Launch is a sequence of independently inspectable obligations rather than a single optimistic status. A failure at any stage records a reason and prevents later signoffs from laundering fixture or inherited evidence into readiness.
Every other V7 page describes a thing the platform does — compose a realm,
hand off authority across a dying node, settle a payout to the cent. This page
describes the conditions under which any of it is allowed to ship to a person:
the accessibility floor a creator surface cannot publish below, the locale set
the catalog speaks, the eval and telemetry surface that tells operators whether
a build is healthy, the cost levers that keep a 1000-inhabitant realm
affordable, the frame and asset budgets the simulation holds to, the one account
a player carries across platforms and games, the staged region rollout, and — at
the end — the launch gate that aggregates all of it into a single go/no-go. V7
is Mawu, an open-world creator republic on Unreal Engine 5.5 and a fleet
of Rust services, and the defining honesty of its Platform-and-Launch layer
is that the gate which decides "ship?" currently reads not-launch-ready
and is wired so it structurally cannot report otherwise while its evidence is
fixture evidence. That is not a defect in the document; it is the point of the
machinery. This page is product-shaped — what a player and a creator experience
at the edges of the platform — and it pins each claim to the code that enforces
it, or labels it honestly where the code is policy, a reused pipeline, or an
inherited seam not yet wired. It belongs to the feature catalogue at
../V7_features.md.
What ships, honestly#
Three categories run through everything below, and the page never blurs them.
Real and on-disk: the Mawu accessibility floor is a 5-rule linter
(libs/v7/contracts/src/accessibility-eval.ts) that blocks publish, run as a
merge gate; the localization catalog is the shared @oshun/i18n library
(libs/oshun/i18n/src/index.ts) with eight launch locales, RTL handling, a
typed fallback chain, and a gap detector; the AI cost/fidelity tiers are real
Rust degradation levers in danu-mesh-cluster that each emit a telemetry
record; a meaningful subset of the performance budgets is encoded as Rust
constants that eval gates assert; cross-version/cross-realm portability is a
real run_v7_passport_eval; and the staged-rollout and launch-readiness records
are machine-checked JSON with verifiers that enforce a no-fabrication invariant.
Spec or reused pipeline, labelled: the metric/trace spine, the asset-budget
streaming path, and the console-cert cook flow are inherited from V1/V5/V6 and
named, not re-implemented for V7. Honestly negative: the staged rollout has
executed zero stages, and the launch review's eight signoffs all rest on in-repo
fixtures, never production measurements. The architecture companion that proves
the seams in engineering depth is
../architecture/observability-performance-and-launch.md.
Accessibility — a publish-blocking floor, in code#
V7 inherits the V5/V6 accessibility commitments and adds the coverage a
creator platform specifically needs: a hearing-impaired player must see who is
speaking, at what range, on which channel; a colorblind creator must read a
provenance diff; a one-handed builder must place a prop. The novelty is that
this is not a guideline — it is the accessibility adversarial merge gate
(added 2026-06-12), and its implementation is runV7MawuAccessibilityEval in
libs/v7/contracts/src/accessibility-eval.ts.
The five-rule linter and three surfaces#
The eval asserts an accessibility floor across exactly three surface descriptors
named in V7_MAWU_ACCESSIBILITY_REQUIRED_SURFACES — mawu-studio-builder,
abundantia-browser, and default-realm — and lints each against five rules in
V7_MAWU_ACCESSIBILITY_LINTER_RULES:
voice-radio-text-visual-parity— proximity and radio voice must expose text transcript, live captions, and visual indicators for speaker, range, channel, and mute state, plus a radio-channel text label;lintVoiceRadioParityraises ablockfinding for each of the seven fields that is false.colorblind-safe-provenance-diff— the provenance/diff palette must not be color-only, must carry a contrast ratio>= 3, must use at least two non-color cues (shape/icon/pattern/label), and must label changed fields.keyboard-gamepad-builder-parity— every builder action needs a keyboard binding, a gamepad binding, a visible focus target, a screen-reader label, and a voice command; the builder surface with zero actions fails outright.scalable-ui-floor— surfaces must include 100% in their text-scale range, reach 200%, reflow at 320 CSS px, and keep 44 px hit targets.reduced-motion-floor— reduced-motion mode must honour the system preference, keep only essential motion, drop the animation multiplier to<= 0.01, and disable vestibular effects.
