D-10 — Wider Scenario Designs: Anatomy, Adaptive Lessons and Completeness (developer)

Scope: Developer companion to the wider scenario set — the anatomy shared across the six playbook families, event-sourcing adaptive lessons, help-desk and traffic design patterns, a completeness recipe for new scenario families, and the safety invariants every new scenario must repeat. Status: as of 2026-11-09 Blueprint sources: Fragment family dossiers for community-life, facilities, housing, public-property, property-compliance, reflex and starter packs; playbook-designs and architecture guides and playbook registry in docs/platform-map/jijibora/; event-sourcing rule examples and community ticket scenario pack referenced by the dossiers.

What this means for you

You build new wider scenarios by copying the anatomy, not by inventing a new runner, bus or schema: a reflex rule for one-shot sense-to-notice reactions, a scenario pack for ordered stages with human gates, and a rule family that groups siblings under shared lookup values — all consuming the standard criteria subjects and emitting the standard fired notice with causation inherited (source: community-life dossier, "Wiring" — one criteria-subject in, one standard fired notice out, bounded depth, terminal-only; source: playbook-designs companion, "How to build the next playbook" — reuse the spine, copy the rule shape exactly).

Details

The six families live as design dossiers alongside their declared configs — each dossier carries purpose, wiring, guardrails, groundedness, review state, and a per-scenario playbook dossier entry (what it does in the city, how it seeds into runtime, what success versus failure looks like, a sample shape, and how to author the sibling variant) (source: facilities dossier, "Playbook dossier" — dossier coverage pattern; source: housing dossier, "Playbook dossier" — same coverage pattern; source: public-property dossier, "Playbook dossier" — same coverage pattern). Keep that dossier structure for every new family; it is what makes a family reviewable before it is seeded.

1. Anatomy theme — reflex rule versus scenario pack versus rule family

Reflex rule (one-shot reaction). Use a reflex rule when one input state should produce one standard notice and nothing else — advisories, proposals, pattern-case openings, and drafts only (source: community-life dossier, "Purpose" — non-consequential actuation; source: reflex dossier, "Purpose" — one criteria-subject in, one standard fired notice out, bounded depth, terminal-only actuation). Copy the shape exactly: identity and version, enablement, runtime chain, pipeline stage and terminal marker, ingress streams with filters, evaluation keying, outputs on match, and side effects that name the terminal owner (source: playbook-designs companion, "How to build the next playbook" — fields to copy). Sibling variants change identity, ingress and emitted notice only, and keep thresholds as lookup values (source: reflex dossier, "Playbook dossier" — sibling variant recipe). Scenario pack (ordered stages with gates). Use a scenario pack when a case must pass ordered stages and human gates — open to inspect to score to remedy to close, or the seven-stage fire, accessibility and hygiene chain ending in expert sign-off, certificate and packet (source: facilities dossier, "Wiring" — seven-stage inspection chain; source: public-property dossier, "Wiring" — six-stage inspection cycle). Packs carry stage order, entity binding by alias with resolve-or-refuse, required policy references by key, intake and service-clock binding, advisory-only intelligence hooks, a validate-only practice posture with zero live rows, and refuse-when-unbound behaviour that never reports practice as live (source: property-compliance dossier, "Groundedness" — pack shape and conventions; source: public-property dossier, "Dev notes" — practice mode with zero writes, never reported as live). Rule family (grouped siblings under shared values). Group reflex siblings into a family when they share lookup keys, guardrail wording, and review discipline — community-life groups intake, ladder, zone, traffic and boards; facilities groups tenancy, rounds and inspections; housing groups queue, options and relief (source: community-life dossier, "Filesystem" — five siblings under one family guide; source: facilities dossier, "Files" — three siblings under one guide; source: housing dossier, "Files" — three siblings under one guide). A family is not an offer or bundle identity: bundle naming stays provisional until registered, and no family mints its own registered identity (source: facilities dossier, "Purpose" — provisional bundle naming, registration pending; source: housing dossier, "Purpose" — same discipline). Keep services resolving by alias against existing entities — no bespoke registers, no new identities (source: facilities dossier, "Guardrails" — spaces resolve or refuse; source: housing dossier, "Guardrails" — same discipline).

