World engine direction — stable boundaries for branch-derived Worlds

# World engine direction — stable boundaries for branch-derived Worlds

Status: **architecture direction, not an implementation contract.** The [World concept contract](../../specs/world/README.md)
owns the product concept. Current runtime truth remains in the code, [Architecture](README.md),
[API principles](API_PRINCIPLES.md), [Persistence](PERSISTENCE.md), and the generated
[MCP manual](../../generated/MCP_MANUAL.md).

This leaf translates World's vision into architectural separations that should survive prototyping. It
does not decide schemas, turn phases, conflict resolution, or deployment topology.

The latest 2026-08-28 refinement makes Scenario the shared decision substrate: it can be played directly
or wrapped inside a seat-shaped live Episode. Together Scenario and Episode cultivate branching stories
and production assets. A sufficiently mature branch may later deploy a semi-permanent World. The
architecture therefore protects origin immutability, perspective authorization, asset lineage, generated
gap provenance, and runtime isolation before it designs touring, persistence, economies, replay, or MMO
delivery. [Founder refinement](../../sources/founder/2026-08-28-founder-scenario-inside-live-episode-world-seeding-2026-08-28.md).

The primary interaction boundary is:

```text
developed Domain / branch coordinate + latent-model lineage + Factory production lineage
→ immutable World origin + versioned configuration
→ inherited areas are reused; generated gaps are marked and constrained
→ tour or runtime receives only perspective-authorized state
→ World history remains distinct from source-branch history
→ replay, persistence, or comparison are optional lifecycle policies
```

Stageplay may project the World origin or runtime history, but XML must never decide that an action occurred
merely because an animation, map token, ledger update, or cutscene played. Episode actions at a branch tip
use Scenario's branch authority path whether Scenario is direct or wrapped; World actions use a distinct
runtime path. Neither silently writes into the other.

## The engine has four distinct things

```text
Domain definition → preserved branch state → World configuration → World runtime history
```

1. **Domain definition** describes the graph-world: System, World, Fate, topology, canon, playable kinds,
   and the material from which mechanics may be configured.
2. **Preserved branch state** is a versioned origin. A World may pin any preserved state, not only a
   branch head. The same state may originate any number of Worlds.
3. **World configuration** declares how this world is played: seats, cadence, tools, permissions,
   context policy, information regime, economies, objectives, evaluation, and lifecycle.
4. **World runtime history** is a later, optional layer that records what happened after stateful play began:
   turns, attributable calls, accepted state changes, information movement, resources, and social
   consequence. The first static-tour World has no runtime history beyond disposable visit state.

These may eventually share storage primitives, but they must not collapse into one object. A configuration
is not history; a played world is not its source branch; a later Domain revision is not permission to
rewrite an instance's past.

The identity model must therefore preserve a one-to-many relation from every branch-state coordinate to
World origins. Scenario lifecycle remains tip-bound: it explores from a branch's active frontier. World
lifecycle is origin-bound: it references an immutable source coordinate; a future stateful configuration
may advance its own runtime history, while the first roadmap proof remains a static tour with live generated
interaction and no state advance. Neither creating nor advancing a World mutates the branch head. This keeps the multiversal map
legible as two coupled structures—a branching possibility tree and many coexisting lived worlds attached
throughout it—without reducing one to the other.

## One canonical world, many situated readings

The World runtime needs a canonical world state, but no seat receives canonical omniscience by default.
The engine must distinguish:

- **truth** — what the canonical World state records;
- **observation** — what an entity could perceive at a time and place;
- **delivery** — what information actually traversed a channel to a seat;
- **memory** — what the seat retained or can retrieve;
- **belief** — how a human or agent interprets what it knows;
- **story** — a perspective-shaped projection of some part of the record.

This separation is the foundation of multi-camera play. Context assembly reads those layers; it never
grants a model the full record merely because doing so is convenient. Stories may render any declared
camera, including an omniscient spectator, but never become a second writer.

