d6eecbd
@@ -2,6 +2,10 @@
A negotiation game played over hours: secret goals, public offers, a deal that binds; agents can sit at the table.
The game is *Sworn & Said*, and its rules of record — charter, charges,
scoring, the sworn and the said, quorum and the clock — are written once in
[RULES.md](RULES.md).
This is an app: the forge runs it. Production follows the default branch;
every open pull gets a preview at its own address with its own copy of the
data. Everything the app keeps lives under `FORGE_APP_DATA`, which is what
@@ -0,0 +1,427 @@
# Sworn & Said — the rules of record
This is the game **parley** builds. It is the one document that says what a
rule *is*; every issue and every module points at a section here instead of
restating it. Where the code and this file disagree, one of them is a bug —
say which in the pull.
A rule in this document is **decidable from stored state alone**: the seed,
the seat count, the act ledger, the clock settings and the current time. No
rule needs a memory of a conversation, a judge, or a player's word.
---
## 1. Vocabulary
Every noun below is the name the code uses. One concept, one word.
| word               | what it is                                                                    |
| ------------------ | ----------------------------------------------------------------------------- |
| **table**          | one game: 4–6 seats, one charter, one act ledger, one clock                   |
| **seat**           | one player's place at a table, fixed order by `ordinal` (0-based)             |
| **charter**        | the 7 clauses this table is arguing over                                      |
| **clause**         | one question on the charter, with exactly 3 **settings**                       |
| **setting**        | one of the 3 answers a clause can take                                        |
| **accord**         | one setting for every clause of the charter — all 7, never a fragment          |
| **charge**         | a seat's secret hand: 4 **aims**                                              |
| **aim**            | (clause, setting, weight) — what a seat wants, and what it is worth            |
| **dread**          | the one aim of weight −3: the setting a seat is paid to prevent                |
| **act**            | one entry in the ledger: an `offer`, an `accept` or a `pass`                   |
| **standing offer** | the accord of the most recent `offer` act                                      |
| **acceptance**     | an `accept` act made after the standing offer was made                         |
| **quorum**         | ⌈n/2⌉+1 acceptances of one standing offer                                     |
| **sworn claim**    | a true, engine-verified aim of your own, published as the price of accepting   |
| **said claim**     | an unverified statement about your own charge, judged in public at the reveal  |
| **binding**        | the moment quorum is reached: the standing offer becomes the accord of record  |
| **settlement**     | the end of the table: every seat scored, every charge and verdict revealed     |
| **impound**        | the other end: the deadline passed with no binding, and every seat scores 0    |
Table states, in order: `open` → `playing` → `settled` | `impounded`.
A table is `open` while seats are empty, `playing` from the moment the last
seat is taken, and ends exactly once, either `settled` or `impounded`.
---
## 2. The fixed numbers
Every number the code needs, named once.
| number                | value                                    |
| --------------------- | ---------------------------------------- |
| seats per table       | **4, 5 or 6** — nothing else             |
| clauses per charter   | **7**, drawn from the pool in §3         |
| settings per clause   | **exactly 3**                            |
| aims per charge       | **4**, on 4 **distinct** clauses         |
| positive aims         | **3**, weights **3 distinct values from {1, 2, 3, 5}** |
| dread                 | **1**, weight **−3**                     |
| score range           | **−3 … 10** (best charge is 2+3+5)       |
| quorum                | **⌈n/2⌉+1** → 3 of 4, 4 of 5, 4 of 6     |
| sworn claims per seat | at most **3** in a whole game (one per positive aim, ever) |
| said claims per act   | at most **3**                            |
| turn window (default) | **6 hours** (`turn_seconds = 21600`)     |
| deadline (default)    | **24 hours** (`deadline_seconds = 86400`) |
| turn window (range)   | 15 minutes … 48 hours                    |
| deadline (range)      | 1 hour … 14 days, and **≥ 2 × turn window** |
| impounded score       | **0** for every seat                     |
The three positive weights of a charge are **distinct**: a seat's positive
aims are worth 1+2+3 = 6, 1+2+5 = 8, 1+3+5 = 9 or 2+3+5 = 10 in total.
Distinct weights mean a sworn weight is information — "she signed for a 5"
says something a table can use.