The report's passed is true only when no surface produces a block finding
and every required surface is present. Because the gate fixture
(V7_MAWU_ACCESSIBILITY_EVAL_FIXTURE) ships passing specs, any seeded
regression — a missing caption, a color-only diff, an unbound builder action, a
non-scalable shell — flips a surface to failed and blocks the merge. The gate
runs via pnpm exec vitest run -t "Mawu accessibility" and is exercised in
libs/v7/contracts/src/index.test.ts. The platform floor a realm author
inherits is this linter; a realm sets accessibility above it, never below.
Localization — the shared catalog, V7's surfacing#
V7 does not own a translation runtime; it composes the platform's. The catalog
is @oshun/i18n (libs/oshun/i18n/src/index.ts), the canonical V1
customer-string library, and V7's localization story is best read as honestly
inherited: the launch locale set, the formatting, and the fallback discipline
are real and shared, while V7's own contribution is surfacing content and
reports in those locales.
OSHUN_LAUNCH_LOCALES fixes eight locales — en-US, es-US, fr-FR, de-DE,
ar, he, ja-JP, pt-BR — with RTL_LOCALES flagging ar and he for
right-to-left direction and LOCALE_EXPANSION_BUDGET recording how much longer
each locale runs than the en-US baseline (German 1.4×, Japanese 0.7×) so
layout QA can verify shells do not truncate. translate() resolves through the
documented chain resolveFallbackChain — requested locale → language-only
locale → en-US — and emits a fallback event for critical keys (disclosures,
evidence, auth, privacy) so a gap is logged rather than silently rendered in
English. findFallbackGaps() is the launch guard: it returns every
<key, locale> pair that resolves by fallback, and a non-empty result means a
translation gap remains before launch. formatForLocale wraps Intl.* for
locale-aware date, time, timezone, number, currency, and region formatting.
Where V7 uses it concretely: the Abundantia catalog, Mawu Studio, governance
surfaces, and platform UI localize across this set, creator content is
locale-tagged for the browser to filter, and — visibly in code — every
incident-response drill in V7/release/staged-rollout.json carries a
localizedReportLocales array equal to exactly these eight locales, so a public
incident report ships in every launch language. Honest label: the catalog's
keys today are the shared shell/assistant strings, not a V7-specific message
set, and there is no V7-specific localization eval gate — localization is
composed from the V1 library plus the rollout-record policy, not re-proven by a
V7 test.
Telemetry, analytics, and eval sets#
The 29 adversarial gates are the eval surface#
V7's eval sets are not a spreadsheet; they are the 29 adversarial merge
gates enumerated in V7/ADVERSARIAL_EVAL_GATES.md, each owning a seeded
hostile fixture, an explicit pass bar, and a CI command. They map directly onto
the feature-doc eval list: sandbox-escape containment, conflict-resolution
correctness, mesh-handoff integrity (200 entities × 10,000 crossings, zero
loss/dup/reconnect), anti-cheat precision/recall, malware-corpus detection,
payout-formula correctness to the cent, plus the safety evals (CSAM hash,
grooming, minor-protection). .github/workflows/v7-ci.yml runs a
verify-inventory job first, then each gate as a named step — cargo test
against the apps/v7/libs/v7 crates, pnpm exec vitest against the TS
services — including the Mawu Studio safety gates (generation-policy,
accessibility) and the Abundantia economy gates (payout-formula,
payout-eligibility, fraud-graph, currency-firewall).
Live ops today: a /health contract, not a metrics spine#
The honest qualification the architecture companion makes applies here in full.
