feat: integrate regional caravan persistence

docs/FEATURE_REGIONAL_SIMULATION_AND_PERSISTENCE.md

@@ -2,9 +2,9 @@
 
 The regional package is the scale foundation for one authority spanning
 settlements, routes, caravans, named people, aggregate cohorts, and polities.
-It is intentionally additive: the current Jajce `SimulationManager` remains
-the playable local facade while the regional contracts prove deterministic
-unloaded work and conservation in isolation.
+The production `SimulationManager` now owns a bounded regional facade for one
+inbound Jajce route, while the broader regional contracts continue to prove
+deterministic unloaded work and conservation before wider integration.
 
 ## Regional record model
 
@@ -63,6 +63,12 @@ no partial mutation. `to_dictionary()`, `from_dictionary()`, and `checksum()`
 provide deterministic save/restore. The test runs always-loaded, never-loaded,
 and load/unload presentation modes through the same authoritative service.
 
+`RegionalSimulationFacade` is the first production consumer. It owns one
+authored Travnik-to-Jajce route, advances before each committed local tick, and
+exposes one bounded delivery command. The cargo is a separate catalogued
+`regional_trade_goods` item with no local storage tag, so this proof does not
+shadow or duplicate the pantry and woodpile economy.
+
 ## Chunked persistence
 
 `RegionalChunkedPersistence` captures the service into a manifest plus fixed
@@ -89,11 +95,20 @@ primitive-tree bounds.
 
 ## Current integration boundary
 
-The regional package is not yet the production authority for `main.tscn`:
+`main.tscn` now advances the regional facade and `SaveSlotStore` writes a
+combined `SimulationSaveManifest` containing the unchanged local v16 record
+and canonical regional envelope. Both checksums plus world, seed, location,
+and tick alignment are validated before either authority is restored. Raw
+local v16 slots remain compatible and create an idle regional facade;
+explicit non-Jajce adapter scopes keep writing local v16 until they have a
+matching regional facade. Those scopes cannot dispatch a Jajce delivery, and
+local-only saving fails closed if regional state is no longer reconstructibly
+idle.
 
-- Jajce local saves still use `SaveSlotStore` and `SimulationStateRecord` v16;
-- `RegionalCaravanService` is a complete isolated transfer proof, not the live
-  economy's 20-trade scheduler;
+The remaining boundary is intentionally narrow:
+
+- the facade has one callable inbound route, not the live economy's 20-trade
+  market scheduler;
 - event retention/rollups and regional chunk files are not yet one integrated
   long-horizon save transaction;
 - loaded/unloaded local NPC travel still has the old active-visual boundary;
@@ -101,8 +116,8 @@ The regional package is not yet the production authority for `main.tscn`:
   aggregate conflict remain planned.
 
 Do not create one `SimulationManager` per settlement or caravan. The next
-production step is an explicit regional facade that delegates to these records
-and services, while the active adapter presents only a bounded relevant context.
+production step is to publish retained raw events, daily rollups, and chunked
+regional history as one atomic, lazily loaded transaction behind the facade.
 
 ## Scale evidence