmbition
– Mv17 RepriceObligations
Avoid:
– global shell expansion while base is weak

Z6:
HighestPriorityMoves:
– Mv08 DowngradeAmbition
– Mv18 RebuildSuccession
– Mv17 RepriceObligations
– Mv20 VerifyUnderLoad
Avoid:
– prestige / symbolic overprojection without base proof

=============================================================================

CITY-SPECIFIC MOVE BIASES

=============================================================================

CITY_MOVE_PROFILE.v1:

NewYork:
PreferredMoves:
– Mv02 RepairBind
– Mv04 ReduceChoiceLoad
– Mv01 RestoreBuffer
– Mv17 RepriceObligations
TypicalTriplet:
– Mv14 SwitchToFallbackRoute
– Mv02 RepairBind
– Mv20 VerifyUnderLoad
Notes:
– prioritize corridor repair over shell optics
– treat affordability-driven transfer loss as structural, not cosmetic

Singapore:
PreferredMoves:
– Mv13 RingFenceCriticalResources
– Mv07 ReduceExternalConcentration
– Mv01 RestoreBuffer
– Mv06 ProtectRegeneration
TypicalTriplet:
– Mv12 FreezeExpansion
– Mv01 RestoreBuffer
– Mv07 ReduceExternalConcentration
Notes:
– keep reserve depth explicit
– prevent overcompression from masquerading as efficiency

Beijing:
PreferredMoves:
– Mv15 ForceTruthAudit
– Mv03 ImproveSignal
– Mv16 SlowDecisionVelocity
– Mv10 ReconcileLegitimacy
TypicalTriplet:
– Mv16 SlowDecisionVelocity
– Mv15 ForceTruthAudit
– Mv03 ImproveSignal
Notes:
– stop wrong-model amplification before resource injection
– truth-bearing bandwidth is core infrastructure

Tokyo:
PreferredMoves:
– Mv09 MaintenanceFirst
– Mv06 ProtectRegeneration
– Mv18 RebuildSuccession
– Mv05 AddRedundancy
TypicalTriplet:
– Mv11 ProtectCoreNodes
– Mv09 MaintenanceFirst
– Mv20 VerifyUnderLoad
Notes:
– treat slow drift as actionable before visible disruption
– preserve quality while widening renewal

London:
PreferredMoves:
– Mv02 RepairBind
– Mv10 ReconcileLegitimacy
– Mv17 RepriceObligations
– Mv15 ForceTruthAudit
TypicalTriplet:
– Mv12 FreezeExpansion
– Mv02 RepairBind
– Mv10 ReconcileLegitimacy
Notes:
– reconnect legacy shell to daily throughput
– do not spend inherited legitimacy as substitute for repair

Seoul:
PreferredMoves:
– Mv06 ProtectRegeneration
– Mv01 RestoreBuffer
– Mv08 DowngradeAmbition
– Mv18 RebuildSuccession
TypicalTriplet:
– Mv12 FreezeExpansion
– Mv06 ProtectRegeneration
– Mv20 VerifyUnderLoad
Notes:
– treat human slack as infrastructure
– stop present output from borrowing against future carriers

=============================================================================

MOVE COST / RISK MODEL

=============================================================================

MOVE_COST_MODEL.v1:
CostBands:
Low:
– Mv04
– Mv12
– Mv14
– Mv16
– Mv19
– Mv20
Medium:
– Mv01
– Mv02
– Mv03
– Mv10
– Mv11
– Mv13
– Mv15
– Mv17
High:
– Mv05
– Mv06
– Mv07
– Mv08
– Mv09
– Mv18
Rule:
Under CM2 with shallow runway:
avoid stacking 2 High-cost moves simultaneously
Rule:
Under CM3:
a Low/Medium truth-restoring move must precede High-cost structural rework
Rule:
Under low confidence:
prefer reversible Low/Medium moves first

MOVE_RISK_FLAGS.v1:
R01: CosmeticOnly
R02: DelaysCoreRepair
R03: ConsumesScarceRunway
R04: IncreasesChoiceShear
R05: MasksShellBaseDivergence
R06: CreatesFalseRecovery

=============================================================================

ANTI-MISUSE RULES

=============================================================================

MOVE_MISUSE_MATRIX.v1:
Mv01 RestoreBuffer:
Misuse:
restore runway while leaving drain unchanged
Mv02 RepairBind:
Misuse:
fix visible link while wrong model still regenerates the break
Mv03 ImproveSignal:
Misuse:
more reporting, no decision correction
Mv04 ReduceChoiceLoad:
Misuse:
simplification that suppresses truth
Mv05 AddRedundancy:
Misuse:
expensive shell backup while base maintenance is failing
Mv06 ProtectRegeneration:
Misuse:
symbolic relief without actual load reduction
Mv07 ReduceExternalConcentration:
Misuse:
fake diversification without real substitution capacity
Mv08 DowngradeAmbition:
Misuse:
narrative downgrade but hidden commitments remain
Mv09 MaintenanceFirst:
Misuse:
defer visible crisis for long-run maintenance and lose the base now
Mv10 ReconcileLegitimacy:
Misuse:
communications campaign instead of real alignment
Mv11 ProtectCoreNodes:
Misuse:
treating prestige nodes as core
Mv12 FreezeExpansion:
Misuse:
freezing essentials or learning loops
Mv13 RingFenceCriticalResources:
Misuse:
vague ring-fence without enforceable priority
Mv14 SwitchToFallbackRoute:
Misuse:
fallback becomes permanent drift
Mv15 ForceTruthAudit:
Misuse:
audit that cannot change action
Mv16 SlowDecisionVelocity:
Misuse:
paralysis during immediate continuity failure
Mv17 RepriceObligations:
Misuse:
accounting fiction with unchanged practice
Mv18 RebuildSuccession:
Misuse:
pipeline branding without retention and transfer
Mv19 StageReentry:
Misuse:
reopening shell before base validation
Mv20 VerifyUnderLoad:
Misuse:
suppressed-load “verification”

GLOBAL_MUST_NOT_DO.v1:

• do not run 3 high-cost moves under runway collapse
• do not reopen while precedence ledgers are breached
• do not treat shell recovery as base recovery
• do not declare success without Mv20
• do not use a move that contradicts active FENCE state

=============================================================================

REPAIR RUN ENGINE

=============================================================================

REPAIR_RUN_ENGINE.v1:
Step1:
Read DominantCollapseMode
Step2:
Read FENCE state and precedence ledger breaches
Step3:
Select default triplet for the dominant CM
Step4:
Apply Z-level priority override
Step5:
Apply city bias override
Step6:
Remove any move that violates runway, truth, or FENCE constraints
Step7:
Execute Slot1 -> Slot2 -> Slot3
Step8:
Recompute:
– weakest sensors
– active ledger breaches
– TimeToThreshold
– CityBand
Step9:
If no measurable improvement:
– re-run Failure Atlas
– check CM misclassification
Step10:
If improvement holds:
– stage reentry only when allowed

MEASURABLE_IMPROVEMENT_RULE.v1:
Improvement exists if at least one:
– TimeToThreshold increases by one band
– dominant breach moves from Breached -> Tight/Reconciling
– dominant sensor leaves PreFence/Breach
– same failure stops worsening under comparable load
NoImprovement:
implies:
– wrong move
– wrong sequence
– wrong dominant CM
– hidden higher-precedence breach

=============================================================================

ONE-PANEL / FENCE / LEDGER HOOKS

=============================================================================

ONE_PANEL_HOOKS.v1:
TopRepairMoves3:
directly sourced from this playbook
Next7Days:
built from Slot1 + Slot2 immediate actions
Next30Days:
built from Slot2 + Slot3 structural and anti-relapse actions
MustNotDo:
sourced from move misuse + active CM + active FENCE state
ExecutiveRead:
may include first move only, never all 20

FENCE_HOOKS.v1:
If FENCE = F2 or higher:
allowed moves exclude:
– shell expansion
– frontier reopening
– non-core redundancy add-ons that consume runway
If FENCE = F3:
triplet must include at least one preserve/protect move
If FENCE = F4:
Mv19 StageReentry becomes eligible
If FENCE = F5:
Mv20 VerifyUnderLoad remains mandatory before returning to F0

LEDGER_HOOKS.v1:
If LGR.BaseLife = Breached:
required move set must include one of:
– Mv01
– Mv11
– Mv14
If LGR.GovernanceLegitimacy = Breached:
required move set must include one of:
– Mv15
– Mv03
– Mv10
If LGR.InfrastructureContinuity = Borrowing/Breached:
required move set must include one of:
– Mv09
– Mv13
– Mv05
If LGR.Regeneration = Borrowing/Breached:
required move set must include one of:
– Mv06
– Mv18
If FrontierPermission != Open:
forbid:
– shell-widening interpretations of Mv19

=============================================================================

DEFAULT BLANK REPAIR PLAN OBJECT

=============================================================================

RepairPlanObject:
CityID:
TimeSlice:
ZLevel:
DominantCollapseMode:
FENCEState:

ActiveLedgerBreaches:
– > – >

MoveSlots:
Slot1_ImmediateStabiliser:
MoveID:
Why:
CostBand:
Slot2_StructuralRepair:
MoveID:
Why:
CostBand:
Slot3_AntiRelapseOrVerification:
MoveID:
Why:
CostBand:

MustNotDo:
–
–
–

ExpectedFirstEffect:
–
–

VerificationChecks:
–
–
–

RecomputeAfter:

=============================================================================

PASS / FAIL

=============================================================================

PASS_CONDITION.v1:
This spec is working if:
– the system can always produce 3 or fewer bounded actions
– actions differ meaningfully for CM1 vs CM2 vs CM3
– move misuse becomes easier to detect
– false recovery is reduced because Mv20 is enforced
– shell-preserving but base-damaging moves are blocked automatically

FAIL_CONDITION.v1:
This spec fails if:
– the playbook becomes a long list instead of a convergent action engine
– teams activate too many moves and increase choice shear
– CM3 keeps getting structural fixes without truth repair
– CM2 keeps getting ambitious build actions during runway collapse
– Mv19 reopens the system before precedence ledgers are reconciled

NEXT_DEPENDENCY:
After this, the next required spec is:
CivOS.CityScenarioRunner.CF.v1.0
“`

“`text id=”v6n3ap”
SPEC_ID: CivOS.CityScenarioRunner.CF.v1.0
TITLE: Universal City Scenario Runner (ChronoFlight) for Any City (Z0-Z6)
MODE: Almost-Code
OUTPUT_RULE: Code-Only
VERSION: v1.0
STATUS: Canonical Trajectory / Stress-Test Engine
DEPENDS_ON:

• CivOS.CityControlTower.OnePanel.v1.0
• CivOS.CitySensorThresholds.Calibration.v1.0
• CivOS.CityFENCE.TriggerMap.Z0-Z6.v1.0
• CivOS.CityInvariantLedger.StackedTemplates.v1.0
• CivOS.CityFailureAtlas.3Modes.Z0-Z6.v1.0
• CivOS.CityRepairPlaybook.Top20Moves.v1.0
• CivOS.CityLawPack.Global.Z3-Z6.CF.v1.0
• CivOS.CityOS.Pack6.Z0-Z6.CF.v1.0

PURPOSE:
Turn static city diagnosis into time-based trajectory testing.
The Scenario Runner simulates:
– drift over time
– shocks
– repairs
– failed repairs
– phased recovery
– shell/base divergence
so the city is read as a route, not a snapshot.