2. Event-sourcing adaptive lessons — consume, negative detection and the pattern probe

The consume notion inside scenario packs. Treat consumption as a declared contract: a pack declares what it consumes and emits, with each consumption naming its subject, entity filter and keying — never an open catch-all feed (source: playbook-designs companion, "Design contracts" — consumed to logic to emitted to guards; source: environmental-ops companion, "Subscribing ops" — subscribe each family under its own subject family). Packs that render upstream verdicts consume them as gates and never recompute or invent their own fill, route or savings figure (source: public-property dossier, "Sourcing / Solving / Optimizing / Sentinels" — upstream verdicts are gates it renders). Negative detection reflex. Add a reflex whose job is to not act: it refuses when its signals are unquantified, its references ambiguous, its evidence unresolvable, or its required human approval missing, and the refusal itself is the recorded outcome (source: community-life dossier, "Guardrails" — pattern case only when signals quantified; source: facilities dossier, "Guardrails" — missing evidence or ambiguous resolve refuses). Keep a negative-detection reflex next to every positive one so silence is distinguished from refusal in the audit trail. The pattern probe. Route pattern detection as a probe with fused thresholds: a values-only count on the same block or corridor inside a window opens a pattern case and a systemic signal, raises a sourcing requirement for crewing and routing, and actuates only at its terminal — it never fines, pays or closes a resident alone (source: public-property dossier, "Wiring" — values-only detector to pattern case to sourcing requirement; source: public-property dossier, "Guardrails" — opens a pattern case and systemic signal only, never an auto-fine). Reuse the same probe shape for traffic corridors: count plus corridor plus timestamps plus severity evidence, pattern case plus advisories, no road restriction from the probe (source: community-life dossier, "Guardrails" — quantified signals).

3. Complaints and help-desk design patterns

Auto-route finders. Intake becomes a finder, not a decider: free-text or messaging-channel intake is classified into a desk category, then held for a human grader to confirm inside the service window — classification without confirmation never assigns (source: community-life dossier, "Wiring" — intake to classify to desk-category proposal to manual grader confirm within service window). Keep the category list small and declared; keep the grader confirmation as the gate the finder cannot pass alone. Grader capabilities. Model grader confirmation as a capability the intake path does not hold: the intake agent cannot close their own ticket, a resolver cannot approve their own close, and close-out needs a triage note as evidence (source: community-life dossier, "Guardrails" — intake agent cannot also close; source: reflex dossier, "Guardrails" — resolver cannot approve own close). Design grader roles as separate lookup-bound capabilities so the separation is enforced by the gate, not by convention. Ticket terminality. All commands come only from the terminal stage; non-terminal stages emit criteria only (source: playbook-designs companion, "How to build the next playbook" — non-terminal stages emit criteria only; source: reflex dossier, "Guardrails" — terminal-only commands). Terminality is what makes a ticket's close a named human act rather than a collector's summary. Reopen. Design reopen as a re-entry through the same finder and ladder with a fresh evidence note — never an edit to history. Keep the reopen band widths as lookup values; they are UNKNOWN in the fragments and must be declared before the reopen path is wired (source: community-life dossier, "Wiring" — evidence-required close-out; specific bands UNKNOWN per this companion's operations section).

4. Traffic corridor design calls — fused sources, expiry-aware design

Fused sources. Fuse the corridor view from incident reports, geo-position deltas on entity state, and closed-work telemetry — each as its own scrubbed-facet stream — and match on shared facets only; sealed content never enters the match (source: public-property dossier, "Sourcing / Solving / Optimizing / Sentinels" — sentinel family fuses complaint, geo, closed-work and payment telemetry; source: playbook-designs companion, "Design contracts" — sealed content never in match). Jam-measure and signal-flow advisories are fused outputs, not single-source facts (source: community-life dossier, "Wiring" — pattern case to jam-measure and signal-flow advisories). Expiry-aware design. Give every probe and round an explicit horizon: rounds carry a cadence value and reschedule misses by the same guard; pattern windows carry a duration value while the count threshold stays declared; certificate and ceiling effects carry expiry where the source evidences one (source: public-property dossier, "Wiring" — missed round reschedules by the same guard; source: community-life dossier, "Guardrails" — count asserted, durations lookup values; source: environmental-ops companion, "SOS and escalation business rules" — expiry attached to overrides). Never let a probe act past its window held on stale state; refuse when the tick clock does not resolve (source: facilities dossier, "Wiring" — refuses when the tick clock does not resolve; source: public-property dossier, "Wiring" — missed round reschedules, never silently dropped). Deferred capabilities. Keep deferred capabilities deferred: where a preferred dispatch capability is not yet invoked, Soft uses the routing capability and consumes it as a gate — never invent a verdict for the deferred path (source: public-property dossier, "Sourcing / Solving / Optimizing / Sentinels" — preferred dispatch deferred, routing used in practice mode).

