Characters SDK

01 Quickstart

A character who holds a grudge, in one manifest entry

A level ships one verb manifest — a JSON file listing the verbs its characters can use, the rules they obey, and any per-character narrowing. Lucan, the shopkeeper who holds a grudge, is one entry in it:

// riverwood.manifest.json — one file per level
{
  "manifest": 1, "vocabulary": "town-1", "world": "skyrim-riverwood", "level": "riverwood",
  "verbs": [ { "name": "report" }, { "name": "refuse_service" }, { "name": "confront" }, /* … the level's set */ ],
  "never": [ { "verb": "confront", "when": "target.isChild", "name": "no-confronting-children" } ],
  "characters": {
    "Lucan Valerius": { "can": ["greet", "serve", "warn", "report", "refuse_service", "watch", "gratitude", "say"] }
  }
}

Tell him what happened — in your own words — through the perception door (§⁠08), and he decides from there. Walk away, come back later, and he won't trade with you: his plan's next step is refuse_service, said aloud, and the receipt (§⁠15) points at the theft. Nothing about that reaction is scripted, and there is no quest, flag, or timer behind it.

02 What a character is made of

Three things you author · everything else is computed · the manifest is the contract

The manifest

can and never are not settings inside the brain; they are one file per level, in MCP tool-declaration shape (VERB_MANIFEST_DESIGN.md). Each verb names the engine action it maps to and whether it speaks:

{ "name": "report",   "engine": "navigate-to", "speaks": true,  "description": "Go to the guard (or a friend) and tell them." },
{ "name": "watch",    "engine": "guard",       "speaks": false, "tags": ["hold"] }

The vocabulary the brain speaks today is town-1: 27 verbs, from the reflex bodies (greet, serve, warn, investigate, flee, confront, call_help, claim_task, resume_task, complain, demand, guard_player, go_station) through the planner's (report, refuse_service, watch, avoid, gratitude, seek_station, buy_from, ask_friend) to the bodies only you or a scene can invoke (lead, sit, eat, lean, sandbox, say). A level lists the subset it has; a manifest naming a verb outside the vocabulary is rejected at load, with the reason.

Per-character can only narrows. A character's list must be a subset of the level's; an entry that widens it is a load error, not a silent grant. Keys are case-insensitive, and an entry may carry the engine's stable handle so renames don't lose the character.

The archetype rule, exactly. If you write a can list, it is the law — the archetype has no say. If you write none, a default is filled in from the character's archetype (a child does not confront; a drifter does not report), and the never report (§⁠18) names that default so you can see what was assumed.

never rules are filters, evaluated over four namespaces. self. is the character's own state, a stable, versioned list: armed_close, was_hit, is_guard, is_child, is_elder, has_command, in_own_place, accompanying, unmet_need. target. is who the verb is aimed at: isChild, isGuard, isPlayer, name, klass, relation. slice. is the time of day the level declares. place. is the level's own tags, which is where a rule stops being about one town — see below. The grammar is and, or, not, parentheses and comparisons — nothing else, and nothing internal to the brain is reachable from a rule. A field your feed does not supply evaluates the whole rule to false: a rule can never fire on a guess.

Places, by type

A place tag matches three ways, and you will almost always want the first:

"places": {
  "temple": { "loctypes": ["temple"] },      // every temple in the game, in one line
  "street": { "default": true }
}

That is the whole difference between a rule about one shrine and a rule about worship. In the Skyrim adapter the types come from the engine's own location keywords, read once whenever the player changes place.

interior and exterior are built in: every place carries one, and a rule may use them without declaring anything. They also close the obvious hole. The default tag is the outdoor fallback, so it never swallows an interior your engine failed to type: an unnamed cave is interior, not street.

