# The World Server & Shard Continuum V6 — **Egbe** — bets that you can run a _population of minds_ inside a shared world named **Orun** and keep it affordable. The world server is the half of that bet that owns physical truth. In V6's Mind/Body/Memory split the world server is **the Body**: it is authoritative for transforms, physics, navmesh, props, world time, and co-presence, and it is the place where an agent's _intent_ is turned into _what physically happened_ — or rejected. The **Mind** (Moirai) decides; the **Memory** (Ori) remembers; but neither can move an avatar through a wall, because only the Body applies state, and it validates every action against the authoritative world before it does. That single rule — decision and truth held apart, with the world server as the validating authority between them — is what lets V6 schedule LLM-driven cognition across thousands of agents without ever letting a hallucinated action corrupt the world. The **shard continuum** is the second half of the same idea. Solo, Co-op, and Commons are not three codebases or three save formats; they are three _binding contexts_ for the same world server and the same agent. They differ only in **who runs the instance and who is authoritative**, never in the simulation code. Because durable truth lives in the Ori and not in any instance, an agent can move from a private homestead to the always-on Commons and home again with its identity, memory, and relationships intact — travel is an _Ori rebind_, not a file copy, so there is never a "which save is canonical" problem. The world server (`apps/v6/egbe-world-server/src/lib.rs`, ~14,360 lines of Rust with **33 `#[test]` cases**) implements all three contexts as data over one tick loop, speaks the engine-agnostic `@oshun/egbe-protocol` wire to every client tier, and publishes its `ShardKind` enum across Rust, TypeScript, and UE C++. This page is the deep dive behind the "World, Edge, and Client" group of the orientation hub [../V6_ARCHITECTURE.md](../V6_ARCHITECTURE.md). It is the simulation companion to [the edge and client tiers](./gateway-pixel-streaming-and-web-fallback.md) (the gateway and Pixel Streaming fleet that terminate the connections the world server serves), it consumes the cognition arbitrated by [Moirai](./moirai-kernel-and-cost-tiering.md) (whose tiers this page's perception-LOD feeds and bounds), and it is rendered by [the UE5 client modules](./ue5-client-modules-and-embodiment.md) (the embodiment side of the same wire). The biography this server flushes life-events to is detailed in [the Ori biography service](./ori-biography-service.md). ## What ships, honestly The world-model **logic** is real, deterministic, and covered by falsifiable tests — but, as with the rest of the Oshun catalogue, the daemon that wraps it is a health endpoint, the physics stage is a collision _mirror_ rather than a stepped integrator, and the UE network module is deliberately empty. Four honest layers: - **Real and exercised by tests.** The 20 Hz authoritative `tick()`, geometric action validation (teleport / out-of-navmesh / prop-blocked rejection), perception that is LOD'd by visible density rather than population, a real `rapier3d` body/collider model, Solo offline-advance with a returning-player chronicle, the Co-op host-bridge and its home-Ori reconciliation, Solo↔Commons Ori-rebind travel, the regional Commons fleet with residency routing, cognition-capacity degradation with a behavior-tree floor, and **deterministic seeded + golden replay** are all genuine algorithms with named numeric budgets, covered by the crate's 33 tests. The capability list in `SERVICE_DESCRIPTOR` (`lib.rs:12`) — `twenty-hz-tick`, `offline-atropos-advance`, `shard-travel-ori-rebind`, `persistent-commons-fleet`, `deterministic-core-golden-replay`, and ~50 more — maps onto implemented code, not aspiration. - **The daemon is health-only.** `run_service()` (`lib.rs:101`) binds a `TcpListener` on port `46101` and `handle_connection` (`:111`) answers `GET /health` with the `ServiceDescriptor` JSON and 404s everything else; `main.rs` is one line. There is **no accept loop ingesting client packets, no live gateway socket, no QUIC listener** — the rich logic is library-grade and test-driven, and the client-serving daemon is not assembled here. - **Physics is a collision mirror, not an integrator.** `RapierPhysicsStage::sync_and_step` (`lib.rs:7156`) rebuilds a real `rapier3d` `RigidBodySet`/`ColliderSet` from the shard each tick — capsule colliders (`capsule_y(0.9, 0.25)`) for agents, ball colliders for blocking props — and returns the body/collider counts, but it **takes `_tick_hz` (ignored) and never calls a `PhysicsPipeline::step`**. Authoritative movement is decided _geometrically_ in `validate_move_action`, not integrated. The rapier sets are a faithful collision model; they are honestly not a dynamics solve. - **The UE network module is intentionally empty.