CORE_FUNCTION:
BaselineState -> InjectScenario -> PropagateAcrossZ ->
RecomputePanel -> SelectRepairMoves -> ApplyRepairLag ->
RecomputeAgain -> ClassifyTrajectory -> RecordOutcome

CANONICAL_DEFINITION:
A city scenario is a bounded ChronoFlight run:
Structure x Phase x Time
under a declared condition set.
It is not prediction certainty.
It is a controlled simulation of how the city corridor widens, narrows, degrades, or recovers
when shocks and repairs interact through the CivOS grammar.

CHRONOFLIGHT_BINDING.v1:
StructureAxis:
Z0-Z6
PhaseAxis:
P0-P3 (with optional frontier gating only when permitted)
TimeAxis:
T0..Tn relative slices
Rule:
Every scenario must track:
– what changed
– where it changed
– how fast it propagated
– whether repair outran drift
– whether the route stayed ledger-valid

SCENARIO_RUNNER_OUTPUTS (must always exist):
O1: ScenarioID
O2: BaselineBand
O3: FinalBand
O4: TrajectoryClass
O5: DominantCollapsePath
O6: HighestFENCEStateReached
O7: KeyLedgerBreaches
O8: RepairEffectivenessRead
O9: TimeSliceOfWorstPoint
O10: ReentryStatus

SCENARIO_TYPES.v1:
ST0:
Name: BaselineDrift
Meaning: no external shock; only current structural drift continues
ST1:
Name: SingleShock
Meaning: one major disturbance injected
ST2:
Name: CompoundShock
Meaning: two or more linked disturbances injected
ST3:
Name: MisrepairRun
Meaning: wrong collapse mode or wrong move sequence is deliberately tested
ST4:
Name: RecoveryRun
Meaning: shock already occurred; test best available repair corridor
ST5:
Name: LongHorizonStress
Meaning: slow drift, regeneration, succession, and reserve effects dominate
ST6:
Name: ShellBaseDivergenceRun
Meaning: outer shell appears strong while base weakens underneath

TRAJECTORY_CLASSES.v1:
TC1:
Name: StableHold
Meaning: system absorbs the scenario and remains Pos/Neu without precedence breach
TC2:
Name: NarrowingButContained
Meaning: corridor narrows, but FENCE and repair keep it inside recoverable range
TC3:
Name: ForcedDowngrade
Meaning: city remains functional only by reducing scope, complexity, or ambition
TC4:
Name: ManagedRecovery
Meaning: breach occurs but repair closes the gap and verified reentry becomes possible
TC5:
Name: RuptureRisk
Meaning: L15 rises and FENCE must act hard to prevent irreversible crossing
TC6:
Name: RuptureEvent
Meaning: core continuity is lost beyond safe re-entry under current run parameters

CANONICAL_SCENARIO_RULE.v1:
The Scenario Runner does not declare success from shell survival alone.
A scenario counts as “held” only if:
– base ledgers remain valid enough for re-entry
– hidden borrowing is not merely shifted forward
– CM3 is not silently driving false recovery

=============================================================================

TIME GRAMMAR

=============================================================================

TIME_SLICE_GRAMMAR.v1:
T0:
Name: Baseline
Meaning: pre-shock / pre-run state
T1:
Name: Immediate
Meaning: first reaction window
T2:
Name: EarlyPropagation
Meaning: direct downstream spread
T3:
Name: ActiveResponse
Meaning: repair and FENCE begin to shape outcome
T4:
Name: StructuralEffect
Meaning: medium-run consequences become visible
T5:
Name: ReconciliationWindow
Meaning: ledgers either close or divergence deepens
T6:
Name: ReentryTest
Meaning: staged restoration tested under load
T7:
Name: LongHorizonAftermath
Meaning: hidden borrowing / regeneration / succession effects become visible

TIME_WINDOW_BY_Z.v1:
Z0:
T1: hours
T2: 1-3 days
T3: 3-7 days
T4: 1-2 weeks
Z1:
T1: 1-3 days
T2: 1 week
T3: 2-4 weeks
T4: 1-2 months
Z2:
T1: days-weeks
T2: 2-6 weeks
T3: 1-3 months
T4: 3-6 months
Z3:
T1: weeks
T2: 1-3 months
T3: 1-2 quarters
T4: 2-4 quarters
Z4:
T1: 1-2 months
T2: 1-2 quarters
T3: 2-4 quarters
T4: 1-2 years
Z5:
T1: 1-2 quarters
T2: 1-2 years
T3: 2-4 years
T4: 4-8 years
Z6:
T1: 1 year
T2: 2-5 years
T3: 5-10 years
T4: 10+ years

=============================================================================

SHOCK LIBRARY

=============================================================================

SHOCK_LIBRARY.v1:

SH01:
Name: CostShock
Type: Economic / base compression
PrimaryHit:
– S09 CostPressure
– S04 BufferDepth
SecondaryHit:
– S11 SocialRegeneration
– S06 TrustSignal
TypicalCMBias:
– CM2 primary
– CM1 secondary if core binds snap

SH02:
Name: SupplyShock
Type: External corridor disruption
PrimaryHit:
– S12 ExternalDependency
– S04 BufferDepth
SecondaryHit:
– S07 InfrastructureRedundancy
– S08 TalentTransfer
TypicalCMBias:
– CM2 primary
– CM1 if fallback missing

SH03:
Name: InfrastructureFailure
Type: Core system disruption
PrimaryHit:
– S07 InfrastructureRedundancy
– S01 NodeContinuity
SecondaryHit:
– S03 RepairLatency
– S06 TrustSignal
TypicalCMBias:
– CM1 primary
– CM2 if redundancy already thin

SH04:
Name: GovernanceShock
Type: wrong-model or macro coordination failure
PrimaryHit:
– S10 GovernanceCoherence
– S03 RepairLatency
SecondaryHit:
– S06 TrustSignal
– S04 BufferDepth
TypicalCMBias:
– CM3 primary
– CM2 if prolonged

SH05:
Name: TrustCollapse
Type: legitimacy / compliance fracture
PrimaryHit:
– S06 TrustSignal
– S10 GovernanceCoherence
SecondaryHit:
– S02 BindQuality
– S03 RepairLatency
TypicalCMBias:
– CM3 primary
– CM1 secondary

SH06:
Name: TalentDrain
Type: renewal / succession loss
PrimaryHit:
– S08 TalentTransfer
– S11 SocialRegeneration
SecondaryHit:
– S04 BufferDepth
– S12 ExternalDependency
TypicalCMBias:
– CM2 long-horizon
– slow CM1 risk

SH07:
Name: DemandSurge
Type: overload shock
PrimaryHit:
– S05 ChoiceLoad
– S03 RepairLatency
SecondaryHit:
– S04 BufferDepth
– S07 InfrastructureRedundancy
TypicalCMBias:
– CM2 if runway thin
– CM3 if mismanaged
– CM1 if overloaded route snaps

SH08:
Name: PolicyOscillation
Type: rapid contradictory interventions
PrimaryHit:
– S03 RepairLatency
– S10 GovernanceCoherence
SecondaryHit:
– S06 TrustSignal
– S05 ChoiceLoad
TypicalCMBias:
– CM3 primary

SH09:
Name: HiddenBorrowingReveal
Type: shell/base divergence exposed
PrimaryHit:
– ReserveRentStatus
– LGR.PrestigeVsBase
SecondaryHit:
– S04 BufferDepth
– S06 TrustSignal
TypicalCMBias:
– CM2 or CM3 depending on response

SH10:
Name: RegenerationErosion
Type: slow human-carrier depletion
PrimaryHit:
– S11 SocialRegeneration
– LGR.Regeneration
SecondaryHit:
– S08 TalentTransfer
– S04 BufferDepth
TypicalCMBias:
– CM2 long-horizon primary

SHOCK_INTENSITY_SCALE.v1:
I0:
Name: Mild
Meaning: localized, recoverable with standard repair
I1:
Name: Moderate
Meaning: cross-Z spread possible without timely repair
I2:
Name: Severe
Meaning: precedence ledgers likely to breach
I3:
Name: Extreme
Meaning: FENCE hard trigger probable or immediate

SHOCK_DURATION_SCALE.v1:
D0:
Brief
D1:
Sustained
D2:
Repeating
D3:
Structural / persistent

=============================================================================

PROPAGATION ENGINE

=============================================================================

PROPAGATION_RULES.v1:
Rule1:
A shock first hits declared primary sensors at T1.
Rule2:
Secondary sensors degrade at T2 unless:
– buffers absorb it
– FENCE truncates spread
– fallback routes exist
Rule3:
If primary collapse mode is misread at T2-T3:
secondary propagation accelerates by one severity band.
Rule4:
If shell metrics are stronger than base metrics for 2+ slices:
hidden borrowing risk rises and L09 weight increases.
Rule5:
If CM3 is active and unresolved:
all repair moves suffer reduced effectiveness until truth is repaired.
Rule6:
If FENCE activates before HardTrigger:
spread may be contained within one Z-band.
Rule7:
If precedence ledger breaches at a lower Z-band:
higher Z-band resilience cannot count as containment.