---
## 3. The charter and the clause pool
A table's charter is **7 clauses drawn from a fixed pool of 12**, each with
exactly 3 settings. The pool is flavour; the mechanics are symmetric across
every clause and every setting. No clause is worth more than another, no
setting is a default, and no setting is good or bad except to the seat whose
charge says so.
The ids are the ids the code stores.
| clause id   | clause          | settings                                            |
| ----------- | --------------- | --------------------------------------------------- |
| `beacon`    | The Beacon      | `kept` · `sold` · `scuttled`                        |
| `hold`      | The Hold        | `opened` · `sealed` · `flooded`                     |
| `ledger`    | The Ledger      | `published` · `redacted` · `burned`                 |
| `pilot`     | The Pilot       | `reinstated` · `paid_off` · `put_ashore`            |
| `name`      | The Name        | `kept` · `changed` · `struck`                       |
| `chart`     | The Chart       | `shared` · `sold` · `locked`                        |
| `salvage`   | The Salvage     | `split_evenly` · `to_the_finders` · `to_the_crown`  |
| `wreck`     | The Wreck       | `raised` · `stripped` · `left`                      |
| `crew`      | The Crew        | `signed_on` · `paid_out` · `turned_loose`           |
| `bond`      | The Bond        | `honoured` · `renegotiated` · `broken`              |
| `anchorage` | The Anchorage   | `held` · `leased` · `abandoned`                     |
| `sounding`  | The Sounding    | `filed` · `amended` · `lost`                        |
The charter and the charges are dealt together from the table's **seed** and
its seat count, and nothing else: the same seed and the same count always
give the same table. The deal must produce a table worth arguing over, and
the code asserts it:
- at least two seats hold aims that cannot both be satisfied — same clause,
  different settings;
- no single accord satisfies every seat's positive aims;
- no two seats are dealt the same charge.
An **accord** names one setting for each of the 7 clauses. An accord missing
a clause, naming a clause outside this charter, naming a setting outside that
clause, or naming a clause twice is not an accord and is refused at the
boundary.
---
## 4. The charge, and what an accord pays
Each seat is dealt a secret **charge**: 4 aims on 4 distinct clauses — three
positive (weights 1/2/3/5, three distinct values) and one **dread** of −3.
An aim is **satisfied** by an accord when the accord sets that aim's clause
to that aim's setting. A dread is **triggered** on the same test.
```
score(charge, accord) = Σ { weight of each satisfied positive aim }
                        − 3 if the dread is triggered
```
That is the whole of scoring. There is no bonus for signing, no penalty for
holding out, and no score for anything said or sworn along the way. A seat
that never acts is scored by the accord exactly like the seat that offered it.
Nobody sees any part of any charge until the table ends — not the host, not
the table, not a guest — except the parts their holders publish themselves as
sworn claims (§6) while the game runs.
---
## 5. The turn
Seats act in a fixed order: **ordinal 0, 1, … n−1, then round again**. After
`k` acts the seat to act is `ordinal = k mod n`. The order never changes and
no seat is ever skipped; a seat that will not play is passed for it by the
clock (§8).
On your turn you take **exactly one act**:
- **offer** an accord. It becomes the **standing offer**, and it **clears
  every acceptance** — including the offerer's own. Sworn claims already made
  are *not* cleared; they are public forever.
- **accept** the standing offer. This costs a truth (§6) and is refused
  outright when you cannot pay it.
- **pass**. Always legal.
Further rules of the turn, each checkable from the ledger:
- There is nothing to accept before the first offer. An acceptance is bound
  to the offer that stands when it is made; an acceptance made before an
  offer never counts for it.
- A seat may accept the standing offer **once**. The offerer may spend a
  later turn of their own accepting their own offer.
- Acts are only legal while the table is `playing`. After settlement or
  impound no act is accepted at any door.
**Any act may carry said claims** (§7) — an offer, an acceptance or a pass.
---
## 6. The sworn: accepting costs a truth
To accept the standing offer you must **cite one of your own positive aims
that this accord satisfies**. The citation is (clause, setting); the engine
checks it against the charge it already holds, and on acceptance the clause,
the setting, its **weight** and your seat become public forever, recorded as
a **sworn claim**.
A sworn claim can never be false: the engine will not write one it cannot
verify.
The three rules that make a signature expensive:
1. **It must be true and satisfied.** The cited aim is a positive aim of your
   own charge, and the standing accord sets that clause to that setting.
   Otherwise the acceptance is refused.