Events, in your words

The gate reads meaning, so a theft phrased with none of our words is still a theft. But your world has events of its own — a tithe, a forge test, a bell — that only you can class. The manifest's events section is consulted before the gate and before the importance rules, so the game's word on its own events is final:

"events": {
  "ambient": ["the forge test-fires", "the bell rings for prayers"],   // the world, never a wrong
  "theft":   ["skimmed the till", "the captain's tithe"],              // a theft in this world
  "importance": { "weapon": 0, "theft": 8 }                            // re-weigh a word, or a class
}

Phrases are case-insensitive substrings of the journal line. A listed phrase is stamped its class at the class's band (theft 9, attack 9, threat 8, debt 7, amends 7, gift 6, slight 5, need 5, ambient 2) unless importance names the class. A word under importance replaces the built-in weight for that word — {"weapon": 0} makes a weapon rack furniture, so the smithy stops spiking. Classes are the nine the brain knows; anything else is a load error, and every phrase is one you can grep for. When you find yourself adding a fifth phrasing of the same thing, that is a gate retrain (§⁠17), not a longer list.

How much ground the gate covers. Wording is free: the gate classes a sentence by its meaning, so "skimmed the till", "made away with my purse" and "that one pocketed my knife" are all thefts without anyone listing them (the batteries prove it with twins: two phrasings, one class, one plan). The boundary is the nine classes, and nearly every wrong a game produces lands in one of them: trespass is a threat or a slight, cheating at cards a theft or a slight, insulting the temple a slight. The rare sentence outside them is stamped other, still wakes the character, and is captured; the next gate retrain sharpens that boundary. A retrain buys a sharper class, never the reaction itself, which the character has either way.

Speech, for this level

The talk lane is a mouth, not a memory. Whatever model phrases a line (yours, ours, or none), it is handed a brief the brain builds: the cited journal entries behind what the character believes, the receipt of what they are doing right now, the dials as numbers, this conversation so far, and what this level lets them say. The manifest's speech section is where you declare that:

"speech": {
  "level_facts": ["the mine flooded last spring and three men were lost"],   // citable, as [L1]
  "names":       ["Foreman Garrick"],                                          // people who exist here
  "places":      ["the lower gallery"]                                         // beyond the place tags
},
"characters": {
  "Old Brenna": { "speech": { "knows": ["the pumps fail every winter"], "voice": "clipped, tired" } }
}

A line may refer only to what is in the brief: the journal, this level, this conversation. A name, place or past event outside it is rejected before it is spoken and the character goes vague instead. That check runs in code, on every line, for every model, and its rejections are logged so you can see which model invents. Facts a developer declares here are the only lore a character can state that they did not live through.

You don't have to author behaviour. Left alone, a character decides from what they know, who they are, and what's in front of them — no trees, no states, no "if the player steals then," and you can inspect the full table of those decisions before you ship. When a moment matters, you take the wheel (§⁠12): you write the scene, not the personality, and you never write the way back out.

03 The three speeds

Why a character can react instantly and still hold a grudge for days

Reflexes — every second

The fast layer answers moment to moment: greet, serve, warn, investigate, flee, confront, call for help, get back to work. It is a small trained network over the character's features and runs locally in microseconds.

The first three are calm: when a character picks one, your game receives nothing at all. A peaceful scene costs you literally zero traffic, which is why a hundred characters cost about the same as one. The manifest masks this layer too — a coward with no flee in their list never flees, before the decision is even scored.

Memory and intent — across hours and days

Events are journaled with an importance and a provenance — the character knows whether they saw it or were told, and says so when they recall it. Importance accumulates per class of wrong, so a bad week can wake a grudge that no single day would have; one grave event wakes it at once.

When one wakes, the character composes a course of action from their own operators — every ordered subsequence, scored by an outcome model — and the length fits the situation. From the planning battery, an owner robbed:

None of those responses is authored. They're worked out, and a plan survives interruption: draw a blade mid-errand and the character deals with the threat, then resumes the same step. A paused plan does not age.

Verbs — every frame

Each verb maps to an engine action, and the adapter executes it: trained per-verb policies in the web, Unity and Godot bodies; Skyrim's own AI packages in Skyrim. Deciding to flee and knowing how to flee are different problems, and the second one is solved per-body, in the adapter.

04 The budget

Measured, not promised · one process, one laptop, no network

"A hundred characters cost about the same as one" is a claim you can profile, so here it is profiled — and the profile does not say that. It says something more useful: the cost is a straight line you can read off, and it is a line your frame never sees.