Every V7 Rust service exposes a GET /health capability document via
apps/v7/service_contract.rs (run_health_server(&DESCRIPTOR) returns
{service, owner, version, status, port, purpose, capabilities} and 404s
everything else) — a readiness probe a load balancer or the Abundantia browser
can poll, not a Prometheus scrape surface. The platform's observability
libraries @oshun/metrics and @oshun/tracing are real and platform-wide
(libs/shared/metrics/src/ — registry, helpers, presets;
libs/shared/tracing/src/ — tracer, W3C propagation, middleware), but a grep
across apps/v7 and libs/v7 returns zero imports of either: the metric
vocabulary the spec names (realm population, mesh-node utilization,
authority-handoff latency, sandbox-budget overrun, scan-queue latency, economy
inflation) is inherited-but-unwired policy plus in-eval telemetry structs,
not a runtime gauge family. The truthful summary: live ops is a /health
contract plus telemetry encoded inside eval reports.
AI cost and fidelity tiering#
The cost controls are real Rust, not a budget memo.
danu-mesh-cluster/src/lib.rs implements three degradation levers under
DANU_AI_COST_FIDELITY_SCHEMA_VERSION, matching the feature doc's (a) meshing
tier, (b) balance agent-fleet depth, and (c) AI-assisted-creation usage:
danu_reduce_mesh_tier— under budget pressure a realm runs fewer sim nodes at a lower per-node cap; with no pressure (available ≥ nominal) the tier is unchanged and not flagged degraded.danu_ai_creation_fallback— AI creation falls back to thetemplate-asset-librarypath rather than metered generation.danu_crucible_reduced_coverage— Ixchel balance verification runs a reduced corner-case set (e.g. 90 of 200) and flags the reduced coverage; it never silently skips.
Each lever emits a DanuDegradationTelemetry { degraded, … } record, and the
eval asserts the budget-pressure case produces exactly three degraded
records while the nominal control case produces none. This is the "degrades
safely, observably" promise as a tested invariant: a realm under cost pressure
sheds fidelity in a way an operator can see, never in a way that lies about full
coverage.
Performance and asset budgets#
V7's budgets live in two honestly-different places. The numeric policy is stated inline: 60 fps / 16.7 ms on the reference client tier with a 30 fps floor on minimum spec (sustained in a meshed realm of 1000+ via interest-managed culling), authority handoff ≤250 ms p99 with no reconnect, netcode playable at 5% loss and graceful at 20%, per-client downstream 64–256 kbit/s, Pheme ≤40 audible streams per listener with p95 mouth-to-ear ≤250 ms at 1000-inhabitant scale, one-click Collection install p95 ≤120 s for 5 GB on 100 Mbit/s, and a Sekhmet scan-queue p95 ≤15 min upload-to-verdict.
A meaningful subset is encoded as constants that gates assert, which is
stronger than a documented number because a regression fails a test:
DANU_AOI_EVAL_INHABITANTS = 1_000 bounds the 1000-inhabitant working set;
REALM_DELTA_MIN/MAX_BANDWIDTH_KBPS = 64/256 (in libs/v7/realm-protocol) is
checked by the netcode gate's within_bandwidth_budget, and a
population-proportional bandwidth profile is a hard
PopulationDependentBandwidth violation;
REALM_INTERPOLATION_EVAL_LOSS_PERCENT = 5 backs the
playable-at-5%/graceful-at-20% gate; LISTEN_HOST_MIGRATION_SLA_MS = 2_000
backs the Listen-tier host-migration eval; and the mesh-handoff gate moves 200
entities 10,000 times without loss or reconnect. Honest label: there are no
typed @oshun/analytics V7 budget manifests of the kind V3 ships — the
per-tier frame-time validation is, for V7, inline policy plus these
constant-backed gates.
For asset budget and streaming, realms stream via the Maya world-streaming and Nanite-class pipeline; creator assets carry auto-generated runtime LODs; the compositor composes only the layers a realm pins; interest management bounds the per-client working set; and a realm declares an asset budget that the Mawu Studio linter warns against exceeding. This path is spec plus reused pipeline — V7 inherits the V5/V6 build/cook flow and has no V7-specific cook-profile tree, and its UE client is a ~2.2k-LOC procedural skeleton, not a content-complete cook.