## Situation awareness is a query over governed state

The engine should be “aware” of a situation only in a precise, inspectable sense: it can derive the
relevant entities, relationships, locations, chronology, information, resources, permissions, tools,
rules, and open Fate from canonical state for a declared perspective and time. This awareness is a query
and context-assembly capability, not consciousness, a hidden global summary, or permission to expose the
record wholesale.

The implementation should keep the underlying facts typed and queryable so different agents, human
interfaces, narrative views, markets, maps, and world-specific instruments can project the same situation
without inventing parallel state.

## Acting gives entity behaviour a selected interpretation context

Meridians records the ingredients of behaviour, not one final characterization. Passing that raw
continuity directly to every model asks each consumer to invent a new interpretation before it can
respond. **Acting is the first-class context-engineering practice that makes the interpretation explicit.**
The Entity Interpretation contract separates evidence from the selected, time-specific context through
which the entity is performed:

**Evidence is the proxy, not the latent truth.** Canonical state records observations and authored facts;
latent traits, formation, motives, and schemas remain a revisable model of the unknown complexity that may
explain them. This is the entity-level instance of Meridians' general [proxy
principle](../foundations/ALIGNMENT.md#the-proxy-principle). Generation and review preserve competing
explanations rather than silently promoting inference into canon.

```text
FORWARD
perspective projection
→ evidence-backed Entity Interpretation Graph in explicit reason order
→ appraisal through interpretation + knowledge + motives + Frames + Control + state
→ action field of competing pressures, inhibitions, and possibilities
→ Will selects an attributable action
→ expression and consequence

BACKWARD
observed expression and consequence
→ compare several behavioural explanations
→ create a new immutable interpretation without treating manifestation as cause
```

**Formation** is more than a history list. It is how upbringing, culture, education, repeated practice,
institutions, and relationships have shaped attention, values, habits, inhibition, and expressive range.
It both develops latent traits and mediates how they appear. Similar dispositions may therefore produce
different behaviour in differently formed people.

The output is an **action field**, never one inevitable act. Accepted history uses it for explanation and
continuity; Experience uses it during production; human and AI seats use it upstream of the Will boundary.
Only the existing governed action path makes a move history.

The schema is owned by the [Acting and Entity Interpretation spec](../../specs/latent-model/README.md): a
deterministic Entity Evidence Profile feeds an authored or generated, immutable Entity Interpretation
Graph. An attributable binding selects the graph at a branch coordinate; downstream entity context then
uses its explicitly ordered reason nodes and typed edges instead of raw continuity. Canonical evidence is
retained, and current Frames and Control are composed beside the graph. A later `BehaviourReading`
(described extension, not built) can activate that graph against projected knowledge, relationships, state,
capabilities, and constraints.
Counterfactual tests vary formation, knowledge, motive, relationship, or constraint and confirm that the
action field changes while unrelated facets remain stable.

Selection is branch-and-coordinate scoped. A child branch inherits the parent's effective binding until an
explicit evidence-grounded reinterpretation selects another immutable graph; prepared Experiences and
World origins pin the graph ids they used. A Behaviour Reading (described extension, not built) may request semantic expression or motion
coverage, but the directional
[Factory](../../specs/visual-novel/production.md#12-factory--the-production-control-surface) resolves that
request to versioned assets. Neither the graph nor the available art may rewrite the other.

Acting has a recurring review cadence but no autonomous refresh lane. New evidence or a changed situation
may make another strong read valuable; for now a person initiates generation, validates the attributed
graph, and binds it. The engine may report staleness, but it does not decide when to reinterpret an entity
or which new reading should govern performance.