CROSS_Z_SPREAD_MAP.v1:
UpwardSpread:
Z0 -> Z1 -> Z2 -> Z3
Typical:
household stress becomes district and city throughput stress
DownwardSpread:
Z4 -> Z3 -> Z2 -> Z1 -> Z0
Typical:
wrong macro model degrades daily life through delayed misrepair
ShellToBaseSpread:
Z5/Z6 -> Z4/Z3 -> Z2/Z1
Typical:
external or prestige strain drains base runway
BaseToShellSpread:
Z0/Z1/Z2 weakness -> Z3/Z4 load -> Z5/Z6 shell downgrades later
Typical:
hollowing beneath shell becomes visible after lag

PROPAGATION_MULTIPLIERS.v1:
If FallbackRouteExists = True:
CM1 spread reduced by 1 class
If BufferCoverRatio < 1: CM2 spread increased by 1 class If SignalValidityRatio < 0.7: CM3 spread increased by 1 class If ChoiceShearRatio > rho_fail:
all mode propagation gains +1 at Z0-Z3
If ReserveRentStatus = Borrowing/Breached:
long-horizon scenarios accelerate at Z4-Z6

=============================================================================

REPAIR APPLICATION ENGINE

=============================================================================

REPAIR_APPLICATION_RULES.v1:
Rule1:
Repair moves do not act instantly unless declared immediate stabilisers.
Rule2:
Structural repair only begins to show effect after its declared latency band.
Rule3:
If the wrong dominant CM is selected:
repair effectiveness is reduced sharply.
Rule4:
If CM3 remains unresolved:
any structural move may appear to work briefly but fail at T4/T5.
Rule5:
Reentry may only be tested after:
– FENCE <= F4
– precedence ledgers no longer in Breach
– at least one verification move is active

REPAIR_EFFECTIVENESS_BANDS.v1:
RE0:
Name: NoEffect
Meaning: no meaningful sensor or ledger improvement
RE1:
Name: PartialHold
Meaning: deterioration slows, but gap remains
RE2:
Name: Containment
Meaning: spread stops widening materially
RE3:
Name: Recovery
Meaning: breached state moves toward Reconciling
RE4:
Name: VerifiedRecovery
Meaning: recovery holds under load without hidden borrowing

MISREPAIR_EFFECTS.v1:
If CM1 treated as CM2:
Expected:
buffers may extend slightly, but the same route fails again by T3/T4
If CM2 treated as CM1:
Expected:
repaired route rebreaks because runway is still too thin
If CM3 treated as CM1 or CM2:
Expected:
false repair surfaces at T2, worsens at T4, trust falls further at T5

=============================================================================

RUN MODES

=============================================================================

RUN_MODES.v1:

RM1:
Name: Conservative
Meaning:
assume weaker buffers, slower repair, earlier FENCE
Use:
for high uncertainty or base-first safety

RM2:
Name: Standard
Meaning:
use current calibrated priors as-is
Use:
default simulation mode

RM3:
Name: StressAmplified
Meaning:
assume lower resilience, faster propagation, slower verification
Use:
for adverse-case testing

RM4:
Name: RepairOptimized
Meaning:
assume best available diagnosis and disciplined repair execution
Use:
to test maximum plausible recovery corridor

MODE_SELECTION_RULE.v1:
If ConfidenceBand = Low:
default to RM1 or RM3
If active FENCE >= F2:
RM2 or RM3 preferred
If testing ideal playbook only:
RM4 allowed
Forbidden:
using RM4 to declare real-world safety without verification

=============================================================================

SCENARIO RUN LOOP

=============================================================================

SCENARIO_RUN_LOOP.v1:
Step1:
Ingest BaselineState:
– city panel
– sensor calibration objects
– active ledgers
– active FENCE state
– allowed frontier state
Step2:
Choose ScenarioType and RunMode
Step3:
Inject shock(s) at T1:
– declare type
– declare intensity
– declare duration
– declare initial Z impact points
Step4:
Update primary sensors at T1
Step5:
Propagate to secondary sensors and adjacent Z-bands at T2
Step6:
Recompute:
– OnePanel
– Dominant CM
– active ledger breaches
– FENCE triggers
Step7:
Select repair triplet from playbook at T3
Step8:
Apply repair latency and effectiveness at T3-T5
Step9:
Recompute trajectory class, peak risk, and worst time slice
Step10:
If conditions allow:
test staged reentry at T6
Step11:
Evaluate long-horizon residue at T7:
– hidden borrowing
– regeneration erosion
– succession damage
– shell/base divergence
Step12:
Produce final scenario record

=============================================================================

OUTCOME EVALUATION

=============================================================================

OUTCOME_EVALUATION_RULES.v1:
StableHold:
if:
– no precedence ledger breaches
– final band remains Pos/upper Neu
– HighestFENCEStateReached <= F2
NarrowingButContained:
if:
– FENCE active
– damage contained
– no irreversible lower-base breach
ForcedDowngrade:
if:
– city remains viable only after Mv08 or equivalent scope reduction
ManagedRecovery:
if:
– one or more breaches occurred
– ledgers moved to Reconciling/Verified by T6/T7
RuptureRisk:
if:
– L15 elevated
– FENCE reached F2/F3/F4
– base remains threatened
RuptureEvent:
if:
– protected core continuity is lost beyond current safe restoration band

REENTRY_STATUS_SET.v1:
RS0:
Blocked
RS1:
Partial
RS2:
Conditional
RS3:
Verified
Rule:
RS3 requires:
– Mv20 completed
– no precedence ledger in Breach
– no immediate relapse indicator

WORST_POINT_SELECTION.v1:
Select the time slice with:
– lowest base ledger health
– highest FENCE state
– strongest L15 signal
TieBreak:
earlier slice wins if it determines later irreversibility

=============================================================================

STANDARD SCENARIO TEMPLATES

=============================================================================

SCENARIO_TEMPLATES.v1:

TemplateA:
Name: BaselineDrift_12Cycle
Type: ST0
Description:
Run existing structural drift only for 12 relative cycles
Purpose:
detect hidden narrowing without obvious external shock

TemplateB:
Name: CostShock_BaseCompression
Type: ST1
Shock:
SH01 CostShock
Purpose:
test whether Z0-Z3 base can hold rising ordinary burden

TemplateC:
Name: InfrastructureSnap_WithFallback
Type: ST1
Shock:
SH03 InfrastructureFailure
Variation:
compare fallback exists vs fallback absent
Purpose:
isolate CM1 resilience

TemplateD:
Name: GovernanceMisrepair
Type: ST3
Shock:
SH04 GovernanceShock
ForcedError:
treat CM3 as CM2 or CM1
Purpose:
test false repair amplification

TemplateE:
Name: ExternalConcentrationStress
Type: ST2
ShockSet:
– SH02 SupplyShock
– SH09 HiddenBorrowingReveal
Purpose:
test shell/base and reserve exposure

TemplateF:
Name: RegenerationLongRun
Type: ST5
Shock:
SH10 RegenerationErosion
Purpose:
test whether present success is borrowing from future carriers

TemplateG:
Name: RecoveryBestCase
Type: ST4
Description:
take a breached state and apply best available triplet
Purpose:
estimate best plausible reentry corridor

=============================================================================

CITY-SPECIFIC SCENARIO BIASES

=============================================================================

CITY_SCENARIO_PROFILE.v1:

NewYork:
MostUsefulTemplates:
– TemplateB CostShock_BaseCompression
– TemplateC InfrastructureSnap_WithFallback
– TemplateE ExternalConcentrationStress
ExpectedStressPath:
Z0-Z2 base compression -> Z3 throughput stress -> shell/base divergence
KeyWatch:
affordability-induced CM1/CM2 mixing

Singapore:
MostUsefulTemplates:
– TemplateE ExternalConcentrationStress
– TemplateD GovernanceMisrepair (smooth-dashboard variant)
– TemplateF RegenerationLongRun
ExpectedStressPath:
Z5/Z4 external concentration -> Z3 reserves -> Z0-Z2 human slack compression
KeyWatch:
overcompression hidden inside a high-control shell

Beijing:
MostUsefulTemplates:
– TemplateD GovernanceMisrepair
– TemplateE ExternalConcentrationStress
– TemplateG RecoveryBestCase
ExpectedStressPath:
Z4/Z3 wrong-model amplification -> cross-Z cascade -> reserve and trust erosion
KeyWatch:
CM3 precedence and truth-lag effects

Tokyo:
MostUsefulTemplates:
– TemplateA BaselineDrift_12Cycle
– TemplateF RegenerationLongRun
– TemplateC InfrastructureSnap_WithFallback
ExpectedStressPath:
slow Z1-Z3 narrowing -> maintenance strain -> visible shell downgrade later
KeyWatch:
graceful-looking drift that accumulates below warning

London:
MostUsefulTemplates:
– TemplateB CostShock_BaseCompression
– TemplateD GovernanceMisrepair
– TemplateE ExternalConcentrationStress
ExpectedStressPath:
base throughput narrowing + legitimacy mismatch -> shell/base split
KeyWatch:
legacy shell masking base corridor decay

Seoul:
MostUsefulTemplates:
– TemplateF RegenerationLongRun
– TemplateB CostShock_BaseCompression
– TemplateG RecoveryBestCase
ExpectedStressPath:
Z0-Z2 regeneration depletion -> Z3 throughput stress -> future-base shrinkage
KeyWatch:
CM2 long-horizon borrowing disguised by present performance

=============================================================================

COMPARISON MODE

=============================================================================

MULTI_RUN_COMPARISON.v1:
Purpose:
Compare several scenarios for the same city OR same scenario across several cities
AllowedComparisons:
– same shock, different cities
– same city, different shock types
– same baseline, correct repair vs misrepair
– standard mode vs stress-amplified mode
ComparisonOutputs:
– earliest breach slice
– highest FENCE state
– dominant collapse path
– reentry probability class
– hidden borrowing residue
Rule:
comparison must preserve same scenario spine or results are not comparable

SCENARIO_SCORECARD.v1:
Fields:
BandRetentionScore:
higher if final base band remains Pos/Neu
BreachDepthScore:
lower if precedence ledgers breached deeply
FENCETimelinessScore:
higher if FENCE acts before hard breach
RepairAccuracyScore:
higher if dominant CM was correctly diagnosed early
ReentryQualityScore:
higher if reentry is verified without hidden borrowing
LongHorizonResidueScore:
lower if regeneration / succession / reserve damage remains
Use:
qualitative comparative ranking, not false precision

=============================================================================

ONE-PANEL / FENCE / LEDGER / PLAYBOOK HOOKS

=============================================================================

ONE_PANEL_HOOKS.v1:
BaselineState:
sourced from PanelObject at T0
EachTimeSlice:
recompute:
– CurrentBand
– ActiveCollapseMode
– TopLawStress3
– WeakestSensor3
– FenceState
– TimeToThreshold
FinalRead:
scenario runner outputs a final PanelObject summary at T7