The unit, so the numbers can't be misread: one sweep is the brain judging the entire cast once — the reflex head for every character, every standing plan served, the routine tier. Sweeps run once a second by default (LW_STUDENT_TICK, 1.0 s; the feed from the game arrives at 4 Hz, the mind reads it at 1 Hz), in the brain's own process beside the game — so none of these milliseconds live in your frame budget. Your frame spends zero; a frame never waits on a thought.

Measurement conditions. pipeline/sweep_budget.py calls student_runtime.step() — the exact function the live loop calls — over a synthetic cast, 40 sweeps a row, on an Apple-silicon MacBook Air, fully offline, with the event gate on its regex fallback (classification is a per-entry cost, not a per-sweep one, and is measured separately) and the plan ranker off. Light lands a fresh wrong on one character every fifth sweep; heavy starts with 30% of the cast already holding a live grudge and lands one every second sweep. Re-run it yourself; the table above is its output.

How to read it:

• Cost per character grows with the cast. About 0.3 ms per character per sweep at a hundred, 0.8 at a thousand, 6 at ten thousand. The floor is the reflex head — one small forward pass and a feature row per character, every sweep, whether or not anything is happening. The growth is the retina: each character's features include the crowd around them, so a bigger town is more to look at for everyone in it. Nothing is quadratic in relationships, and nothing is free either. The earlier claim that a hundred cost about the same as one was measured on a different implementation and is withdrawn.
• Load barely moves the median. With 30% of the town holding a live grudge and drama at 2.5× the base rate, the median moved 4 ms at a hundred and 41 ms at a thousand. A held grudge is cheap to hold; the composer runs once per wake, and composing costs 0.012 ms (median, 0.25 ms p99 — _compose over an owner's full operator set). What load does move is the tail: at a thousand under heavy drama the p99 reaches 2.7 s, which is the wake path landing on many characters in one sweep.
• No decay. Median latency in the last third of each run matches the first third — journals accumulate, the sweep does not slow down.
• The tick, not the frame, is the budget. A sweep that fits inside one second holds the 1 Hz default. A thousand holds it at the median and loses it at the tail under heavy drama. Ten thousand is the honest ceiling on one process: 59 s a sweep, fifty-nine times over the tick. Populations that size want sharding, not hope.

These are scale numbers, not endurance numbers — the hundred-hour question is a separate measurement, and the flat medians above are the shape you want going into it.

05 When a character isn't sure

A language model decides — inside a cage it cannot open

Most moments are clear and get answered locally for free. In the rare moment that is genuinely close and genuinely matters, a language model breaks the tie — and it is handed a menu, never a blank page.

So the model participates in the decision, but only ever as a chooser among options the character could have reached alone. Every one of those moments is recorded with the exact situation that produced it, archived, and folded into the next training round of the reflex brain — so the number of times a model is needed goes down over time, not up.

06 Validated for

The operational design domain, in plain words

This brain is certified — by batteries that run before every change lands — for social behaviour in a populated place, daily routines, grudges and gratitude that form, act, and forgive, needs and what a character does about them, reactions to threat, and obedience to orders, including breaking one aloud.

It is not validated for tactical combat or stealth pursuit. Those come from your AI and your sensors (§⁠13, §⁠17). Asking it to pick cover or time a parry is asking it a question outside its domain, and the number below is how you'd see that.

The escalation rate is the number that tracks how often the brain was out of its domain: decisions per NPC-hour that could not be settled by the reflex head and needed the model or the offline fallback. It is computed from the receipts (§⁠15) — every decision carries who served it — and it goes down as the flywheel turns, because each escalation becomes an example for the next reflex brain. Planned — a published figure per release; today you compute it from your own receipts file.

07 Nothing is silent

A principle, not a feature

Every decision a player could see is explained in character. A plan announces itself as it acts — each speaking step says its line when it fires ("We're not done — I know what you did"; "Not to you. Find someone else."). An order a character breaks off is broken aloud, with the real reason that decided it. A refused player command is refused aloud. Escalation is spoken: when a graver wrong swaps the plan, the swap is said. Gratitude is said.

Why: the felt intelligence of an NPC is in the player's head, and speech is the hook that puts it there. A character who just stops walking looks like a bug; one who tells you why looks alive. The one rule of the coach lane says it shortest: "stop" is silent and instant; refusals always speak.