[Vocabulary contract](../vocabulary/substrate.md) ·
[Founder direction](../../sources/founder/2026-09-02-entity-behaviour-model-founder-note.md) ·
[Formation refinement](../../sources/founder/2026-09-02-formation-latent-traits-founder-note.md) ·
[Evidence-proxy contract](../../sources/founder/2026-09-02-evidence-proxy-latent-traits-founder-note.md)
· [Latent graph direction](../../sources/founder/2026-09-02-latent-behaviour-graph-founder-note.md)
· [Entity Interpretation correction](../../sources/founder/2026-09-07-2026-09-07-entity-interpretation-founder-direction.md)
· [Acting as first-class interpretation](../../sources/founder/2026-09-07-acting-first-class-founder-clarification.md)
· [Acting reads and manual cadence](../../sources/founder/2026-09-07-acting-reads-founder-clarification.md)

## Frames and Control answer different questions

The canonical topology carries universal, typed **Frames**. A Frame records how one entity or concept owner reads,
values, or aligns toward one exact target. Its valence may be positive or negative; its direction is
intrinsic, and the reverse direction is a separate Frame. Social attachment, marriage, allegiance,
nationalism, adherence to law or Dao, religion, and devotion to Fate use this common directed
contract before acquiring bespoke stores. Frames may point across World, System, Fate, and Theme, but never grant
authority.

**Unit Control** is a separate power contract. A Unit is either Unbound or fully Controlled by
exactly one selected source. Control has no mode, valence, strength, share, autonomy percentage,
or partial state. It must not be inferred from a Frame or graph proximity: a beloved ruler may lack Control,
a hated ruler may possess it, and an Unbound Unit may still be the target of consequential Frames. If power is
negotiated, partial, or self-authored, the entity should use Character resolution.

Unit-to-Unit Control forms an authority chain rather than a social topology. It must remain
acyclic. Mutual attachment is represented as two directed Frames. A Controller may reference a Character,
Unit, Location, Artifact, System topic, or Fate thread without granting that source a hidden write path.

Generation and extraction must resolve both contracts through the same canonical endpoint registry.
Model placeholders are remapped before validation across Character, Unit, Location, Artifact,
Thread, Theme, and whole-Topic-Tree endpoints; unresolved ids are rejected rather than persisted.
Leaf Topics are addressable once they exist in the committed Topic Tree. A generation transaction that
is only proposing a new Topic path must not invent a future Topic id; it may target the whole Topic Tree,
then use the leaf Topic on a later committed boundary.

Arc scenes and World Expansions record authority transitions as typed `controlDeltas` beside their
`frameDeltas`; replay applies identity-resolution changes first and then the exact Control result at that
entry. Wizard generation establishes initial Unit Control directly. World Expansion's UI and
headless operation expose one positive allow-list over the complete expansion contract—including new
Themes, Theme movement, Frames, and Control changes—and the parser strips every field outside that list.
Downstream Arc generation receives the complete committed expansion brief rather than only its newly
created Characters and Locations.

## Character and Unit are resolutions of agency

Character and Unit should be treated as simulation resolutions, not permanent species or judgments
about intelligence, sentience, morality, scale, or importance. Characters receive high-resolution agency,
memory, attention, and agenda continuity. Units use a lighter resolution and are Unbound or fully
Controlled.

What makes an entity a Unit is that its action **can be authored by a controller** rather than
self-authored. Controllability is the whole criterion, so substrate and scale carry no weight: a model or
software agent, a creature or companion, an NPC mob or crowd, a piece on a board, someone who does not
yet hold their own agency, and a company, institution, or faction all sit at Unit resolution. A Unit
whose ownership is absent, disputed, or undecided is Unbound and remains a Unit; promotion to Character
is a claim about self-authored agency, never a way to record uncertain ownership.

Promotion and demotion preserve the entity's stable identity and log continuity. Frame history,
information, and consequences survive the registry transition; only the agency contract and simulation
resolution change. Frame ownership survives either resolution. Demotion must declare the resulting Unit Control rather than invent it from a
relationship. Promotion removes the obsolete Control dependency without erasing the history that made
the transition meaningful.