FENCE_HOOKS.v1:
FENCE acts as propagation modifier, not just post-hoc label
If HighestFENCEStateReached = F2 or above:
expansion remains blocked until reentry test passes
If EmergencyTrigger fires:
scenario auto-escalates at least one TrajectoryClass worse unless core is preserved quickly

LEDGER_HOOKS.v1:
EachTimeSlice:
update:
– ledger states
– active gaps
– hidden borrowing flags
– verification states
PrecedenceRule:
if lower ledger breaches, shell recovery cannot upgrade final TrajectoryClass beyond ForcedDowngrade unless reconciled

PLAYBOOK_HOOKS.v1:
At T3:
select move triplet
At T4-T5:
apply expected move effect and failure risk
At T6:
Mv19 and Mv20 govern reentry test
If move triplet is misaligned with dominant CM:
downgrade RepairEffectivenessRead and raise RelapseRisk

LAW_HOOKS.v1:
L02:
tested by whether repair outruns scenario drift
L07:
tested by whether scenario narrows valid options to one safe corridor
L08/L09:
tested by reserve drawdown and hidden borrowing under load
L11:
tested by human/institutional carrier survivability
L15:
tested by worst-point breach plus FENCE delay

=============================================================================

DEFAULT BLANK SCENARIO OBJECT

=============================================================================

ScenarioObject:
ScenarioID:
CityID:
ScenarioType:
RunMode:

Baseline:
TimeSlice: T0
CurrentBand:
ActiveCollapseMode:
ActiveLedgerBreaches: [>, >]
FenceState:

InjectedShockSet:
– ShockID:
Intensity:
Duration:
InitialZHit: [, ]

TimeSlices:
T1:
PrimarySensorMoves:
DominantCM:
FenceState:
T2:
CrossZSpread:
LedgerChanges:
T3:
RepairTriplet:
–
–
–
T4:
StructuralEffect:
T5:
ReconciliationRead:
T6:
ReentryTest:
T7:
LongHorizonResidue:

Outputs:
FinalBand:
TrajectoryClass:
DominantCollapsePath:
HighestFENCEStateReached:
KeyLedgerBreaches: [>, >, ]
RepairEffectivenessRead:
TimeSliceOfWorstPoint:
ReentryStatus:
RelapseRisk:

=============================================================================

PASS / FAIL

=============================================================================

PASS_CONDITION.v1:
This spec is working if:
– the city is read as a route through time, not a frozen snapshot
– shocks propagate differently depending on buffers, truth, and FENCE timing
– correct repair materially changes the trajectory
– misrepair visibly worsens the route
– shell survival cannot be mistaken for successful containment while base ledgers fail

FAIL_CONDITION.v1:
This spec fails if:
– every scenario ends the same regardless of shock type
– repair moves do not materially affect propagation
– CM3 misrepair is not distinguishable from correct repair
– long-horizon hidden borrowing never appears
– the runner produces optimistic outputs while precedence ledgers stay breached

NEXT_DEPENDENCY:
After this, the next required spec is:
CivOS.CityComparativePanel.6Cities.v1.0
“`

“`text id=”y1s7qk”
SPEC_ID: CivOS.CityComparativePanel.6Cities.v1.0
TITLE: Six-City Comparative Panel (NY, SG, BJ, TK, LD, SL) — Continuous Binding Layer
MODE: Almost-Code
OUTPUT_RULE: Code-Only
VERSION: v1.0
STATUS: Canonical Comparative Control Surface
DEPENDS_ON:

• CivOS.CityControlTower.OnePanel.v1.0
• CivOS.CitySensorThresholds.Calibration.v1.0
• CivOS.CityFENCE.TriggerMap.Z0-Z6.v1.0
• CivOS.CityInvariantLedger.StackedTemplates.v1.0
• CivOS.CityFailureAtlas.3Modes.Z0-Z6.v1.0
• CivOS.CityRepairPlaybook.Top20Moves.v1.0
• CivOS.CityScenarioRunner.CF.v1.0
• CivOS.CityLawPack.Global.Z3-Z6.CF.v1.0
• CivOS.CityOS.Pack6.Z0-Z6.CF.v1.0

PURPOSE:
Provide a single comparative board that binds:
– six cities
– three Z-bands (base / system / interface)
– the dominant collapse mode and law stress
– top repair move
– and a minimal scenario set
so the “all cities” law pack becomes a living comparative runtime.

CANONICAL_RULES:
Rule1:
No city is “healthy” if its base (Z0-Z2) is persistently weak.
Rule2:
Comparisons must use the same sensor normalization and thresholds.
Rule3:
Output must converge to:
– one dominant read per city
– one dominant cross-city insight
– one recommended next action per city (max 3)
Rule4:
No frontier permission is displayed if FrontierPermission != Open.
Rule5:
CM3 precedence remains global:
wrong model > buffer > transfer.

PANEL_OUTPUTS (must always exist):
P0: PanelTimeSlice
P1: CityRankByRisk (relative, qualitative)
P2: CitySummaryRow[6]
P3: CrossCityStressMap
P4: CrossCityRepairMap
P5: CrossCityScenarioQueue
P6: GlobalBinderRead (one paragraph)

=============================================================================

PANEL SCHEMA

=============================================================================

CITY_SET.v1:

• NewYork # NY
• Singapore # SG
• Beijing # BJ
• Tokyo # TK
• London # LD
• Seoul # SL

Z_BAND_SET.v1:
BaseBand:
Z: {Z0,Z1,Z2}
Name: HumanCarrierBand
SystemBand:
Z: {Z3,Z4}
Name: CitySystemBand
InterfaceBand:
Z: {Z5,Z6}
Name: ExternalInterfaceBand

CITY_SUMMARY_ROW_SCHEMA.v1:
Fields:
CityID
Archetype
CurrentBand
DominantCM
TrendDirection
BaseBandStatus
SystemBandStatus
InterfaceBandStatus
TopLawStress3
WeakestSensor3
HighestFENCEState (current or recent)
TopRepairMoves3
FrontierPermission
KeyLedgerBreaches (top 2)
MostImportantUnreconciledGap
ConfidenceBand
TimeToThreshold
NotesOneLine

CROSS_CITY_STRESS_MAP_SCHEMA.v1:
Fields:
LawStressHistogram:
L01..L15 -> count of cities where law is in TopLawStress3
CollapseModeHistogram:
CM1/CM2/CM3 -> count of cities where mode is dominant
WeakSensorHistogram:
S01..S12 -> count of cities where sensor is in WeakestSensor3

CROSS_CITY_REPAIR_MAP_SCHEMA.v1:
Fields:
RepairMoveHistogram:
Mv01..Mv20 -> count of cities where move is in TopRepairMoves3
SharedTopMoves:
list of moves that appear in >= 3 cities
DivergentMoveNeeds:
per city, the move that differs most from others

SCENARIO_QUEUE_SCHEMA.v1:
Fields:
ForEachCity:
– ScenarioTemplateID
– Purpose
– RunMode
– Priority
CrossCityComparativeRuns:
– ScenarioTemplateID
– CitiesIncluded
– Purpose

GLOBAL_BINDER_READ_SCHEMA.v1:
OneParagraph:
Must include:
– dominant global stress pattern (1-2)
– whether base hollowing vs shell strain is common
– one global “must-not-do”
– one global “repair primitive to export”

=============================================================================

PANEL COMPUTATIONS

=============================================================================

CITY_RISK_RANKING_RULE.v1:
Inputs:
– CurrentBand
– BaseBandStatus
– DominantCM
– HighestFENCEState
– PrecedenceLedgerBreaches
– ConfidenceBand
– TimeToThreshold
RankingPrinciples:
– BaseBand Neg increases risk sharply
– CM3 dominant increases risk precedence
– FENCE at F2+ increases risk
– Low confidence increases risk
– T0/T1 time-to-threshold increases risk
Output:
RiskTier (qualitative):
TierA: Highest concern
TierB: Elevated
TierC: Watch
TierD: Stable

CROSS_CITY_INSIGHT_RULE.v1:
Determine:
– which law(s) stress appears most
– which collapse mode dominates across the set
– whether the shared pattern is:
Pattern1: BaseHollowing
Pattern2: ExternalShockExposure
Pattern3: ChoiceShear
Pattern4: WrongModelAmplification
Pattern5: MaintenanceDebt
Output:
One Global Insight + One Global Countermeasure

FRONTIER_PERMISSION_RULE.v1:
If FrontierPermission != Open:
Display: Blocked/Narrow/Conditional only
Hide:
any wording implying expansion should proceed
If CurrentBand != PosLattice:
FrontierPermission cannot be Open

SHELL_BASE_DIVERGENCE_RULE.v1:
If InterfaceBandStatus is Pos
AND BaseBandStatus is Neg or low Neu
for 2 cycles:
Flag:
GlobalShellBaseDivergence = True
Raise:
L09 BorrowedLift prominence in CrossCityStressMap
Apply:
CityBand downgrade in comparative rank computation

=============================================================================

DEFAULT PANEL (EMPTY) TEMPLATE

=============================================================================

ComparativePanelObject:
PanelTimeSlice:

CityRankByRisk:
– CityID:
RiskTier:
WhyOneLine:

CitySummaryRow:
– CityID: NewYork
Archetype:
CurrentBand:
DominantCM:
TrendDirection:
BaseBandStatus:
SystemBandStatus:
InterfaceBandStatus:
TopLawStress3: [, , ]
WeakestSensor3: [, , ]
HighestFENCEState:
TopRepairMoves3: [, , ]
FrontierPermission:
KeyLedgerBreaches: [>, >]
MostImportantUnreconciledGap:
ConfidenceBand:
TimeToThreshold:
NotesOneLine:

- CityID: Singapore
  (same fields)
- CityID: Beijing
  (same fields)
- CityID: Tokyo
  (same fields)
- CityID: London
  (same fields)
- CityID: Seoul
  (same fields)

CrossCityStressMap:
LawStressHistogram:
L01: <0..6>
L02: <0..6>
L03: <0..6>
L04: <0..6>
L05: <0..6>
L06: <0..6>
L07: <0..6>
L08: <0..6>
L09: <0..6>
L10: <0..6>
L11: <0..6>
L12: <0..6>
L13: <0..6>
L14: <0..6>
L15: <0..6>

CollapseModeHistogram:
  CM1: <0..6>
  CM2: <0..6>
  CM3: <0..6>
WeakSensorHistogram:
  S01: <0..6>
  S02: <0..6>
  S03: <0..6>
  S04: <0..6>
  S05: <0..6>
  S06: <0..6>
  S07: <0..6>
  S08: <0..6>
  S09: <0..6>
  S10: <0..6>
  S11: <0..6>
  S12: <0..6>