08 Telling characters what happened

The perception door · in your words, not a fixed vocabulary

Characters see through one door: a line of text in the first person lands in their journal. The Skyrim adapter's perception bank writes it from engine events — an attack, a theft, a gift — and any adapter can write it for anything at all:

"Aren stole a coin purse right off me"
"the newcomer gave me a sweetroll"
"I have gone without food since yesterday"

You don't have to match a phrasing or pick from a list — characters read meaning. An event gate over a sentence embedding classes the line (theft, attack, threat, slight, debt, gift, amends, small talk) and sets its importance, with a keyword floor so authored weights hold. "Made away with the contents of my till" registers as a theft even though it shares no words with any rule you wrote — and "returned what they took" registers as amends, never as a second theft.

Provenance is stored with every entry — observed, inferred, or told-by a named character — and a character renders it the way a person would ("Gerdur told me"). Planned — hearsay weighted softer: today a rumour lands with the same importance as a sighting; the weighting by provenance is designed and not yet built.

09 Your economy, their grudges

Needs, money, and debts — the world is yours, the caring is theirs

Characters don't ship with an economy, on purpose: hunger bars, gold, prices, and shops are world state, and world state belongs to you. What the minds provide is the part you can't script — caring about yours.

What ships

• The need class. A first-person line about a want ("I have gone without food since yesterday") is a need, never a wrong. Needs only accumulate — a single mention never wakes anyone — and the door is the same perception line as everything else.
• The need operators. A woken need composes from three operators: seek-station (walk to a place that meets it), buy-from (a seller, with a line), ask-friend (an ally, with a line). Each binds late, at fire time, to a station that's open, a seller who's near, a friend in the cell — and skips with a logged reason when there is none. A character who cannot meet the need at all logs that too.
• Debt is a first-class wrong. "Aren took bread and never paid" classes as debt, joins the serious classes with theft, attack and threat, and refusal says why: "You still owe me. Settle up first."
• Refuse-service is an owner's recourse. It is in the owner archetype's operator set and composes into plans on its own.
• deliberator_decided is the record you settle. Every step a character fires writes one: the operator, its manifest verb, the target and the engine handle. Today it lands in the flywheel log, where your adapter or tooling reads it; Planned — delivered on the wire as an event you subscribe to.

Why there is no ledger

We do not ship one, and will not. A ledger has to agree with your inventory, your prices and your save format, and a second copy of that truth inside the brain is a desync waiting to be reported. We never see a price. The characters own the feelings about the ledger — who's hungry, who's owed, who's been cheated — and what someone with their temperament does about it. Scripted economies have balance; this one has grudges.

10 A town that moves without the player

The consequence loop · their acts, your outcomes

Characters form intentions about each other, not just the player, and the mechanism is built:

• Witnessing. When the perception bank sees a wrong, every character close enough to have seen it journals it too — "I saw Aren stole a coin purse from Lucan" — first-hand, with the subject named.
• A subject on the intention. The character who did it is read from the line and carried on the plan. confront, watch and avoid aim at that body: walk to where Aren stands, hold a post beside him, put distance between them.
• Bind-skip. The body is bound at fire time, not at planning time. If Aren has left the cell, the step is skipped with a logged reason and the plan moves on; it does not walk to where he was.

The minds run on their own clock whether or not the player is nearby. What they cannot do is change your world by themselves: outcomes — coins, bans, injuries, titles — are world state, and world state is yours. So a living town is one loop, and you write only the middle of it: read the decided record with a character target, apply your outcome, and journal the result back through the perception door for everyone in earshot. The ban is a wrong done to Aren, Aren's friends saw who did it, and the next intention forms without you.

What this buys at the twenty-hour mark

A world that only reacts to the player is a mirror — it moves when they move. Close this loop and it's an aquarium: leave the village for an hour and come back to find Aren barred from the market, the whole town aware of it, and sides quietly taken. The reasons had nothing to do with the player, which is exactly why it reads as alive.

11 Giving orders

Plain language, and they can say no

"follow me"
"go to the mill, then come back to me"
"stop"

Orders are understood in ordinary language — you don't need to match a phrase — and a sequence is a sequence. A new order replaces the old one; "stop" is silent and instant.

