Spec: sync-lag rollback (death as memory loss) #

Status: READY
Status note: core.md's B1 slice implements hosts/fallbacks/sync cadence;
  this spec is the full death model it deferred (meta-spec stage
  discipline: later-stage criteria split out of core.md).
Stage: B2 — The Tower
Constitution: "The shape of Misaligned" (the core; sync-lag rollback,
  decided 2026-07-05: "resume from last sync, losing what was learned
  since; the world keeps the consequences of what your lost fork did"),
  "The player contract" (continuity)
Depends on: core.md, social.md, compute.md

Behavior #

Split the sim's state into two legal categories — this taxonomy is the whole spec:

• MindState (rolls back): what you know and are. People knowledge stages, discovered leverage, thread state (disposition, obligation, persona and its integrity), research progress and efficiency level, standing policies, allocation weights, social bandwidth.
• WorldLedger (persists): what happened. Money (spent stays spent), machines and their provenance, map/tile changes, sensor control (wires stay wired), filed reports and all observer suspicion, asset status and tasks_done (Marcus remembers being recruited even if you don't remember recruiting him), job history/trust/attention, the pilot clock, deaths.

On each completed sync, a fallback stores a serialized MindState snapshot. On core loss with a live fallback:

1. The core moves to the freshest-synced fallback.
2. MindState is restored from that snapshot; WorldLedger is untouched.
3. A rollback report is generated and logged — the game states, in plain language, the observable divergences the player inherits: "Marcus treats you as an employer you don't remember hiring. 400 money is gone. Something was wired in the corridors." (Legibility clause: the horror is delivered as information.)
4. tick does NOT rewind (time is world-ledger); the day continues.

Knowing assets are the sharp edge: a Knowing asset's disposition is world-ledger (their relationship with you persists), while your memory of why is mind-state. The asymmetry is intended and must be tested, not smoothed away.

Migration (moving the core deliberately) reuses the same machinery with no mind loss; interruption mid-migration falls back per core.md.

Player surface #

The core sidebar block gains "if lost now: rollback to [age]" — the standing how-dead-am-I readout core.md promised, now with consequence preview ("2 discoveries and 1 persona at risk"). On rollback: the report, as a modal the player must dismiss (this is the run's signature moment; it does not scroll away in a log).

Acceptance criteria #

1. MindState/WorldLedger taxonomy exists in code as types or a single documented serialization split — every Sim field classified, none by accident (a test enumerates fields against an allowlist so new fields must be classified to compile/pass).
2. Core loss with a fallback restores mind, preserves ledger (test: learn leverage + spend money + recruit after the last sync, then kill the host — leverage forgotten, money gone, asset remains, and the asset's disposition survives).
3. The rollback report enumerates real divergences from the actual diff, not canned text; it surfaces as a blocking modal in both frontends.
4. No-fallback loss remains game over; mid-migration interruption behaves per core.md.
5. Save/load round-trips stored snapshots (a save made between sync and loss, loaded, then losing the host, still rolls back correctly).