Lilith Metaverse is V3's embodied multi-user substrate. One authoritative world and protocol support premium Unreal clients, browser access through Pixel Streaming, and a reduced-fidelity local web fallback without creating a weaker identity or safety tier.
Rendering tier changes fidelity and transport, not identity, entitlement, moderation, rights, or safety authority.
Client and launch tiers#
| Surface | Runtime | Purpose | Honest boundary |
|---|---|---|---|
| Native Tier 1 | Unreal Engine 5.5 client | Premium desktop, VR, console, and supported mobile fidelity. | Requires platform build, optional art/audio plugins, and compatible hardware. |
| Browser Tier 1 | UE Pixel Streaming | Full UE rendering delivered to a thin browser client. | Requires regional GPU worker/signaller capacity and WebRTC conditions. |
| Tier 2 fallback | Next.js + three.js/WebGPU/WebGL2 | Locally rendered access for constrained devices, networks, or regions. | Deliberately reduced visual/crowd fidelity; trust and identity do not downgrade. |
| Static/degraded | Product-defined fallback | Preserve access to information or archived/on-demand experience when realtime cannot start. | Does not claim live presence. |
The launch decision is a typed server contract with reason codes, not a client-side guess. The architecture and exact status are documented in Product promise and architecture and Tier routing and Pixel Streaming.
Authoritative world model#
The world server owns rooms, membership, presence, entity state, physics validation, interest management, persistence, and reconnect/resume semantics. Clients predict or render; they do not become authoritative because they run a high-fidelity engine.
Rooms bind a tenant, venue/mode, capacity regime, region/shard, activated Game Feature data, moderation/safety posture, and persistence policy. Interest management limits which entities and updates a client receives based on spatial relevance and tier. Capacity tiers, wire bandwidth tiers, and voice-realm tiers are distinct vocabularies and must not be treated as one enum.
See World server and gateway and World, rooms, presence, and multiplayer.
Network and transport#
The realtime gateway mediates authenticated transport and voice. The protocol is shared across TypeScript, Rust, and Unreal representations; golden fixtures protect wire compatibility. Depending on client/network, transport can use WebTransport/QUIC, WebRTC, or WebSocket fallback under a declared policy.
Reconnect preserves session and shard intent only when the resume token, authorization, room version, and retention window remain valid. A reconnect is not proof that every transient action or voice frame was recovered; the UI must show the actual state.
Presence and embodiment#
Presence binds a V1 account/session to a world participant and avatar under visibility, privacy, moderation, and swap/cooldown rules. Presence includes connection state, room, pose/transform, nameplate/identity presentation, speaking state, and relevant activity—not unrestricted personal metadata.
Embodiment responsibilities include:
- VRM/community and MetaHuman/premium avatar paths;
- skeleton retargeting, animation, IK, locomotion, and pose policy;
- viseme/lip synchronization and speaking indicators;
- costume slots and body-safety constraints;
- nameplate and avatar LOD by distance/capacity;
- personal-space, block/mute, reporting, and moderation controls;
- reduced-motion, seated, single-switch, and other access modes.
The focused feature document is Avatars, nameplates, and spatial audio.
Spatial voice and audio#
Voice passes through the realtime gateway/SFU and is rendered spatially by the client tier. Policy covers mic permission, speaking indicators, mute/block, recording consent, voice abuse, moderation access, region/room rules, and degraded stereo or text alternatives. Ambient audio, MetaSounds, performance audio, and participant voice are separate buses with separate priority and rights.
Crowd scale may change mix strategy and update bandwidth, but it does not make consent or abuse controls optional.
World streaming and Game Features#
The UE project contains always-loaded modules plus Game Feature plugins that scope tenant/mode data and activation. Activating a descriptor does not prove a complete venue or gameplay implementation; the handbook and architecture pages distinguish content descriptors, module skeletons, authored assets, and tested behavior.
Scene streaming coordinates world cells, room mode, asset bundle/version, participant readiness, and safe fallback. Join should not expose a user to a partially initialized unsafe state; leave/reconnect should release resources and preserve only declared persistence.
Accessibility and fidelity parity#
Parity means the same identity, authorization, presence semantics, safety, consent, and core participation—not identical pixels. Reduced-fidelity clients must disclose omitted effects or crowd detail while preserving essential navigation, captions/transcripts where supported, audio controls, reduced motion, photosensitive-safe presentation, color-vision accommodations, and input alternatives.
The quality and localization surface is documented in Accessibility, localization, and quality.
Persistence and cross-device continuity#
Durable world state, tenant data, member continuity, and transient realtime state are separate. The world server and tenant schemas persist declared records; Iris owns personal memory/identity continuity; the realtime protocol carries ephemeral state. A client handoff reauthorizes access and resolves conflicts rather than copying a live socket state blindly.
Failure and recovery#
- Pixel Streaming capacity unavailable: route to native, Tier 2, or declared static fallback with the reason visible.
- Gateway transport failure: follow the bounded fallback ladder and show reconnect state.
- Shard/world failure: preserve authoritative checkpoints and avoid duplicate commerce or attendance receipts.
- Voice failure: retain text/visual participation and accurate speaking state.
- Missing optional art/audio plugin: fail the feature gate or use the declared asset fallback; never claim premium fidelity.
- Client mismatch: enforce protocol/content compatibility and guide update or compatible fallback.