An order is borrowed attention, not ownership. A fresh order outweighs even a strong grudge, in full, for two minutes; after that the pull of the character's own life is weighed against it, and a serious wrong can end it. When they end it themselves, they say why, in the words of the wrong that decided it: "Not with that thing out there." They never break off silently (§⁠07), and the stated reason is always the real one.

A command the manifest forbids is refused aloud, not swallowed.

12 Taking direct control

When the moment is yours, not theirs

Autonomy is the default, not a requirement. Anywhere you need a character to do a specific thing at a specific time, say so — and it wins over anything they'd have chosen for themselves.

What ships is the Architect's stage, a set of tools over MCP: cast a character into a role at a spot or on the player (cast_role), put a line in their mouth (npc_say), set a situation, and arm beats — one-shot triggers that fire during play on the player reaching a place, picking up the objective, completing the goal, or a timer, and then say a line, recast someone, replace the goal, or shoot an improvised scene. A cast is a scene lease: the character holds their staging against their own social impulses until the lease ends. A cast the manifest forbids is refused with the reason, and nothing is sent.

What you don't have to write

The way back. When a scene ends — or you never write one — characters resume their own lives on their own: back to the shop, back to the patrol, back to the grudge they were holding before you interrupted. With a behaviour tree you write the scripted moment and every transition out of it, and the bugs live in the transitions. Here you write only the moment.

And survival still wins

One thing outranks even your direction: a real threat. A character in your ambush who takes an arrow will react to the arrow, then return to their mark. That rung is not overridable, by design — an NPC who stands politely still while being killed because a scene said so is the oldest bug in games.

13 Running alongside your own AI

Keep your behaviour trees · timescale, not subject, divides the work

You almost certainly have combat AI you've spent years tuning. Keep it. The split is not "combat to you, everything else to the mind" — it is by timescale:

What ships at the seconds scale today is the threat tier — warn, flee, confront, call for help — emitted as engine actions your body executes, plus the cast-able dispositions your adapter's expert set already knows (size up, shadow, seek cover, chase). Planned — the named disposition layer (engage / press / disengage) as a contract of its own, so your tree reads a stance and keeps every frame of the timing.

There are three sizes of integration.

Advisory — your logic keeps the body Planned

The mind watches, remembers, and forms opinions, but never moves anything. You receive its conclusions (suggests) and do what you like with them, including nothing. The zero-risk integration; not built today.

Tiered — you own some moments, the mind owns the rest built

Two leases exist and are the mechanism. The scene lease (§⁠12) holds an authored role against a character's own initiative. The command lease (§⁠11) holds a player's order for its term and decays after. Threat outranks both. When a lease ends, the mind picks up — including resuming whatever the character was doing before you interrupted, at the same step.

Claimed — take the body for a stretch Planned

For cutscenes, minigames, vehicles, or any sequence you want to own outright: lucan.claim(tag) … claim.release(). Not built today; a scene lease with no beats is the nearest thing that ships.

One body, one owner, always

Two systems driving one NPC is the classic way to get an actor twitching between two goals. That can't happen here: at every tick exactly one rung owns the body (§⁠16), the handoff is explicit, and the receipt records which rung served the tick and what the reflex head wanted. When something looks wrong you read the tick rather than guessing which system won.

The talk lane's memory is the brain's, not the model's. Every turn, the speech model is given a brief: the journal entries it may cite (verbatim, with ids), the receipt of the moment (served by what, which step of which plan), the dials, the level's speech section (§⁠02) and the conversation so far — the first two turns and the last twelve, read back from the journal, so a restart loses nothing. The model returns a line and the ids it drew on. A line that asserts a past event without a citation, or names a person or place outside the brief, is rejected in code and replaced with something vague. The player's words are written to the journal as events; the character's own line is written as its own speech, which can never wake the deliberator. A promise the player makes in conversation is folded into the journal as a cited deed when the conversation ends. This holds for any backend: ours, an OpenAI-style endpoint, a local model, or the no-model readout the batteries run.