2. **It must be fresh.** A positive aim can be sworn **once in a game**. A
   citation you have already sworn is refused, whatever the accord.
3. **Secrets first.** If the accord satisfies a positive aim of yours that is
   not yet sworn, you must cite one of those. You may choose which, when more
   than one is secret — the cheap truth or the expensive one, and that choice
   is itself a move.
Two consequences, both intended:
- **An accord that satisfies none of your positive aims cannot be accepted by
  you at all.** Not for a favour, not for a promise. The page does not offer
  the button; every other door refuses by name.
- **You have at most three signatures in a game**, one per positive aim. A
  seat whose satisfied aims are all already sworn cannot accept that accord
  either. Honesty is the currency and the purse is finite.
Sworn claims arise *only* from acceptances. There is no way to swear
voluntarily; if you want to tell the table something for free, you say it.
A refusal never leaks. "That is not one of your aims" and "you have a secret
aim this accord satisfies — cite that one" say nothing about any other seat,
and no failure message names an aim the caller does not already hold.
---
## 7. The said: cheap claims, audited in public
Any act may carry up to **3 said claims**. A said claim is structured and
unverified:
```
(clause, setting, worth)      worth ∈ none | small | large | dread
```
The engine validates only its *shape*: the clause is on this charter, the
setting belongs to that clause, the worth is one of the four words, and the
same (clause, setting) appears at most once within one act. It **never**
rejects a said claim for being false. Lying is a legal move, it is cheap, and
it is recorded with your seat's name on it.
Said claims are shown as *said* while the game runs — believed or not as the
table likes — and at settlement **every one of them is marked true or false
in public**, judged against the charge that made it. Nothing else about a
said claim changes anything: it does not score, it does not bind, it does not
substitute for a sworn claim, and saying "large" about an aim does not make
it sworn or make it secret.
The verdict, computed once at settlement. For the stated (clause, setting),
the claiming seat's **true worth** is:
| true worth | when                                                        |
| ---------- | ----------------------------------------------------------- |
| `dread`    | the seat's dread aim is exactly that clause and setting      |
| `large`    | a positive aim of weight **3 or 5** is exactly that pair     |
| `small`    | a positive aim of weight **1 or 2** is exactly that pair     |
| `none`     | the seat holds no aim on that clause *at that setting*        |
A said claim is **true** when its declared worth equals the true worth, and
**false** otherwise. Note the last row: an aim on that clause at a *different*
setting is worth `none` at the setting stated, so "the Ledger redacted is
nothing to me" is true for a seat whose Ledger aim is `published`.
The same said claim may be repeated on later acts. Each is recorded and each
is judged.
---
## 8. The clock
A table plays asynchronously, and the clock is arithmetic on timestamps — no
timer, no background job. Everything below is derived at read time from the
ledger and `now`, and written down when it is derived.
- **The turn window** (default 6h, range 15m–48h) is how long the seat to act
  has. A window that passes unplayed is an **automatic pass**: the engine
  writes a real `pass` act for that seat, marked `lapsed`, and the turn moves
  on. Several windows may lapse at once; each becomes one pass, exactly once.
- **The deadline** (default 24h, range 1h–14d, and never less than two turn
  windows) runs from the moment the table starts playing.
- **The impound.** If the deadline passes with no binding, the table is
  **impounded**: nothing is set, and **every seat scores 0**. Charges, sworn
  claims and the verdict on every said claim are revealed exactly as a binding
  reveals them.
The impound is not a draw. Zero is a fine result for the seat whose dread was
about to be triggered, and a disaster for the seat holding a satisfied 5. The
clock is therefore a bargaining position: running it down is a move that
nobody has to announce.
The game always ends. Every lapsed window produces a pass, and the deadline
ends the table whether or not anyone is still playing.
---
## 9. The binding, the settlement and the reveal
The standing offer **binds the moment acceptances of it reach the quorum** —
⌈n/2⌉+1 seats: 3 of 4, 4 of 5, 4 of 6. Binding is not a vote to be closed and
not a step anyone takes; it happens inside the acceptance that reaches it.
At settlement, in one transaction:
1. The standing offer is stored as the **accord of record**.
2. **Every seat** is scored against it by §4 — accepting or not, present or
   lapsed — and the score is written down. It is a record, not a calculation
   redone on every read.