5. Entire-document completeness checker — is a new family complete?

Verify a new family as a whole, not file by file. Run this recipe and refuse to seed until every step is green:

Parse. Each config must parse as valid data, carry its bundle of identity fields (schema reference, kind, version, brief), and use only conventional scenario identities — no invented offer or bundle identities (source: facilities dossier, "Review state" — validated by parse plus identity-field presence plus conventional identity naming).
Compile condensed to JSON values. Condense every declared value — bands, service clocks, evidence lists, cadences, weights, rosters — into lookup values referenced by key only; the scenario docs themselves reproduce no numbers, and any number found in a doc is a defect (source: facilities dossier, "Wiring" — lookup keys referenced, not duplicated; numbers never reproduced; source: housing dossier, "Wiring" — same discipline).
Dry-run. Run a validate-only practice dry-run of each scenario pack: validation plus plan with zero live rows, and confirm practice is never reported as live (source: facilities dossier, "Review state" — practice apply validates with zero writes; source: public-property dossier, "Dev notes" — practice never reported as live).
Soft-apply. Soft-apply each pack and each reflex; confirm refusals occur for every unbound or ambiguous input named in its guardrails, and that no file declares itself live (source: community-life dossier, "Guardrails" — source-trigger refuse semantics; source: facilities dossier, "Guardrails" — a pack cannot declare itself live).
Ready. A family is ready when its dossier mirrors the six-family shape — purpose, wiring, guardrails, groundedness, review state, file summary, playbook dossier per scenario with success-versus-failure, sample shape and sibling recipe — and its unknowns are each marked UNKNOWN with a bind-at-wiring-time note (source: facilities dossier, "Groundedness" — nothing beyond sources asserted, silent values marked UNKNOWN; source: property-compliance dossier, "Playbook dossier" — per-scenario dossier coverage).

6. Built-in safety invariants — repeated in every new family

Repeat these verbatim in every new family — they come from the dossiers and are the non-negotiables:

Fail closed everywhere. Unknown or ambiguous references, missing registrations, missing evidence, missing separation-of-duties or bands, missing intake maps, empty verdicts, or unbound criteria refuse (source: facilities dossier, "Guardrails" — fail closed; source: housing dossier, "Guardrails" — same list; source: property-compliance dossier, "Guardrails" — same discipline).
References resolve or refuse. Spaces, dwellings, parcels and buildings resolve by alias; zero or multiple resolves refuse, and no instance is invented (source: facilities dossier, "Guardrails" — spaces resolve or refuse; source: property-compliance dossier, "Guardrails" — parcels resolve or refuse).
Child cannot widen parent. Child states, sub-notices, relief placements and review branches inherit the parent ceiling and may only tighten it (source: facilities dossier, "Guardrails" — child states do not widen parent limits; source: housing dossier, "Guardrails" — relief child inherits parent ceiling; source: reflex dossier, "Guardrails" — same rule).
Terminal-only, non-consequential by default. Commands only from the terminal stage; reflexes advise, propose, notice, open cases, and draft — consequential effects need a named human owner (source: community-life dossier, "Guardrails" — every auto-actuation is non-consequential; source: playbook-designs companion, "How to build the next playbook" — terminal-only side effects).
Separation, evidence and quorum before effect. The intake agent cannot close their own ticket, the inspecting worker cannot sign their own inspection, close-out needs evidence, disputed reviews need quorum, and certificates need every receipt (source: community-life dossier, "Guardrails" — separation and evidence at close-out; source: facilities dossier, "Guardrails" — no self-approval, no self-certification).
No fines, no payouts, no public leaks. No reflex fines, pays, closes or settles alone; no personal or sealed content in public tiers; auto-enrolment and auto-charge do not exist in the housing family (source: community-life dossier, "Guardrails" — no fines or payouts from reflexes; source: public-property dossier, "Guardrails" — scrubbed fields only, sealed never in match; source: housing dossier, "Guardrails" — no forced upsell).
Practice before production, values before code. Land in practice mode, never declare live, read bands and clocks from lookup values, and change thresholds declaratively without code (source: public-property dossier, "Dev notes" — practice mode; source: facilities dossier, "Guardrails" — thresholds change declaratively without code).

Open items / gaps

All wider families in this set remain Soft drafts — declared only, not seeded or live; seeding is a separate act (source: community-life dossier, "Review status"; source: facilities dossier, "Review state"; source: housing dossier, "Review state").
Provisional stream and event names in the facilities, housing and property-compliance families are pending registration; canonical subject keys and output keys bind at wiring time (source: facilities dossier, "Purpose"; source: housing dossier, "Purpose").
Checklists, cover formats, cadences, rosters, band sets, weights, quorum text, shelter inventories, pricing comparables, and intake-map keys are UNKNOWN until bound as lookup values (source: facilities dossier, "Review state"; source: housing dossier, "Review state"; source: property-compliance dossier, "Review state").
Whether witnesses combine by quorum or by multi-witness sealing alone is UNKNOWN in the fragments and must be declared before complaint-mode wiring (source: property-compliance dossier, "Wiring" — disputed review needs quorum, quorum text UNKNOWN).