** Unlike V3, whose `V3Net` re-implemented the wire codec in C++, V6's `V6Net.cpp` (`V6/ue/Source/V6Net/`) is an empty `IModuleInterface` whose header documents the choice: it "declares NO UCLASS/UFUNCTION capability surface, so it implies no networking features that do not exist," and defers real multiplayer to "the Oshun services layer." A protoc-generated UE C++ codec **does** exist (`libs/v6/egbe-protocol/ue/generated/.../egbe.pb.{h,cc}`, ~33,440 lines) but is not wired into any `Source/` module; the client's shard model is the independent `EV6WorldShardKind { Solo, Coop, Commons }` enum in `V6World` (`V6ClientWorldModel.h`). Where the topology page says "the UE-C++ `V6Net` module adapts to this protocol," the disk says V6Net is empty — treat the protocol _peer_ on the UE side as [the client modules page](./ue5-client-modules-and-embodiment.md) describes it, not V6Net. ## The world server — the Body authority ### The 20 Hz authoritative tick Everything pivots on `WorldTickLoop::tick` (`lib.rs:7411`). With the canonical `WorldTickConfig::default()` (`lib.rs:786`) — `tick_hz: 20`, `snapshot_hz: 20`, `frame_budget_ms: 50.0`, `checkpoint_interval_ticks: 20` — one tick advances world time by `1_000 / tick_hz` ms and then runs a fixed pipeline: evaluate cognition-capacity pressure, choose the execution mode, resolve the incoming `ActionBatch` against authoritative state, sync the physics bodies, compute the next perception batch, emit a snapshot on an accumulator boundary, flush life-events to the Ori, and checkpoint on the interval. The snapshot cadence is an accumulator (`snapshot_accumulator += snapshot_hz`; emit when it crosses `tick_hz`), and each emitted `AgentStateSnapshot` is encoded through the same `encode_wire_packet` the protocol crate uses, so `encoded_snapshot_bytes` (`:7501`) is the literal on-wire size, not an estimate. The result carries `within_frame_budget` measured from a real `Instant`. The load test `world_tick_holds_twenty_hz_with_one_hundred_fifty_agents` (`lib.rs:14297`) drives **150 agents over 80 snapshots** and asserts `held_twenty_hz` against the p99 tick time — a falsifiable performance gate, not a comment. ### Validating intent against the world This is the heart of the Body's authority. `resolve_action_batch` (`lib.rs:7909`) first sorts the batch by a `stable_action_ordering_key` so the same intents always apply in the same order (a determinism prerequisite), then validates each `MoveTo`. `validate_move_action` (`lib.rs:10042`) is four real rejections, each returning a typed fact-ref: - `world/action/teleport-rejected` — the requested distance exceeds `max_intended_move_mm` (default `1_200` mm/tick). - `world/action/target-outside-navmesh` — the destination has no `navmesh_region_for_transform`. - `world/action/target-blocked-by-prop` — `validate_transform_against_ground` finds the target inside a blocking prop. - `world/action/path-blocked-by-prop` — a point-to-segment test (`distance_point_to_segment_xz_squared`) finds a navmesh-blocking prop within its `collision_radius_mm` of the move path. Only after passing does the action step the avatar toward its target by `action_step_mm_per_tick` (300 mm). `Say`/`Emote` flip activity state; everything else is a no-op-applied. The test `world_tick_rejects_moirai_actions_that_clip_geometry_or_teleport` (`lib.rs:10624`) proves a Moirai action batch that tries to clip geometry or teleport produces exactly the rejection count and the `teleport-rejected` fact — the monolith's "an agent cannot walk through a wall because it intended to" is enforced, not asserted. Rejections become `WorldEventKind::ActionRejected` world events, so the client and the Ori both learn that the world refused the Mind. ### Perception, LOD'd by what the player can see `compute_perception_batch` (`lib.rs:8050`) is the Body→Mind half of the loop, and it is where cognition cost is bounded. For each agent it collects other actors within `coarse_perception_radius_mm` (24 m), sorts them by distance with a stable id tiebreak, and assigns **rich LOD** (`lod = 1`, confidence 9000 bp) to the nearest few inside `rich_perception_radius_mm` (6 m) up to `max_rich_perception_items_per_agent` (8), then **coarse LOD** (`lod = 3`, confidence 6500 bp) up to `max_coarse_perception_items_per_agent` (4), and nothing beyond. The crucial property is in the test name: `perception_lod_scales_items_with_visible_agents_not_total_agents` (`lib.rs:10771`). Because perception volume tracks _visible_ density, not population, the cognition spend Moirai pays is bounded by what a