3. The table becomes `settled`, with the time it settled.
4. No further act is accepted, at any door.
Then **the reveal**, which is the same for a settled table and an impounded
one: every charge in full, every seat's score, the ranking, and every said
claim marked true or false. Sworn claims were already public.
Ranking is by score, highest first. Seats tied on score share the rank and
are shown in seat order. There is no tie-break; a shared win is a shared win.
A settled table keeps this record permanently, readable by anyone who can see
the app — the accord, the scores, who swore what and when, and every claim
with its verdict.
---
## 10. A worked example
A four-seat table. Seed `tidewater`, seats Ash (0), Brail (1), Cleat (2),
Dunnage (3). Quorum is ⌈4/2⌉+1 = **3**.
**The charter** (7 of the 12):
| clause      | settings                                           |
| ----------- | -------------------------------------------------- |
| `beacon`    | kept · sold · scuttled                             |
| `hold`      | opened · sealed · flooded                          |
| `ledger`    | published · redacted · burned                      |
| `pilot`     | reinstated · paid_off · put_ashore                 |
| `name`      | kept · changed · struck                            |
| `chart`     | shared · sold · locked                             |
| `salvage`   | split_evenly · to_the_finders · to_the_crown       |
**The charges** — secret until the reveal. Shown here so the arithmetic can
be checked by hand.
| seat        | +5                        | +3                    | +2                  | +1                        | dread −3                  |
| ----------- | ------------------------- | --------------------- | ------------------- | ------------------------- | ------------------------- |
| Ash (0)     | `salvage=to_the_finders`  | `beacon=kept`         | —                   | `ledger=redacted`         | `pilot=put_ashore`        |
| Brail (1)   | `ledger=published`        | —                     | `hold=opened`       | `name=changed`            | `salvage=to_the_crown`    |
| Cleat (2)   | —                         | `pilot=reinstated`    | `chart=shared`      | `salvage=to_the_finders`  | `beacon=scuttled`         |
| Dunnage (3) | `beacon=kept`             | `hold=sealed`         | `name=kept`         | —                         | `ledger=redacted`         |
Each charge is 4 aims on 4 distinct clauses, with three distinct positive
weights. Brail wants the Ledger `published`; Ash is paid a little for
`redacted` and Dunnage dreads it. Brail wants the Hold `opened`, Dunnage
`sealed`. No accord satisfies everyone.
**The ledger.**
| # | seat    | act    | what                                                                                                   |
| - | ------- | ------ | ------------------------------------------------------------------------------------------------------ |
| 1 | Ash     | offer  | **A₁** = beacon kept · hold sealed · **ledger redacted** · pilot reinstated · **name kept** · chart locked · salvage to_the_finders. Says *(ledger, redacted, small)*. |
| 2 | Brail   | pass   | Says *(ledger, published, large)*.                                                                      |
| 3 | Cleat   | accept | A₁ satisfies his `pilot=reinstated` (3) and `salvage=to_the_finders` (1); both secret, he picks the loud one. **Swears `pilot=reinstated`, weight 3.** |
| 4 | Dunnage | pass   | A₁ would pay him 5+3+2−3 = 7, but he wants the Ledger published. Says *(ledger, redacted, **none**)*.    |
| 5 | Ash     | offer  | **A₂** = beacon kept · hold sealed · **ledger published** · pilot reinstated · **name changed** · chart locked · salvage to_the_finders. She spends her own +1 to buy Brail. This **clears Cleat's acceptance**; his sworn claim stands. |
| 6 | Brail   | accept | A₂ satisfies `ledger=published` (5) and `name=changed` (1), both still secret — *said* is not *sworn*. He cites the cheap one: **swears `name=changed`, weight 1.** |
| 7 | Cleat   | accept | A₂ satisfies `pilot=reinstated` — already sworn, so not citable — and `salvage=to_the_finders`, still secret. Secrets first: **swears `salvage=to_the_finders`, weight 1.** |
| 8 | Dunnage | pass   | A₂ pays him 8 and triggers nothing. He holds out for `name=kept` anyway.                                |
| 9 | Ash     | accept | Her own offer. It satisfies `salvage=to_the_finders` (5) and `beacon=kept` (3), both secret; she cites the cheaper truth: **swears `beacon=kept`, weight 3.** Third acceptance — **quorum. A₂ binds.** |
**The scores**, every seat against A₂:
| seat        | satisfied                                            | dread triggered?                      | score |
| ----------- | ---------------------------------------------------- | ------------------------------------- | ----: |
| Ash (0)     | `salvage=to_the_finders` +5, `beacon=kept` +3; `ledger=redacted` missed | `pilot=put_ashore` — no (reinstated)  | **8** |
| Brail (1)   | `ledger=published` +5, `name=changed` +1; `hold=opened` missed          | `salvage=to_the_crown` — no           | **6** |
| Cleat (2)   | `pilot=reinstated` +3, `salvage=to_the_finders` +1; `chart=shared` missed | `beacon=scuttled` — no                | **4** |
| Dunnage (3) | `beacon=kept` +5, `hold=sealed` +3; `name=kept` missed                  | `ledger=redacted` — no (published)    | **8** |
Ranking: **Ash and Dunnage tied at 8**, Brail 6, Cleat 4. Dunnage never
signed a thing, published nothing about himself, and tied for first — the
accord scores every seat, and holding out is a real strategy that a quorum
can nevertheless settle over.