CrossCityRepairMap:
RepairMoveHistogram:
Mv01: <0..6>
Mv02: <0..6>
Mv03: <0..6>
Mv04: <0..6>
Mv05: <0..6>
Mv06: <0..6>
Mv07: <0..6>
Mv08: <0..6>
Mv09: <0..6>
Mv10: <0..6>
Mv11: <0..6>
Mv12: <0..6>
Mv13: <0..6>
Mv14: <0..6>
Mv15: <0..6>
Mv16: <0..6>
Mv17: <0..6>
Mv18: <0..6>
Mv19: <0..6>
Mv20: <0..6>

SharedTopMoves:
  - <Mvxx>
  - <Mvxx>
DivergentMoveNeeds:
  NewYork: <Mvxx>
  Singapore: <Mvxx>
  Beijing: <Mvxx>
  Tokyo: <Mvxx>
  London: <Mvxx>
  Seoul: <Mvxx>

CrossCityScenarioQueue:
ForEachCity:
NewYork:
– ScenarioTemplateID:
Purpose:
RunMode:
Priority:
Singapore:
– (same)
Beijing:
– (same)
Tokyo:
– (same)
London:
– (same)
Seoul:
– (same)

CrossCityComparativeRuns:
  - ScenarioTemplateID: <TemplateB|TemplateE|TemplateF>
    CitiesIncluded: [NewYork,Singapore,Beijing,Tokyo,London,Seoul]
    Purpose: <text>

GlobalBinderRead:
OneParagraph:

=============================================================================

STANDARD POPULATION RULES

=============================================================================

PANEL_POPULATION_RULES.v1:
SourceOfTruth:
Each city row is populated by that city’s OnePanel output.
FieldRules:
CurrentBand:
from OnePanel.CurrentBand
DominantCM:
from FailureAtlas selection
Base/System/InterfaceBandStatus:
from OnePanel aggregated Z-bands
TopLawStress3:
from OnePanel.TopLawStress3
WeakestSensor3:
from calibrated sensor outputs
HighestFENCEState:
max(FENCE current, last cycle)
TopRepairMoves3:
from RepairPlaybook selection
FrontierPermission:
from LGR.FrontierPermission
KeyLedgerBreaches:
top 2 by precedence
MostImportantUnreconciledGap:
from OnePanel row F2
ConfidenceBand:
from OnePanel
TimeToThreshold:
from OnePanel
ConsistencyRule:
If a field is missing:
downgrade ConfidenceBand by one level
Anti-OpticsRule:
If shell is Pos but base is Neg:
annotate NotesOneLine with “Shell/Base Divergence”
and apply band downgrade in risk ranking

=============================================================================

DEFAULT SCENARIO QUEUE (FOR THIS 6-CITY SET)

=============================================================================

DEFAULT_SCENARIO_QUEUE.v1:

ForEachCity:

NewYork:
  - ScenarioTemplateID: TemplateB
    Purpose: Test base compression -> transfer snaps under cost pressure
    RunMode: RM2
    Priority: High
  - ScenarioTemplateID: TemplateC
    Purpose: Test CM1 corridor snap with/without fallback routes
    RunMode: RM2
    Priority: Medium
Singapore:
  - ScenarioTemplateID: TemplateE
    Purpose: Test external concentration + reserve drawdown exposure
    RunMode: RM2
    Priority: High
  - ScenarioTemplateID: TemplateF
    Purpose: Test long-horizon regeneration under high performance
    RunMode: RM1
    Priority: Medium
Beijing:
  - ScenarioTemplateID: TemplateD
    Purpose: Test CM3 wrong-model amplification vs truth-audit correction
    RunMode: RM3
    Priority: High
  - ScenarioTemplateID: TemplateE
    Purpose: Test external concentration stress vs reserve cover
    RunMode: RM2
    Priority: Medium
Tokyo:
  - ScenarioTemplateID: TemplateA
    Purpose: Detect slow drift / hollowing under stable surface
    RunMode: RM2
    Priority: High
  - ScenarioTemplateID: TemplateF
    Purpose: Detect long-horizon regeneration and succession narrowing
    RunMode: RM2
    Priority: Medium
London:
  - ScenarioTemplateID: TemplateB
    Purpose: Test affordability-driven base throughput narrowing
    RunMode: RM2
    Priority: High
  - ScenarioTemplateID: TemplateD
    Purpose: Test legitimacy mismatch and misrepair risk
    RunMode: RM2
    Priority: Medium
Seoul:
  - ScenarioTemplateID: TemplateF
    Purpose: Test regeneration borrowing under compressed acceleration
    RunMode: RM3
    Priority: High
  - ScenarioTemplateID: TemplateG
    Purpose: Test best-case recovery corridor after base runway breach
    RunMode: RM4
    Priority: Medium

CrossCityComparativeRuns:
– ScenarioTemplateID: TemplateB
CitiesIncluded: [NewYork,Singapore,Beijing,Tokyo,London,Seoul]
Purpose: Compare how base compression propagates across archetypes
– ScenarioTemplateID: TemplateD
CitiesIncluded: [NewYork,Singapore,Beijing,Tokyo,London,Seoul]
Purpose: Compare misrepair vs truth-audit correction under CM3 risks
– ScenarioTemplateID: TemplateF
CitiesIncluded: [NewYork,Singapore,Beijing,Tokyo,London,Seoul]
Purpose: Compare long-horizon regeneration and succession stability

=============================================================================

GLOBAL BINDER READ GENERATOR

=============================================================================

GLOBAL_BINDER_READ_GENERATOR.v1:
Inputs:
– CrossCityStressMap histograms
– Shell/Base Divergence flags
– SharedTopMoves
– Dominant collapse mode distribution
Output:
OneParagraph:
Sentence1:
dominant shared stress and what it means structurally
Sentence2:
dominant shared collapse risk and where it starts (base/system/interface)
Sentence3:
shared must-not-do (global)
Sentence4:
shared repair primitive to export across cities
Constraints:
– mechanism-first
– no moral framing
– no news-cycle claims

=============================================================================

PASS / FAIL

=============================================================================

PASS_CONDITION.v1:
This spec is working if:
– six city OnePanels can be bound into one comparable panel
– comparisons preserve the same thresholds and semantics
– shell/base divergence becomes visible immediately
– the panel converges to action per city (<= 3 moves)
– the scenario queue provides repeatable stress tests

FAIL_CONDITION.v1:
This spec fails if:
– comparisons become narrative and not schema-consistent
– cities are ranked by shell optics while base failure is ignored
– the panel outputs too many insights and no next action
– frontier permission appears while base ledgers are breached
– scenario runs are incomparable due to drifting definitions

NEXT_DEPENDENCY:
After this, the next required spec is:
CivOS.CityEventToLaw.Mapper.v1.0
“`

“`text id=”q3w8nc”
SPEC_ID: CivOS.CityEventToLaw.Mapper.v1.0
TITLE: Universal City Event-to-Law Mapper for Any City (Z0-Z6)
MODE: Almost-Code
OUTPUT_RULE: Code-Only
VERSION: v1.0
STATUS: Canonical Common-Sense Explainer / Event Routing Engine
DEPENDS_ON:

• CivOS.CityControlTower.OnePanel.v1.0
• CivOS.CitySensorThresholds.Calibration.v1.0
• CivOS.CityFENCE.TriggerMap.Z0-Z6.v1.0
• CivOS.CityInvariantLedger.StackedTemplates.v1.0
• CivOS.CityFailureAtlas.3Modes.Z0-Z6.v1.0
• CivOS.CityRepairPlaybook.Top20Moves.v1.0
• CivOS.CityScenarioRunner.CF.v1.0
• CivOS.CityComparativePanel.6Cities.v1.0
• CivOS.CityLawPack.Global.Z3-Z6.CF.v1.0
• CivOS.CityOS.Pack6.Z0-Z6.CF.v1.0

PURPOSE:
Convert a real-world city event into a CivOS runtime read:
Event -> Z-level -> Band -> Sensors -> Ledger -> LawStress ->
CollapseMode -> FENCEState -> RepairMoves -> Common-Sense Explanation
so the system can explain:
– what just happened
– where it happened
– why it happened
– what layer failed first
– what it is most likely to trigger next
– what the next bounded repair move is

CORE_FUNCTION:
IngestEvent -> ResolveFacts -> SeparateStructureFromPerception ->
MapToZ -> MapToSensors -> MapToLedgers -> SelectTopLawStress ->
SelectDominantCM -> DetectFENCENeed -> OutputRepairRoute ->
GenerateCommonSenseRead

CANONICAL_DEFINITION:
An event is not just a news item or isolated incident.
In CityOS, an event is a named state change passing through:
Structure x Phase x Time.
The Event-to-Law Mapper determines whether the event is:
– a local symptom
– a structural shift
– a boundary crossing
– a wrong-model reaction
– or a narrowing toward one valid corridor

CORE_READING_RULE:
Every event must be mapped through two simultaneous layers:
Layer1: StructuralLayer (what is mechanically happening)
Layer2: PerceptionLayer (what people think is happening)
The final output must not confuse perception with structure.

DUAL_MODE_READING.v1:
StructuralLayer:
Goal:
identify actual corridor, sensor, ledger, and law effects
Question:
“What changed in the real operating system?”
PerceptionLayer:
Goal:
identify narrative noise, false inevitability, panic, optics, blame displacement, or delayed recognition
Question:
“What do participants believe or claim is happening?”
Rule:
StructuralLayer always takes precedence for repair.
Exception:
If PerceptionLayer is causing direct signal corruption,
then perception becomes structurally relevant through CM3.