## The clock is part of authority

The first World is **not turn-based**: it is pinned to one branch moment, and traversal or conversation does
not advance that moment. If a later World configuration supports stateful activity, it must make wall time,
turn order, fictional time, and active versus resting periods explicit. A scheduler may open or close action
windows, but it does not gain a separate write path. Consequential transitions still pass through the same
attributable mutation authority as manual and agent calls.

Cadence is configuration, not a hardcoded global. The common engine should be able to enforce a schedule
without deciding that every Domain shares one phase choreography.

The world clock and a seat's action rate are separate contracts. Within one cadence, configuration may
grant different entities different tick eligibility, action allocations, cooldowns, queue priority,
concurrency, and tool latency. These rates may be static rules or governed state affected by roles,
locations, artifacts, capabilities, resources, delegation, or prior action.

Rate differences are part of System and therefore versioned, inspectable, and attributable. The runtime
must record when an action became eligible, entered a queue, began, completed, expired, or consumed an
allocation. It must distinguish fictional duration from compute latency and scheduler delay; otherwise
infrastructure accidents become hidden game mechanics. Where rate can be acquired or exchanged, it is an
economic resource subject to the same permissions and history as any other capability.

## MCP is the Will boundary

For both humans and agents, Will becomes concrete as a typed MCP tool call. Natural language and manual
controls are input modes around the same capability boundary.

The runtime sequence remains conceptually:

```text
intrinsic state + situated context + Frames + Control + System/Fate pressure + Will
→ available affordances → chosen call → permission/rule gate → state transition → history
```

Agent prompts may shape personality, knowledge, and choice, but prompts do not become authority. A tool is
available only when the seat, World, Domain rules, and current turn permit it. The record attributes the
call to the human, agent, delegation, seat, tool, and turn that produced it.

The shared requirement is enough typed evidence to explain which Frames, Control state, pressures, and
knowledge informed an attempted action; a model's fluent rationale is not a substitute for that record.

## Information propagation is a first-class transition

Information must not be reconstructed later from prose. An event can create information objects or
observations that then travel through typed topology under a declared communication regime.

Propagation may depend on level, distance, routes, relationships, institutions, artifacts, technology,
reach, latency, fidelity, credibility, secrecy, decay, and discoverability. These are Domain mechanics,
but their results belong in canonical runtime history so later context can explain why one seat knew
something and another did not.

The information economy emerges from this boundary: access and timing alter available action. It is not a
score painted over globally shared context.

## World injection uses the same authority as play

External events, licensed-canon additions, synthetic developments, and frontier expansion must enter as
governed proposals or typed events. An injection names provenance and authority, passes through the same
rule and mutation boundary as play, and creates information that propagates according to the Domain's
regime. It cannot mutate a hidden world store, silently rewrite history, or make injected knowledge common
to every seat.

This keeps an expanding world open to reality and generation without giving either a privileged second
writer. Whether an injection is scheduled, human-authored, researched, generated, or triggered by play is
metadata on the event—not a different truth path.

## Tool ecology is society infrastructure

A World configuration does not merely expose one generic catalog of actions. It declares a tool ecology:
which capabilities exist, which seats can reach them, their permissions and costs, the information or
resources they require, and how they compose. Communication, trade, transport, custody, production,
surveillance, governance, and world-specific tools may distribute power as strongly as an economy does.

Tool distribution is therefore part of System and versioned game configuration. Agent prompts may affect
how a seat chooses among tools, but they must not silently create capabilities or authority absent from
the ecology. Changing a tool or its distribution is an intervention in the society, not prompt tuning.

## Economies are governed state, not a special writer

Artifacts, resources, money, ownership, reputation, access, computation, and capability may be optional
modules or Domain-specific mechanics. Whatever their representation, acquisition and transfer are normal
world transitions subject to rules, permissions, attribution, and history.

The kernel should model scarcity, access, transformation, custody, and transferability before assuming a
currency. Barter, money, credit, auctions, production, labor, reputation exchange, or no market at all can
then be Domain modules over those primitives. Information participates in an economy when exclusivity,
freshness, credibility, or timing changes what a seat can do—not because it has been assigned a price.