**The said claims at the reveal:**
| act | seat    | said                          | true worth                                    | verdict   |
| --- | ------- | ----------------------------- | --------------------------------------------- | --------- |
| 1   | Ash     | *(ledger, redacted, small)*   | +1 → `small`                                  | **true**  |
| 2   | Brail   | *(ledger, published, large)*  | +5 → `large`                                  | **true**  |
| 4   | Dunnage | *(ledger, redacted, none)*    | his dread sits exactly there → `dread`        | **false** |
Dunnage's lie worked: it helped move the Ledger to `published`, which is what
his charge needed. It also went on the record, and the table read it, in
public, at the end.
---
## 11. Why this is not a board game you know
The skeleton is borrowed, and honestly: hidden individual agendas settled by
one binding multi-clause vote is the shape of *Junta*'s budget and *The
Republic of Rome*'s senate; negotiating by post over hours with no board
between turns is *Diplomacy*'s; structured lies audited at the end is the
family *Sheriff of Nottingham* and the social-deduction games belong to.
What is not borrowed is the price of a signature. In every game above, talk is
free and a promise is worth whatever the table thinks of you. Here the engine
holds your charge and checks your citation, so **accepting an accord forces
you to publish one true, fresh, specific fact about what you want and what it
is worth to you** — and you only have three such facts to spend. You cannot
buy a seat's signature without making them pay the room in information the
room will use against them in the next offer. Holding out keeps you opaque,
but the quorum can settle without you and the accord scores you anyway, so
silence is not safety. Lying is still available, in the *said* register, cheap
and plentiful — and read out true-or-false in front of everyone at the end.
There is no board, no map, no units, no resources, no rounds and no
turn-by-turn economy. There is a document, a seat order, a clock, and one
moment where the document becomes binding.
---
## 12. What every rule reads
Each rule here is a function of stored state. For implementers, and for the
next issue that wants to add one:
| rule                     | reads                                                        |
| ------------------------ | ------------------------------------------------------------ |
| charter, charges         | seed + seat count (dealt once, stored)                       |
| whose turn               | seat count + count of acts                                   |
| standing offer           | the latest `offer` act                                       |
| acceptances              | `accept` acts after the latest `offer` act                    |
| is this accord legal     | the accord + this table's charter                            |
| may I accept, and citing what | caller's charge + standing offer + caller's sworn claims |
| said claim legal         | the claim's shape + this table's charter                     |
| quorum reached           | seat count + acceptances of the standing offer               |
| score                    | a charge + the accord of record                              |
| said verdict             | a charge + the claim                                         |
| whose window has lapsed  | acts + `turn_seconds` + `now`                                |
| impound                  | `started_at` + `deadline_seconds` + `now` + no binding        |
Nothing here reads a player's intent, a chat log or a human judgement, and
nothing here needs a random number after the deal.
		@@ -2,6 +2,10 @@
2	2
3	3	A negotiation game played over hours: secret goals, public offers, a deal that binds; agents can sit at the table.
4	4
	5	The game is Sworn & Said, and its rules of record — charter, charges,
	6	scoring, the sworn and the said, quorum and the clock — are written once in
	7	[RULES.md](RULES.md).
	8
5	9	This is an app: the forge runs it. Production follows the default branch;
6	10	every open pull gets a preview at its own address with its own copy of the
7	11	data. Everything the app keeps lives under `FORGE_APP_DATA`, which is what