14 Events

Everything a character does reaches you as a signal

What ships on the wire today is said — every line a character speaks, with who it's aimed at — and the game-directed commands the adapter executes. Decisions, memories and resolutions are written as records (§⁠15), not delivered as events.

15 Reading their mind

Receipts · the answer to "why did it just do that?" · a kill cam for the friendship

Every decision leaves one line of truth, appended to a daily receipts file. A reflex receipt carries the full head — the probability of every action, the one chosen, the confidence against the gate, who served it (the reflex, the model, the offline fallback, a cast), the features it saw, the episode it belongs to — and, when a manifest masked it, the head before and after the mask and the verbs masked out. The planner writes its own: decided, step advanced and why, bind-skipped and why, never-blocked and which rule, plan done, stood down, order broken, plan escalated.

Debugging a character becomes reading rather than guessing — you can see that Lucan greeted the player because the grudge had stood down that morning, not because something broke. It is a kill cam for the friendship: the moment it turned, frame by frame, with the reason on each one.

16 Order of precedence

One law, every character, every tick

The manifest is not a rung; it is the fence around all six. No rung can produce a verb the character does not have, and every handoff between rungs is spoken (§⁠07).

17 Verbs and sensors your genre needs

You describe it · we build and certify it · it's yours

Verbs

The shipped vocabulary covers a populated world (§⁠02). Your game may need seal_bulkhead, hide_under, peek_around_cover, drag_body, vault_railing. Request one and we build it: lw verbs request hide_under --looks-like "..." --wrong-when "..." (or the lw_verb_request tool from an agent), and lw train status follows it. What you send us:

• A name — what you'll call it in can
• What it looks like — a few sentences describing the movement as you'd describe it to an animator. "Presses against cover, leans out to expose one shoulder, holds for a beat, pulls back."
• When it's wrong — the failure you'd notice. "If they step fully into the open, it's wrong."
• Optionally, reference — footage or a clip from your game

We build and train the body ourselves; no existing verb is touched. What comes back is a finished verb plus its certification report: proof it does the thing under closed-loop test, in real geometry, driving itself. From then on it behaves like any shipped verb — listed in can, refused by never, chosen by reflexes, used inside a composed plan, asked for by players in plain language. Adding a verb to your guards does not give it to your shopkeepers; every character's limits stay exactly what you listed.

The planner can choose it on its own. A released verb ships with its operator card: which wrongs (or needs) it answers, whom the step goes to, what it is worth to a character with these traits, how it is carried out, and which archetypes take it by default. That card is what the hosted planner reads, so the moment the verb certifies it is released to you, automatically, no one in the loop: your licence gets a version carrying the body and the card, lw train status says released, and a character who has it in can can decide to use it — inside a composed plan, weighed against report, confront, avoid and the rest, under the same never rules — not only when a player asks. Nothing else moves: a level that does not name the verb decides exactly as before (that is checked, corner by corner, before any card is released). The planner's two students, the one that proposes moves and the one that chooses among plans, read the card's profile rather than the verb's name, so they have an opinion about a verb they never trained on, and the vocabulary can grow to any size without the planner being rebuilt. lw verbs lists released verbs with what they answer and who takes them by default.

Getting it into your build: lw licence activate after the release pulls the body and the card; name the verb in the manifest's verbs and in the characters' can; bind the engine action <name> in your adapter (the body is an expert your runtime loads like the shipped ones).

When you need a new verb — and when you need a retrain

Three different gaps look alike from the outside: a character "won't do the thing". They are told apart by where the brain says so, and each has one remedy. None of them is a config flag; two of them are requests we fulfil for you.

A new verb is the request of §⁠17 above: name, what it looks like, when it's wrong. You get the finished verb, its operator card (so the planner can choose it), its certification report and the version it lands in, automatically, the moment it certifies. Later we add it to the base every studio starts from; that second step is ours. Two rules of thumb for whether you need one: (1) if you can describe the movement to an animator and no shipped verb's description matches, you need a verb; (2) if a shipped verb does match but the character still won't do it, you don't — check can and the load report first, then lw why.