EVENT_MAPPER_OUTPUTS (must always exist):
O1: EventClass
O2: StructuralLayerRead
O3: PerceptionLayerRead
O4: PrimaryZ
O5: AffectedZBands
O6: TopSensorHits
O7: TopLedgerHits
O8: TopLawStress3
O9: DominantCM
O10: FENCERead
O11: TopRepairMoves3
O12: NextLikelySequence
O13: ConfidenceBand
O14: FalseInevitabilityFlag

=============================================================================

EVENT GRAMMAR

=============================================================================

EVENT_CLASS_SET.v1:
EC01:
Name: AccessEvent
Meaning: work, housing, mobility, care, or service access changes
EC02:
Name: CostEvent
Meaning: price, burden, debt, affordability, or funding shifts
EC03:
Name: ServiceEvent
Meaning: service delay, outage, overload, or disruption
EC04:
Name: InfrastructureEvent
Meaning: system, utility, transport, or network continuity changes
EC05:
Name: GovernanceEvent
Meaning: policy, rule, execution, or institutional coordination change
EC06:
Name: TrustEvent
Meaning: legitimacy, compliance, confidence, or public behavior shift
EC07:
Name: ExternalEvent
Meaning: global interface, supply, talent, trade, or dependency change
EC08:
Name: RegenerationEvent
Meaning: burnout, succession, population, renewal, or human carrier changes
EC09:
Name: ShellEvent
Meaning: prestige, signaling, symbolic projection, frontier expansion, shell-only moves
EC10:
Name: CompositeEvent
Meaning: multiple event classes coupled in one sequence

EVENT_SCOPE_SET.v1:
Local
District
CitySystem
MetroGovernance
ExternalInterface
CivilisationNode

EVENT_TEMPORALITY_SET.v1:
Immediate
Short
Medium
Long
LongHorizon

EVENT_DIRECTION_SET.v1:
PositiveShift
NegativeShift
MixedShift
UnclearShift

EVENT_SEVERITY_SET.v1:
E0:
Minor
E1:
Moderate
E2:
Severe
E3:
Critical

EVENT_SOURCE_SET.v1:
DirectObservation
OfficialReport
ReportedNarrative
DerivedInference
ModelSimulation
MixedSources

=============================================================================

EVENT INPUT SCHEMA

=============================================================================

EventObject:
EventID:
CityID:
TimeSlice:

EventHeader:
EventTitle:
EventClass:
SourceType:
Scope:
Direction:
Severity:
Temporality:

ObservedFacts:
–
–
–

ReportedClaims:
–
–
–

NamedCorridorsMentioned:
–
–

ImmediateImpactsObserved:
–
–

SuspectedAffectedZ:
–
–

ConfidenceInputs:
FactQuality:
SignalConflict:
NarrativeHeat:

=============================================================================

FACT RESOLUTION ENGINE

=============================================================================

FACT_RESOLUTION_RULES.v1:
Step1:
Separate direct observations from interpretations
Step2:
Separate observable state changes from causal claims
Step3:
Mark any claim that is:
– causal but unverified
– moral but non-mechanical
– symbolic but not operational
Step4:
Preserve only load-bearing facts for structural mapping
Step5:
Keep narrative claims in PerceptionLayer only unless they directly change:
– trust
– behavior
– compliance
– decision velocity

LOAD_BEARING_FACT_TEST.v1:
A fact is load-bearing if it changes at least one:
– corridor continuity
– reserve/runway
– signal validity
– legitimacy/compliance
– external dependency
– regeneration capacity
If not:
keep as narrative context only

FACT_QUALITY_RULE.v1:
High:
multiple consistent observable facts
Medium:
some direct facts, some inferred
Low:
mostly claims, weak direct observation
Rule:
Low FactQuality reduces structural confidence and raises PerceptionNoise weight

=============================================================================

Z-MAPPING ENGINE

=============================================================================

Z_MAPPING_RULES.v1:
Z0:
if event directly changes:
– person-day access
– immediate safety
– immediate affordability
– same-day routine viability
Z1:
if event directly changes:
– household continuity
– work/school/care routine
– weekly obligations
Z2:
if event directly changes:
– district coordination
– local services
– neighborhood trust
– community access
Z3:
if event directly changes:
– city systems
– transport, utilities, health, housing operations
– maintenance or service backlogs
Z4:
if event directly changes:
– governance model
– fiscal commitments
– institutional coordination
– policy-to-execution coupling
Z5:
if event directly changes:
– trade, finance, migration, supply, external confidence
– city shell-interface with the outside world
Z6:
if event directly changes:
– long-horizon city identity
– exported model validity
– succession continuity
– prestige vs base civilization-node role

PRIMARY_Z_SELECTION.v1:
Choose the lowest Z where the event becomes materially real first.
Reason:
upstream/base change matters before downstream shell appearance.
Example:
A visible market panic at Z5 caused by base affordability failure still maps first to Z0-Z2 if that is where the real corridor failure began.

AFFECTED_Z_BAND_RULE.v1:
BaseBand:
if any of {Z0,Z1,Z2} materially affected
SystemBand:
if any of {Z3,Z4} materially affected
InterfaceBand:
if any of {Z5,Z6} materially affected
Rule:
one event may hit multiple bands, but must still have one PrimaryZ

=============================================================================

SENSOR MAPPING ENGINE

=============================================================================

EVENT_TO_SENSOR_MAP.v1:

EC01.AccessEvent:
PrimarySensors:
– S01 NodeContinuity
– S02 BindQuality
– S09 CostPressure
SecondarySensors:
– S03 RepairLatency
– S06 TrustSignal

EC02.CostEvent:
PrimarySensors:
– S04 BufferDepth
– S09 CostPressure
SecondarySensors:
– S11 SocialRegeneration
– S06 TrustSignal

EC03.ServiceEvent:
PrimarySensors:
– S03 RepairLatency
– S01 NodeContinuity
– S02 BindQuality
SecondarySensors:
– S10 GovernanceCoherence
– S06 TrustSignal

EC04.InfrastructureEvent:
PrimarySensors:
– S07 InfrastructureRedundancy
– S01 NodeContinuity
– S03 RepairLatency
SecondarySensors:
– S04 BufferDepth
– S12 ExternalDependency

EC05.GovernanceEvent:
PrimarySensors:
– S10 GovernanceCoherence
– S03 RepairLatency
SecondarySensors:
– S06 TrustSignal
– S05 ChoiceLoad

EC06.TrustEvent:
PrimarySensors:
– S06 TrustSignal
– S10 GovernanceCoherence
SecondarySensors:
– S02 BindQuality
– S03 RepairLatency

EC07.ExternalEvent:
PrimarySensors:
– S12 ExternalDependency
– S08 TalentTransfer
– S04 BufferDepth
SecondarySensors:
– S06 TrustSignal
– S07 InfrastructureRedundancy

EC08.RegenerationEvent:
PrimarySensors:
– S11 SocialRegeneration
– S08 TalentTransfer
– S04 BufferDepth
SecondarySensors:
– S09 CostPressure
– S06 TrustSignal

EC09.ShellEvent:
PrimarySensors:
– S04 BufferDepth
– S12 ExternalDependency
– S06 TrustSignal
SecondarySensors:
– S08 TalentTransfer
– S10 GovernanceCoherence
SpecialRule:
always test for shell/base divergence

EC10.CompositeEvent:
Rule:
union the top 2 event-class sensor sets only
Reason:
avoid combinatorial sprawl

TOP_SENSOR_HIT_SELECTION.v1:
Output max 3 sensors:
– 2 from primary set
– 1 from secondary set
Exception:
if shell/base divergence is suspected,
force-include:
– S04 BufferDepth
OR
– S11 SocialRegeneration
before shell-only sensor additions

=============================================================================

LEDGER MAPPING ENGINE

=============================================================================

EVENT_TO_LEDGER_MAP.v1:

If PrimaryZ in {Z0,Z1}:
TopLedgers:
– LGR.BaseLife
– LGR.Regeneration

If PrimaryZ in {Z2,Z3}:
TopLedgers:
– LGR.CivicThroughput
– LGR.InfrastructureContinuity
Add:
– LGR.GovernanceLegitimacy if trust or model mismatch is involved

If PrimaryZ = Z4:
TopLedgers:
– LGR.GovernanceLegitimacy
– LGR.TruthAndTelemetry
Add:
– LGR.InfrastructureContinuity if macro decisions hit core systems

If PrimaryZ = Z5:
TopLedgers:
– LGR.ExternalInterface
– LGR.PrestigeVsBase
Add:
– LGR.FrontierPermission for expansion events

If PrimaryZ = Z6:
TopLedgers:
– LGR.PrestigeVsBase
– LGR.FrontierPermission
Add:
– LGR.Regeneration if long-horizon continuity is being borrowed

LEDGER_OVERRIDE_RULES.v1:
If event includes:
– visible wrong-model correction
– policy worsens outcomes
-> force-include:
– LGR.GovernanceLegitimacy
– LGR.TruthAndTelemetry

If event includes:
– burnout
– fertility/renewal collapse
– succession thinning
-> force-include:
– LGR.Regeneration

If event includes:
– shell expansion
– symbolic prestige
– major outward projection
-> force-include:
– LGR.PrestigeVsBase
– LGR.FrontierPermission

=============================================================================

LAW MAPPING ENGINE

=============================================================================

LAW_SELECTION_RULES.v1:
Select max 3 laws.
The first law must describe the first real mechanical issue.
The second law must describe the active amplification mechanism.
The third law must describe the consequence boundary or narrowing path.

EVENT_TO_LAW_MAP.v1:

If S01/S02 primary:
PrimaryLaw:
– L01 CoreLatticeLaw
Amplifier:
– L03 LatticeDriftCondition
Consequence:
– L04 FenceIntegrityLaw

If S04/S09 primary:
PrimaryLaw:
– L02 RateDominanceLaw
Amplifier:
– L08 ReserveRentLaw
Consequence:
– L09 BorrowedLiftLaw

If S03/S06/S10 primary:
PrimaryLaw:
– L03 LatticeDriftCondition
Amplifier:
– L11 VesselFirstLaw
Consequence:
– L04 FenceIntegrityLaw
Override:
if wrong-model correction is visible:
raise L13 EnvelopeShiftLaw

If S05 primary:
PrimaryLaw:
– L05 SymmetryChoiceLaw
Amplifier:
– L06 SymmetryChoiceRateLaw
Consequence:
– L04 FenceIntegrityLaw

If S07 primary:
PrimaryLaw:
– L04 FenceIntegrityLaw
Amplifier:
– L13 EnvelopeShiftLaw
Consequence:
– L15 EnvelopeRuptureEvent (if critical)

If S12 primary:
PrimaryLaw:
– L08 ReserveRentLaw
Amplifier:
– L12 FrontierApertureLaw
Consequence:
– L09 BorrowedLiftLaw

If shell/base divergence detected:
force-include:
– L09 BorrowedLiftLaw
– L11 VesselFirstLaw

If options are visibly collapsing:
force-include:
– L07 SingleCorridorLaw

If rupture window is close:
force-include:
– L15 EnvelopeRuptureEvent
but only as third law unless already the direct event