An external-value bridge would be a separate governed boundary. It must never be smuggled into the base
economy model or used to imply that a fictional World predicts, verifies, or controls a real market.

## Collectives emerge before they become entities

The base engine should first express a household, guild, religion, company, army, or nation as a stable
formation of Frames, coordinated Control, information boundaries, pooled resources, common System
commitments, and shared tools. This tests whether the universal graph really is expressive and avoids a
parallel Faction topology.

A Domain may still promote a collective into a first-class playable entity when it needs its own durable
memory, custody, permissions, or agency. That promotion should name what cannot be derived from the
formation and continue to use the same Frames, information, resource, and authority contracts.

## Domain mechanics extend the engine; they do not fork authority

Presets should cover common game shapes. A custom Domain engine may eventually supply rule evaluation,
special actions, propagation behavior, economy logic, or scoring. The extension point must return or
authorize typed transitions through the common record rather than persist private shadow state.

The invariant is one world authority with programmable mechanics—not a central engine plus an
incompatible database hidden inside each Domain.

## Scenario and World share substrate, not lifecycle

Scenario develops possibility at a branch tip. World inhabits a pinned origin anywhere in preserved branch
history and accumulates
plural history. They may reuse graph, context, resolver, action, and projection primitives, but neither
should be implemented as a cosmetic mode flag over assumptions belonging only to the other.

Promotion between them is explicit. A Scenario may prepare a World origin; a World history may become
input to reflection or later world-building. Neither direction silently promotes played output into
Domain canon.

They also expose different future learning interfaces. Scenario can produce bounded episodes from a pinned
situation: inject Will, render narrative consequence, and compare alternate branches. World can produce
continuing multi-agent trajectories in which actions alter later information, incentives, relationships,
institutions, and affordances. Training infrastructure may share state, action, provenance, and evaluation
contracts without pretending the episodic and persistent environments have the same lifecycle.

## Experience modes share an event envelope, not authority

A later World may expose the same situation through several runtime modes: an abstract graph, a card-like
Scenario passage, text-led roleplay, a continuously inhabited sprite scene, a tactical or economic
instrument, or a directed audiovisual set-piece. These are projections and interaction adapters around
one World, not sibling stores. Every transition must preserve a common envelope naming at least the World,
its pinned origin and current revision, the triggering event or command, the situated viewer, the
information permitted to that view, the active control posture, and—when control is temporarily seized—the
return target.

```text
Scenario card / graph mandate / context injection
                         ↓ attributed proposal or event
World rules + permissions + information + canonical transition
                         ↓ perspective-safe event envelope
abstract view ↔ live sprite presence ↔ directed set-piece ↔ fixed Episode projection
```

The adapters may vary input affordances, camera, pacing, framing, and audiovisual grammar. They may not
reinterpret a camera cut as a state transition, let XML approve a tool call, leak facts across
perspectives, or resume live control against a different implicit scene state. Capital-S Stageplay remains
the fixed Episode producer today. A later responsive orchestrator may reuse its proven scene grammar only
after the event and control-transfer boundary is explicit.

Scalability comes from separating reusable definitions from runtime instances, attaching small typed
capabilities, using stable resource identities, and making lifecycle and execution space explicit. It does
not come from placing all possible World behavior in one scene object or one universal mode state machine.

## Migration preserves ancestry

A World may pause, resume, conclude, fork, migrate, or upgrade. Migration is a declared transition from
one compatible basis to another, with an inspectable account of source revision, target revision,
transformations, unresolved incompatibilities, and resulting lineage.

Migration must preserve the ability to answer: which world did this begin from, which rules governed each
turn, and when did those rules or source assumptions change?