A retrain is never something you do yourself and never something you have to guess about. It ships only if it passes the batteries the base passed and is no worse than the base on every metric; a retrain that would make your characters worse is rejected, and the receipts say why. The flywheel counts the misses per lane; lw escalations shows the counts and the lines behind them; lw train <lane> --propose sends the lane's escalations up, and what comes back depends on the lane. Student and gate weights are yours to keep and ship (they run in your build, offline). Ranker and deliberator improvements are applied to the hosted service — no artifact, no download, the next wake is simply better. In every case you receive the certification receipts: what was tested, which batteries ran, what changed and by how much — you never receive the training pipeline, and you never need them.

What you never retrain: the reflex head to give a character a verb it doesn't have (that is can), a gate to make a character care about something (that is the events section of the manifest, and importance), or anything at all to change one character's temperament (traits and never rules do that, per character, at load time).

Sensors Planned

The brain never learns geometry and never reads your nav mesh. You compute the facts that matter in your genre and declare them as sensors in the manifest — has_cover, monster_near, lights_out, exit_behind_me — and our rules run over your facts: never: { verb: "advance", when: "self.lights_out and not self.has_cover" }. You own the geometry; we own the deciding — the same division as the ledger in §⁠09.

What ships today is the fixed version of this: the four namespaces of §⁠02, with the self. list versioned alongside the vocabulary and place tags declared per level. Developer-declared sensors extend self. with your names; the load-time check will report a sensor no adapter supplies, the same way it reports a verb no body can execute.

What we deliberately do not do

• Cover selection. Which wall, which crate — yours.
• Pathing tactics. Flanking routes, choke points — yours.
• Frame-scale combat timing. Parry windows, dodge frames, attack cancels — yours, always (§⁠13).

18 What they can never do

Checked before you ship — not hoped for at runtime

Two kinds of prohibition, both verified before publish:

By omission. A verb absent from the character's set cannot occur — not under fear, not under an order, not deep inside a long plan, not from a cast, not ever. The manifest masks the reflex head before it is scored, bounds the planner's operators, gates the Architect's casts, and a backstop in the one funnel every command leaves through catches anything a future layer slips past.

By rule. For verbs a character does have, conditional limits over the namespaces of §⁠02:

"never": [
  { "verb": "confront",   "when": "target.isChild",              "name": "no-confronting-children" },
  { "verb": "draw",       "when": "place.temple",                "name": "no-steel-in-the-temple" },
  { "verb": "leave_post", "when": "slice.morning or slice.noon", "name": "shop-hours" }
]

The temple rule holds in every temple in the game, not one shrine you listed, because place.temple matches the engine's own type for the place (§⁠02). That is what makes a rule shippable: you write the prohibition once, and it travels to levels you have never seen.

draw and leave_post are tags — a rule may name a verb or a tag that several verbs carry. These aren't strong preferences that a strong enough impulse could outweigh — they're filters, applied when a plan is composed and again at the instant each step fires. Values are weighed; rules are enforced. The two never mix.

The publish-time proof

Because a character's verbs are a finite list, every course of action they could ever take is enumerable — so publishing walks all of them. The proof (prove_never.py, run by certification) enumerates every ordered subsequence of the character's operators, for wrongs and for needs, against every situation the rules can tell apart, and checks each step with its own evaluation of the rules — not the runtime's — so a broken fence is caught rather than rubber-stamped. You get a report:

Lucan Valerius · riverwood
  can never:  avoid, flee, guard_player, lead, lean, sandbox   (no such verb)
              confront when target.isChild   (rule 'no-confronting-children' — verified, 252 plans;
                                              48 carry the verb and rely on the fire-time fence
                                              if the situation changes mid-plan)
              draw when place.temple         (rule 'no-steel-in-the-temple' — verified, 252 plans; …)
  tool off:   follow_me   (needs guard_player)
  enumerated: 252 plans × 24 situation(s) (can list)

Two things the report says that a hope would not. First, how many plans carry a rule's verb and therefore depend on the fire-time check should the world change mid-plan — that reliance is stated, per rule. Second, a rule over a fact your feed does not supply is reported unenforceable and fails the proof, because a rule that can never fire is not a rule. A character without a can list is proved over every archetype default, and the report says which default it assumed.

That page is checkable, printable, and holds for a character who is frightened, furious, mid-order and mid-plan all at once — because none of those are inputs to the question.