=============================================================================

COLLAPSE MODE MAPPING ENGINE

=============================================================================

EVENT_TO_CM_MAP.v1:
CM1.TransferBreak:
TriggerIf:
– named corridor can be identified
– access/service continuity has snapped
– S01/S02 are primary hits
EventBias:
– EC01
– EC03
– EC04
CM2.BufferBreach:
TriggerIf:
– runway/reserve/slack is the first true limit
– S04/S09/S07 are primary hits
EventBias:
– EC02
– EC04
– EC07
– EC08
– EC09
CM3.SignalCorruption:
TriggerIf:
– fixes worsen conditions
– narrative and reality split
– S03/S06/S10 are primary hits
EventBias:
– EC05
– EC06
– EC10
Rule:
Select one dominant CM only.
TieBreak:
CM3 > CM2 > CM1

SECONDARY_CM_RULE.v1:
Optional:
one secondary mode only
Use:
only when it changes the repair path materially
Example:
cost shock causing access snap:
– CM2 primary
– CM1 secondary

=============================================================================

FENCE MAPPING ENGINE

=============================================================================

EVENT_TO_FENCE_RULE.v1:
Advisory:
if event is localized, low severity, no precedence ledger at risk
PreFence:
if:
– event hits one priority sensor at warning level
– OR event crosses 2 adjacent Z-levels
– OR repeated similar events appear in one corridor
ActiveFence:
if:
– event implies hard breach of a precedence ledger
– OR core continuity is threatened
– OR wrong-model escalation is active
EmergencyFence:
if:
– basic life corridor breaks now
– critical infrastructure breaks now
– macro wrong-model correction is amplifying live damage
– external critical corridor severs with no reserve cover

FENCE_OUTPUT_FIELDS.v1:
FenceStateRecommendation:

TriggeredFencePointCandidates:
–
–
–
ExpansionStatusRecommendation:

=============================================================================

REPAIR MAPPING ENGINE

=============================================================================

EVENT_TO_REPAIR_MAP.v1:
If DominantCM = CM1:
DefaultTopMoves:
– Mv14 SwitchToFallbackRoute
– Mv02 RepairBind
– Mv20 VerifyUnderLoad

If DominantCM = CM2:
DefaultTopMoves:
– Mv12 FreezeExpansion
– Mv01 RestoreBuffer
– Mv17 RepriceObligations

If DominantCM = CM3:
DefaultTopMoves:
– Mv16 SlowDecisionVelocity
– Mv15 ForceTruthAudit
– Mv03 ImproveSignal

REPAIR_OVERRIDE_RULES.v1:
If PrimaryZ in {Z0,Z1}:
prefer:
– Mv11 ProtectCoreNodes
– Mv01 RestoreBuffer
– Mv14 SwitchToFallbackRoute

If event is long-horizon and regeneration-linked:
prefer:
– Mv06 ProtectRegeneration
– Mv18 RebuildSuccession

If event is shell-expansion while base is weak:
force:
– Mv08 DowngradeAmbition
– Mv12 FreezeExpansion

If confidence is low:
ensure one move is:
– Mv20 VerifyUnderLoad
OR
– Mv15 ForceTruthAudit

=============================================================================

NEXT LIKELY SEQUENCE ENGINE

=============================================================================

NEXT_SEQUENCE_RULES.v1:
The mapper must output one likely causal sequence:
What happened ->
What it most likely stresses next ->
What it becomes if ignored
Format:
Event -> Sensor -> Ledger -> CM -> Consequence

STANDARD_NEXT_SEQUENCES.v1:

If CM1:
OutputPattern:
named break -> adjacent corridor overload -> wider transfer loss -> FENCE escalation

If CM2:
OutputPattern:
runway loss -> maintenance / human slack drawdown -> broader service strain -> shell/base divergence

If CM3:
OutputPattern:
wrong read -> wrong repair -> trust loss -> faster downstream CM2/CM1 emergence

If shell/base divergence:
OutputPattern:
shell stays stable -> base narrows -> hidden borrowing rises -> later visible downgrade

=============================================================================

FALSE INEVITABILITY DETECTION

=============================================================================

FALSE_INEVITABILITY_DETECTOR.v1:
Purpose:
Separate:
– true narrowing into one valid corridor (Single Corridor Law)
from
– narrative, panic, optics, or self-fulfilling closure
Output:
FalseInevitabilityFlag =
CorridorState =

TRUE_SINGLE_CORRIDOR_TEST.v1:
A true Single Corridor condition exists only if:
– multiple ledgers have narrowed simultaneously
– all but one viable repair path violate a protected invariant
– FENCE / reserve / signal rules remove the other options mechanically
If true:
set:
CorridorState = SingleValidCorridor
include:
L07 SingleCorridorLaw

FALSE_CLOSURE_TEST.v1:
FalseInevitabilityFlag = True if ANY:
– participants claim “no choice” but ledgers still show multiple valid options
– high narrative heat with low structural confidence
– shell optics are used to declare closure while base data is missing
– a wrong model removes options that are still structurally available
– fear / blame / symbolism is compressing choices faster than real constraints
If true:
do NOT elevate L07 as a structural law
instead elevate:
– CM3 pathways
– Mv15 ForceTruthAudit
– Mv16 SlowDecisionVelocity

PERCEPTION_NOISE_CLASSES.v1:
PN1:
Name: PanicCompression
Meaning: fear narrows perceived options faster than structure
PN2:
Name: PrestigeMask
Meaning: shell confidence hides real narrowing
PN3:
Name: BlameDisplacement
Meaning: symptoms are assigned as causes
PN4:
Name: ComplianceTheatre
Meaning: appearance of control without correction
PN5:
Name: FalseClosure
Meaning: “inevitable” is claimed before structural gates truly close

=============================================================================

COMMON-SENSE EXPLAINER GENERATOR

=============================================================================

COMMON_SENSE_EXPLAINER.v1:
Purpose:
Produce a concise causal explanation in “this is what happened” form.
RequiredOutput:
– one structural sentence
– one sequence sentence
– one implication sentence
StructuralSentence:
” is primarily a / problem affecting , not merely a surface headline.”
SequenceSentence:
“The first real pressure is on ; if not corrected, it most likely becomes .”
ImplicationSentence:
“The next safe move is , while the main mistake to avoid is .”
Constraints:
– mechanism-first
– no persuasion
– no moral framing
– no false precision
– must distinguish structure from narrative

EXPLAINER_MODE.v1:
ModeA:
StructuralOnly
ModeB:
StructuralPlusPerception
Rule:
Use ModeB when:
– CM3 is dominant
– FalseInevitabilityFlag = True
– trust/legitimacy is part of the event

=============================================================================

CONFIDENCE ENGINE

=============================================================================

CONFIDENCE_BAND_RULES.v1:
High:
if:
– direct facts are strong
– structural mapping is consistent
– perception noise is low
Medium:
if:
– main structure is visible
– some narrative conflict remains
Low:
if:
– facts are weak
– perception noise is high
– multiple competing mappings exist
Rule:
Low confidence forces:
– no frontier permission expansion
– stronger preference for truth-audit moves
– lower certainty language in explainer output

MAPPING_CONFLICT_RULE.v1:
Conflict exists if:
– PrimaryZ inferred from facts conflicts with reported narrative Z
– dominant CM differs between surface story and structural reading
– shell metrics imply strength while base facts imply weakness
If conflict:
raise:
– FalseInevitability scan
– CM3 weight
– Confidence downgrade

=============================================================================

EVENT TYPE QUICK MAPS

=============================================================================

QUICK_MAP_TEMPLATES.v1:

Template.AccessSnap:
EventClass: EC01
PrimaryZ: Z0/Z1
LikelyCM: CM1
LikelyLaws:
– L01
– L03
– L04
LikelyMoves:
– Mv14
– Mv02
– Mv20

Template.AffordabilityCrunch:
EventClass: EC02
PrimaryZ: Z0/Z2
LikelyCM: CM2
LikelyLaws:
– L02
– L08
– L09
LikelyMoves:
– Mv12
– Mv01
– Mv17

Template.ServiceBacklog:
EventClass: EC03
PrimaryZ: Z2/Z3
LikelyCM: CM2 or CM1
LikelyLaws:
– L02
– L03
– L04
LikelyMoves:
– Mv11
– Mv09
– Mv20

Template.PolicyMisfire:
EventClass: EC05
PrimaryZ: Z4
LikelyCM: CM3
LikelyLaws:
– L03
– L11
– L13
LikelyMoves:
– Mv16
– Mv15
– Mv03

Template.PrestigeExpansion:
EventClass: EC09
PrimaryZ: Z5/Z6
LikelyCM: CM2 or CM3
LikelyLaws:
– L08
– L09
– L12
LikelyMoves:
– Mv08
– Mv12
– Mv20

Template.RegenerationWarning:
EventClass: EC08
PrimaryZ: Z1/Z2
LikelyCM: CM2
LikelyLaws:
– L02
– L11
– L09
LikelyMoves:
– Mv06
– Mv18
– Mv20

=============================================================================

CITY-SPECIFIC EVENT BIASES

=============================================================================

CITY_EVENT_PROFILE.v1:

NewYork:
EarlyBias:
– map shell-positive / base-negative events through base first
StrongChecks:
– affordability -> CM2 before surface market read
– transit/work/service -> CM1
FalseInevitabilityRisk:
– high under prestige-mask conditions

Singapore:
EarlyBias:
– check reserve / dependency / overcompression even when surfaces look smooth
StrongChecks:
– compact spread can turn local event into system event quickly
FalseInevitabilityRisk:
– moderate when high-control optics hide narrow buffers

Beijing:
EarlyBias:
– check CM3 first when policy response is part of the event
StrongChecks:
– outcome-vs-compliance divergence
FalseInevitabilityRisk:
– high when narrative closure is declared before truthful feedback

Tokyo:
EarlyBias:
– detect slow-form base narrowing beneath stable surface
StrongChecks:
– regeneration / maintenance drift
FalseInevitabilityRisk:
– lower panic, higher under-recognition

London:
EarlyBias:
– check legacy shell vs daily throughput mismatch
StrongChecks:
– legitimacy mismatch + affordability + service strain
FalseInevitabilityRisk:
– high when inherited prestige delays structural read

Seoul:
EarlyBias:
– check regeneration borrowing before praising visible performance
StrongChecks:
– human slack / succession / compressed load
FalseInevitabilityRisk:
– high when high-output shell masks future-base depletion

=============================================================================

ONE-PANEL / SCENARIO / COMPARATIVE HOOKS

=============================================================================

ONE_PANEL_HOOKS.v1:
EventMode:
When an event is mapped:
– update TopLawStress3 candidate weights
– update DominantCM candidate
– update FENCERead candidate
– update TopRepairMoves3 candidate
If event is severe:
recompute:
– TimeToThreshold
– ConfidenceBand
– MostImportantUnreconciledGap

