REL-HUM-RMS: Human ↔ Room

Stable ID: REL-HUM-RMS
Entities: HUM (Human) ↔ RMS (Room)
Relationship status: implemented

Audited relationship

Human Room membership through user-kind Actors is current.

Design

Humans are in Rooms via their per-Server Actor. Cardinality is M:N transitive: one Human may join private, family, and team Rooms; one Room may contain many Humans. The direct edge materializes through Actor: a Human in Room R on Server S is represented by the corresponding user-kind Actor in room_members.

This edge is load-bearing: it is the structural source of Namespace access under the canonical model (REL-NSP-RMS, REL-HUM-NSP). Every Namespace a Human can see is derived from the Room where the turn occurs via the effective audience subset rule:

H*(R) =
 H(R) ∪ {cosmos} when R's top-level Namespace boundary is public
 H(R) otherwise

accessible(R) = { Namespace(R') : H*(R') ⊇ H*(R) }

cosmos is virtual authorization state, never an Actor or Room member. Room membership is therefore simultaneously "who's at the conversation" and "what memory scope this Human brings into the turn," while a public Room adds the structural rule that it cannot hydrate a private Namespace.

Implementation

Transitive. See REL-ACT-RMS and REL-ACT-HUM. The subset rule over H*(R') ⊇ H*(currentRoom) is the key policy. Storage keeps only real Humans in the GIN-indexed rooms.human_actor_ids uuid[]; the public cosmos boundary is derived from the top-level kind='open' Room that owns the Namespace.

Scope narrows as the conversation widens. A fact written in a wider family Room surfaces in a qualifying smaller private Room; a fact written while alone in that private Room does not surface in the wider family Room. A qualifying private Room may read public knowledge, and a smaller public Room may read a larger public Room, but no public Room reads private knowledge because the private candidate lacks cosmos. Writes always target the current Room's Namespace alone.

Verification state

This article remains at the original relationship granularity for AI and maintainer use. Its current-versus-target classification was reconciled before migration; public code-anchor verification remains in progress against Nautilo 4b3ea604.