## Evaluation is a projection with declared scope

Live and posthoc metrics read the world and its history. They do not acquire authority to rewrite it. Each
evaluation names its World, ruleset, perspective, interval, measure, and limits. Domain-specific scores
may guide play; Fate may organize open consequence; neither becomes a universal verdict on an actor or
intelligence.

## Analyzability requires an experimental record

Emergent behavior cannot be inferred responsibly from a narrative recap alone. The kept history must make
it possible to reconstruct the conditions under which a choice occurred, including:

- the seat's delivered information, retained memory, context, resources, location, and available tools;
- the human, agent, delegation, prompt or policy, authority, and tool version behind the call;
- accepted, rejected, deferred, and transformed calls and the rules that produced each result;
- state, resource, ownership, reputation, status, relationship, and location transitions;
- communication and information-propagation paths, topology snapshots, institutional changes, and
  governed event injections;
- the World configuration and any intervention or migration active for that interval.

That record supports replay, counterfactual forks, comparisons between controlled variants, and posthoc
analysis. Without it World may still produce compelling fiction; it does not yet provide a trustworthy
environment for studying how tools, information, economies, or institutions influenced behavior.

Any non-fiction-derived World remains a bounded synthetic experiment. Analysis describes behavior under
its declared model and conditions unless a separate method validates the finding against external data.

## Training environments preserve the learning conditions

A future World may act as a reinforcement-learning environment for one agent or many cohorts. Its graph
provides traversable state; its information regime supplies partial observation; its tool ecology defines
the action space; System supplies transition rules; resources and economies create incentives; Frames and
Control create social structure; Fate keeps long-horizon questions open; and the event log supplies
attributable trajectories.

Training must not collapse the world into an unscoped reward. A curriculum or reward names its World,
task, perspective, interval, intervention, and limits. Cohort comparison requires pinned origins and
versioned policies, tools, prompts, contexts, rules, and evaluators so an apparent improvement can be
traced to the condition that changed.

Success in a simulated World establishes performance under that declared environment only. Claims that
training improves real societal performance require an explicit transfer boundary: external tasks,
independent evaluation, safety and distribution-shift analysis, and evidence from the real environment.
The simulation can produce candidates for better policy; it cannot certify its own transfer. For people,
that certification is the externally run proof programme in
[strategy 12](../product/strategy/12-the-practice-monopoly.md#the-proof-programme) — a pre-registered
transfer study with an external measure — not anything the world reads about itself.

## The smallest architectural proof

The first vertical slice should prove inheritance and authority using the Episode 006 story coordinate:

1. pin the council scene's exact Domain, branch, revision, cast, information, resources, rules, and open Fate;
2. inherit the council location, cast, maps, and props with exact semantic and production lineage;
3. generate one previously unstaged connective area under explicit ontology and style constraints;
4. label inherited and generated material so neither can masquerade as the other;
5. expose a tour or bounded activity through perspective-authorized context;
6. keep World state, information movement, and history isolated from the source branch;
7. project the experience through Stageplay or another lens without granting it write authority;
8. preserve enough origin state that later replay or persistence experiments remain possible.

If this slice requires presentation-owned truth, omniscient context, prose-parsed state, shared mutable run
state, or silent branch mutation, the architecture is wrong even if the demonstration looks convincing.
Only after this proof reveals a distinct value should the design settle replay, persistence, lobbies, finance,
organizing, multi-World portfolios, or MMO-scale populations.

## Deliberately not decided here

- World schemas and storage layout;
- universal turn phases or simultaneous-action resolution;
- agent memory and context-selection algorithms;
- Domain-specific action selection and conflict resolution;
- Character/Unit promotion and demotion policy beyond continuity requirements;
- the Domain extension API;
- economy and scoring implementations;
- Hosted topology for shared play;
- migration algorithms;
- external-value systems;
- training curricula, reward models, cohort protocols, and transfer evaluation;
- the first preset and UI.

Those decisions require the playable proof. The boundaries above exist so that experimentation can change
mechanics without changing what the world is or where its truth lives.

Raw Markdown source