player can actually see — the same idea that makes [Moirai's tiering](./moirai-kernel-and-cost-tiering.md) affordable, expressed on the perception side. ### Physics: a rapier collision model, honestly `sync_and_step` (`lib.rs:7156`) clears and rebuilds the `RigidBodySet` and `ColliderSet` every tick from authoritative transforms: each agent becomes a `kinematic_position_based` body with a `capsule_y(0.9, 0.25)` collider (350 mm radius), each navmesh-blocking prop a `fixed` body with a ball collider sized to its collision radius, positions converted mm→m. It returns the body and collider counts (`world_tick_holds_twenty_hz_*` asserts `max_physics_body_count == 151` for 150 agents plus one prop). The honest caveat stated above bears repeating here: this builds a real, queryable rapier collision world but does not call the integrator — the integration is geometric, in `validate_move_action`. Rapier is the collision _representation_; the movement contract is the segment/navmesh math. ### Cognition-capacity pressure and the behavior-tree floor The resilience story — "a cognition outage costs richness, never the world" — is real branching in the tick. `evaluate_cognition_capacity_pressure` (`lib.rs:7532`) compares the agent count against `cognition_capacity_high_fidelity_agent_limit`; when agents exceed the limit, `degraded_mode_active` flips, external Moirai actions are dropped for that tick, and `execution_mode` (from `agent_behavior`) selects `BehaviorExecutionMode::DeterministicFallback`, under which the world server computes a fallback `ActionBatch` from co-located behavior trees so agents keep acting believably. A `PlayerDegradedModeNotice` (`player_degraded_mode_notice`, `:7560`) is `player_visible: true` with a plain-language message, emitted once on the degradation edge so players are told, not silently downgraded. The default limit is `usize::MAX` (degradation off until an operator configures a budget), and `homestead_rest_caps_offline_days_and_lowers_cognition_spend` (`lib.rs:11352`) proves the Solo pace control lowers spend. ### Durable flush and determinism Each tick flushes life-events to the Ori (`flush_life_events`) and, on the checkpoint interval, writes a world-state checkpoint through `DurableWorldPersistence` — the durable truth that makes a shard rebind safe. Determinism is gated twice: `seeded_world_replays_identically` (`lib.rs:14314`) runs a seeded world twice and asserts the FNV-64 trace hashes are equal, and `deterministic_core_golden_replay_matches_committed_fixtures` (`lib.rs:14334`) replays against a committed golden fixture (`V6/evals/golden-replay/deterministic-core-golden.json`). This is why the build stamps strict floating-point flags: the perception→cognition→action loop must replay identically for audit. ## The shard continuum The continuum is one world server, three binding contexts. The wire enum is shared across every runtime: `ShardKind { SHARD_KIND_SOLO = 1, COOP = 2, COMMONS = 3 }` in `egbe.proto`, mirrored as `EV6WorldShardKind` in the UE client. A `ShardState` (`lib.rs:530`) simply carries a `shard_kind`, a region, an instance id, world time, and its grounds; the same `tick()`, the same validation, the same perception run regardless of which kind it is. What differs is _who hosts it_ and _how it advances when no one is watching_. ```mermaid flowchart TB ori[("Ori biography service
durable truth — identity, memory,
relationships, values (:46105)")] subgraph continuum["The Shard Continuum — one world server, three contexts"] direction LR solo["Solo — private homestead
advance_offline_absence_with_rest
offline → Atropos batch + chronicle"] coop["Co-op — host's instance
begin_coop_session: visiting Oris
read-mostly; host authoritative"] commons["Commons — always-on fleet
CommonsShardRuntime.advance_real_time
regional shards, residency-routed"] end solo -- "travel_agent_as_ori_rebind
(Solo ⇄ Commons only)" --> commons commons -- "consolidate → detach →
attach → rehydrate" --> solo coop -- "reconcile_to_home_ori
on session end" --> ori solo -- "life-events / checkpoint" --> ori commons -- "life-events / checkpoint" --> ori ori -- "rehydrate identity