SCENARIO_RUNNER_HOOKS.v1:
The mapper may convert an event directly into:
– a scenario trigger
– a scenario template choice
Example:
Governance misfire event -> Template.PolicyMisfire -> ST3 MisrepairRun

COMPARATIVE_PANEL_HOOKS.v1:
If the same event-class appears across multiple cities:
aggregate:
– which law is shared
– which collapse mode is shared
– which city differs due to archetype
Output:
CrossCityEventPatternRead

LAW_STACK_HOOKS.v1:
Event mapping is the primary runtime entry point for:
– L03 Drift visibility
– L07 true vs false inevitability
– L09 shell/base borrowing visibility
– L11 vessel-first prioritization
– L15 rupture-prevention escalation

=============================================================================

DEFAULT BLANK MAPPING OBJECT

=============================================================================

MappedEventObject:
EventID:
CityID:
TimeSlice:

StructuralLayerRead:
EventClass:
PrimaryZ:
AffectedZBands: [, , ]
TopSensorHits: [, , ]
TopLedgerHits: [>, >, ]
TopLawStress3: [, , ]
DominantCM:
SecondaryCM:

PerceptionLayerRead:
NarrativeHeat:
NoiseClass:
StructuralNarrativeConflict:
FalseInevitabilityFlag:
CorridorState:

ControlRead:
FenceStateRecommendation:
TriggeredFencePointCandidates: [, , ]
TopRepairMoves3: [, , ]
MainWrongMoveToAvoid:

SequenceRead:
NextLikelySequence:
–
–
–
CommonSenseRead:
StructuralSentence:
SequenceSentence:
ImplicationSentence:

ConfidenceBand:

=============================================================================

PASS / FAIL

=============================================================================

PASS_CONDITION.v1:
This spec is working if:
– a raw city event can be mapped into one coherent structural path
– perception and structure are clearly separated
– false inevitability is caught before it corrupts law selection
– the mapper converges to one dominant CM and 3 or fewer repair moves
– explanations become “what happened, why, what next” instead of vague description

FAIL_CONDITION.v1:
This spec fails if:
– events are reduced to headlines without structural routing
– perception narratives override mechanical reality by default
– L07 is triggered by panic instead of real corridor closure
– shell optics repeatedly hide base-first mapping
– the mapper produces many labels but no bounded repair direction

NEXT_DEPENDENCY:
After this, the next required spec is:
CivOS.Publishing.Router.CityLawPages.v1.0
“`

“`text id=”p8n1vr”
SPEC_ID: CivOS.Publishing.Router.CityLawPages.v1.0
TITLE: Publishing Router for CityOS + Laws of Civilisation (Six Cities) — Canonical Page Spine + Stable IDs
MODE: Almost-Code
OUTPUT_RULE: Code-Only
VERSION: v1.0
STATUS: Canonical Publishing Spine (WordPress-ready)
DEPENDS_ON:

• CivOS.CityLawPack.Global.Z3-Z6.CF.v1.0
• CivOS.CityOS.Pack6.Z0-Z6.CF.v1.0
• CivOS.CityControlTower.OnePanel.v1.0
• CivOS.CitySensorThresholds.Calibration.v1.0
• CivOS.CityFENCE.TriggerMap.Z0-Z6.v1.0
• CivOS.CityInvariantLedger.StackedTemplates.v1.0
• CivOS.CityFailureAtlas.3Modes.Z0-Z6.v1.0
• CivOS.CityRepairPlaybook.Top20Moves.v1.0
• CivOS.CityScenarioRunner.CF.v1.0
• CivOS.CityComparativePanel.6Cities.v1.0
• CivOS.CityEventToLaw.Mapper.v1.0

PURPOSE:
Publish the full CityOS law stack in a way that:
– is searchable
– is AI-ingestible
– preserves stable semantics
– prevents completion drift
– supports follow-up queries and deep navigation
while keeping everything runnable via the One-Panel / Ledger / FENCE system.

PUBLISHING_CONSTRAINTS:

• No renaming of laws or primitives
• Stable IDs must appear in each article
• Each page must stand alone
• Each page must link “up” and “down” the spine
• Each page must include a bottom Almost-Code block (copyable runtime object)
• “Baseline-first” structure must be maintained (classical -> CivOS extension)

CANONICAL_PAGE_TYPES.v1:
PT0: Hub
PT1: CityOS Master Page
PT2: Law-in-City Page
PT3: Z-Level-in-City Page
PT4: Control Tower Page
PT5: Failure Atlas Page
PT6: Repair Playbook Page
PT7: Scenario Runner Page
PT8: Comparative Panel Page
PT9: Event-to-Law Guide Page

CANONICAL_SLUG_RULES.v1:
Global prefix:
civos-
City prefix map:
NewYork: ny
Singapore: sg
Beijing: bj
Tokyo: tk
London: ld
Seoul: sl
Use hyphenated lowercase.
Do not include dates in slugs.
Include version tokens in the page body, not the slug.

NAVIGATION_LAYERS.v1:
LayerA:
Global hub
LayerB:
City hubs (6)
LayerC:
Law pages per city (15 x 6)
LayerD:
Z pages per city (7 x 6)
LayerE:
Control and execution pages (panel, ledgers, fence, atlas, playbook, runner)
LayerF:
Comparative panel pages (6-city)

MINIMUM_PUBLISH_SET (if you publish only the essentials):

• PT0 Global Hub (1)
• PT1 CityOS Master (6)
• PT4 Control Tower (1)
• PT5 Failure Atlas (1)
• PT6 Repair Playbook (1)
• PT8 Comparative Panel (1)
  Total: 11 pages

FULL_PUBLISH_SET (complete spine):

• PT0 Global Hub (1)
• PT1 CityOS Master (6)
• PT2 Law-in-City (15 x 6 = 90)
• PT3 Z-in-City (7 x 6 = 42)
• PT4 Control Tower (1)
• PT5 Failure Atlas (1)
• PT6 Repair Playbook (1)
• PT7 Scenario Runner (1)
• PT8 Comparative Panel (1)
• PT9 Event-to-Law Guide (1)
  Total: 145 pages

=============================================================================

GLOBAL HUB

=============================================================================

PAGE:
Type: PT0 Hub
PageID: PAGE.CivOS.CityLaw.Hub.v1
Title: Laws of Civilisation in Global Cities (CityOS)
Slug: civos-cityos-laws-global-cities
Purpose:
The top entry point for search and navigation.
MustIncludeSections:
– Classical Baseline
– CivOS Definition (city = transfer corridor)
– The 15 Laws (short)
– The 6 City Archetypes (short)
– “How to Run This” (links to One-Panel)
– Links to each city master page
– Links to Comparative Panel
MustLinkTo:
– PAGE.CityOS.ControlTower.OnePanel.v1
– PAGE.CityOS.FailureAtlas.3Modes.v1
– PAGE.CityOS.RepairPlaybook.Top20.v1
– PAGE.CityOS.ScenarioRunner.CF.v1
– PAGE.CityOS.ComparativePanel.6Cities.v1
– PAGE.CityOS.EventToLaw.Guide.v1
BottomAlmostCodeBlock:
Include:
– Spec IDs for global pack and binder
– Law registry list

=============================================================================

CITY MASTER PAGES (6)

=============================================================================

CITY_MASTER_PAGE_TEMPLATE.v1:
Type: PT1 CityOS Master Page
PageID: PAGE.CityOS..Master.v1
Title: CityOS: (Z0–Z6) — How the Laws of Civilisation Work Here
Slug: civos-cityos–master
Purpose:
One page per city that:
– defines city archetype
– provides Z0–Z6 overview
– lists dominant stresses
– links into law pages and Z pages
– points to control tower usage
MustIncludeSections:
– Classical Baseline (what a city must do)
– CivOS City Definition (transfer corridor)
– City Archetype (from the pack)
– Z0–Z6 Map (short)
– Top Law Stress Set (from the city pack)
– Dominant Failure Shapes (CM bias)
– Typical Repair Priorities (from playbook biases)
– “Run the One-Panel for this City” (link + template)
MustLinkTo:
– all PT2 law pages for this city
– all PT3 Z pages for this city
– global hub
– comparative panel
BottomAlmostCodeBlock:
Include:
– CityID
– Archetype
– default law stress
– default weakest sensors
– city fence profile
– city ledger bias profile

CITY_MASTER_PAGES.v1:

• PAGE.CityOS.NewYork.Master.v1:
  Title: CityOS: New York (Z0–Z6) — How the Laws of Civilisation Work Here
  Slug: civos-cityos-ny-master
• PAGE.CityOS.Singapore.Master.v1:
  Title: CityOS: Singapore (Z0–Z6) — How the Laws of Civilisation Work Here
  Slug: civos-cityos-sg-master
• PAGE.CityOS.Beijing.Master.v1:
  Title: CityOS: Beijing (Z0–Z6) — How the Laws of Civilisation Work Here
  Slug: civos-cityos-bj-master
• PAGE.CityOS.Tokyo.Master.v1:
  Title: CityOS: Tokyo (Z0–Z6) — How the Laws of Civilisation Work Here
  Slug: civos-cityos-tk-master
• PAGE.CityOS.London.Master.v1:
  Title: CityOS: London (Z0–Z6) — How the Laws of Civilisation Work Here
  Slug: civos-cityos-ld-master
• PAGE.CityOS.Seoul.Master.v1:
  Title: CityOS: Seoul (Z0–Z6) — How the Laws of Civilisation Work Here
  Slug: civos-cityos-sl-master

=============================================================================

LAW-IN-CITY PAGES (90)

=============================================================================

LAW_IN_CITY_PAGE_TEMPLATE.v1:
Type: PT2 Law-in-City Page
PageID: PAGE.CityOS..Law..v1
Title: in — What It Means and What It Prevents
Slug: civos-cityos–law-
Purpose:
Capture one law’s city-specific expression in a stand-alone SEO page.
MustIncludeSections:
– Baseline (classic meaning of the concept)
– City-specific mechanism (how it expresses here)
– Sensors + thresholds (which sensors show it)
– Ledger hits (which ledgers it breaches first)
– Failure trace (short chain)
– Repair corridor (top 3 moves)
– “How to read events through this law” (hook to mapper)
MandatoryFields:
– LawID (Lxx)
– CityID
– PrimaryZ focus (which Z levels it hits most)
– Dominant CM association
BottomAlmostCodeBlock:
Include:
– LawID
– CityID
– PrimaryZ set
– sensor set
– ledger set
– default repair triplet
– must-not-do list