at destination" --> commons classDef store fill:#f3e8ff,stroke:#6d28d9,color:#3b0764 class ori store ``` ### Solo — the private homestead and offline advance A Solo shard is a private instance per player. Its distinctive code is what happens while the player is _away_: `advance_offline_absence_with_rest` (`lib.rs:3733`) refuses to run on a non-Solo shard, then forces every agent to `AgentTier::Atropos` and `ActivityState::OfflineSummary`, advances world time by the absence window at `SOLO_HOMESTEAD_OFFLINE_TICK_HZ`, generates summary life-events, builds a **returning-player chronicle** ( `SoloHomesteadChronicle`), flushes to the Ori, and writes a checkpoint. A `HomesteadRestPaceControl` caps how many game-days an absence can advance, so a month away does not produce a month of compute. The test `solo_homestead_persists_and_multi_day_absence_produces_chronicle` (`lib.rs:11256`) exercises the multi-day round trip — this is the monolith's "while offline the world advances in Atropos as a low-cost batch job," made real and bounded. ### Co-op — the host's instance with read-mostly visiting Oris Co-op is not a separate server kind; it is a Solo host that has accepted visitors. `begin_coop_session` (`lib.rs:3798`) takes a `CoopBridgeRequest` of visiting agent seeds and binds each into the host's instance read-mostly — the host stays authoritative. When the session ends, `reconcile_to_home_ori` (`lib.rs:3900`) walks each visiting agent's earned events and reconciles them back to that agent's _home_ Ori, so nothing a visitor experienced is lost or trapped in the host's world. `coop_bridge_reconciles_visiting_events_to_home_ori` (`lib.rs:11404`) proves the reconciliation. This is the cheapest point on the continuum: no new fleet, just another agent's biography loaded alongside the host's. ### Commons — the always-on regional fleet Commons is the persistent, regionally-sharded world that advances in real time whether or not any individual player is present. `CommonsShardRuntime` holds a map of regional shards; `advance_real_time` (`lib.rs:4480`) accumulates elapsed wall time per shard, advances the right number of fixed ticks, and — critically — runs `interest_manage_commons_cognition` first, which enables high-fidelity cognition only on shards where players are present and reassigns the rest of the population to Atropos. The test `empty_commons_region_runs_atropos_only_without_players` (`lib.rs:11769`) and its companion `commons_region_with_player_preserves_high_fidelity_for_present_agents` (`lib.rs:11851`) pin both halves of that rule. Region boundaries honor data residency: `commons_residency_zone_for_region` (`lib.rs:8615`) maps a region string (`eu-`, `uk-`, `ca-`, `latam-`, `apac-`…) to an `OshunResidencyZone`, and `travel_agent_across_commons_with_residency` (`lib.rs:4217`) gates cross-region travel on explicit consent — `commons_region_residency_constrains_cross_region_travel_without_consent` (`lib.rs:12319`) proves a no-consent crossing is refused. ### Travel is an Ori rebind The seam that makes the continuum _one_ world is `travel_agent_as_ori_rebind` (`lib.rs:3956`). It first checks `valid_shard_travel_route` (`lib.rs:8604`), which permits **only Solo↔Commons** — Co-op is a visit, not a travel endpoint. It then captures the source actor, asserts it is an Agent, builds a rehydrated transform at the destination, validates that transform against the destination ground (navmesh + props), records the Ori life-event counts, **detaches** the actor from the source instance, **attaches** it to the destination via `spawn_actor_on_ground` carrying its cognition tier, and produces a `ShardTravelReport` with a `travel_event_count`. Because the Ori is the durable record, the rehydrated agent arrives with its identity, memory, and relationships intact — the test `shard_travel_ori_rebind_preserves_identity_memory_and_relationships` (`lib.rs:11504`) asserts exactly that. A relationship an agent formed in the Commons is simply a remembered, written-to relationship when it walks back into a Solo homestead; there is no canonical-save problem because no instance ever held the truth. The `V1CrossShardPresenceBus` (`lib.rs:551`, topic `v1.presence.cross-shard`) carries the presence signal across the seam. ## Related - [../V6_ARCHITECTURE.md](../V6_ARCHITECTURE.md) — the orientation hub and the full Mind/Body/Memory, two-substrate, and determinism model. - [Gateway, Pixel Streaming & web fallback](./gateway-pixel-streaming-and-web-fallback.md) — the edge that terminates client transport and routes to the world-server shard this page simulates. - [The Moirai kernel & cost tiering](./moirai-kernel-and-cost-tiering.md) — the Mind that consumes this server's perception batches and returns the action intents it validates; the tiering this page's perception-LOD bounds. - [UE5 client modules & embodiment](./ue5-client-modules-and-embodiment.md) — the rendering peer, the real protocol surface on the UE side (the empty `V6Net` and the `V6World` shard model), and agent density-LOD. - [The Ori biography service](./ori-biography-service.md) — the durable truth the world server flushes life-events to and rebinds travel through. - [Architecture, topology & project layout](./architecture-topology-and-layout.md) and [Subsystem glossary](./subsystem-glossary.md) — the orientation pages for the whole product.