Cross-platform and cross-progression#
A player is one identity everywhere. A single account ID with per-platform
linked credentials carries from V5, and characters, Hera crew membership, owned
mods/Collections, and creator earnings follow the account across platforms. The
portability is a real eval: run_v7_passport_eval
(libs/v7/substrate-bridge/src/lib.rs) round-trips a character into the V2–V6
destinations and into federated realms with Ori integrity, and
open_v7_realm_federation_corridor opens the realm-to-realm corridor a
character travels under federation treaty; Hera carries a
cross-version-group-presence record so a crew fields a team across versions.
Console crossplay follows the per-surface rules V5 defines (competitive surfaces
may pool by input device), and mod installs sync cross-platform through
Abundantia on the mod.io model, within the console-certification limits on which
sandbox tiers a console realm may grant. Honest label: the V1-identity
binding behind this is a mock seam today — default_substrate_bridge bindings
mark only the V6 Ori store and the Maya engine-core as Reused; V1 identity,
Aje, and the rest are deterministic local Mocks, which is what lets the
passport eval run without a live deployment but means the cross-platform
identity claim rests on a mocked boundary.
Region rollout strategy#
The rollout is staged, and the record is honestly negative.
V7/release/staged-rollout.json encodes the five stages from the feature doc —
creator-alpha → rp-beta → meshing-beta → economy-launch →
general-availability — each with its scope, the eval gates it depends on, and
an incident-response drill. Every stage carries status: "planned" and
decision: "pending", and a correctionNote re-marked 2026-06-12 states the
consequence plainly: all five were originally recorded "met" on the same day the
record was authored, without any stage ever being executed — no creator
alpha, no community realms, no real populations — and the IR drills logged in
them were code-level simulations (run_incident_response_drill fixtures), not
operational drills. The scripts/v7/verify-staged-rollout.mjs verifier enforces
advance-iff-met, so a stage cannot claim it advanced without being marked
met against its gates — the machinery that keeps the record from drifting back
to a flattering green.
Launch readiness and exit criteria#
§ Launch Readiness aggregates everything above, and its defining property is
that it is honestly not ready and structurally cannot lie about it.
V7/release/launch-readiness-review.json reads decision: "not-launch-ready".
All eight signoffs — trust boundary, Ixchel sandbox, Danu scale/handoff, Sekhmet
child-safety/IR, creator economy, anti-cheat, moderation/minor-protection, and
the all-realms safety floor — carry status: "fixture-passed" and the verbatim
evidenceBasis: "in-repo adversarial fixture; not a production measurement".
The checked-in correctionNote is unsparing: the original 2026-06-02
"launch-ready" decision predated any adversarial audit; the 100%/100%
precision-recall figures are fixture-toy signatures (6 true positives, 0 FP, 0
FN on seeded cases), not classifier performance against the 95% bar; the UE
client is a skeleton; and PhotoDNA, PDQ, CSAI Match, Thorn Safer, Lantern,
StopNCII, and EAC are not integrated.
The honesty is enforced, not promised. scripts/v7/verify-launch-readiness.mjs
encodes a no-fabrication invariant: if any signoff is fixture-passed, the
decision cannot be launch-ready (:378–388). The same verifier greps the
source for the eval functions and their key assertions, so a hand-edited
evidence file cannot pass while the code that would produce it is absent. V7
will be launch-ready — per the feature checklist — only when the Ixchel sandbox
contains a defined escape corpus with zero successes on launch-scale fixtures,
Danu sustains 1000+ with integrity-clean handoffs on a real cluster, Sekhmet
meets its malware/CSAM/grooming bars with the real vendor integrations and
passes an operational IR drill, the creator economy settles a test cohort's
payouts through Aje with KYC/tax/reserve and the anti-fraud gates, anti-cheat
meets its precision/recall bar on community servers, moderation and
minor-protection meet their safety bars, and the Lilith/Kuanyin safety floor is
proven enforced on every realm regardless of owner configuration.
V7 exit criteria are deliberately conjunctive: a creator can author, host, and publish a server-authoritative, fully-moddable realm with executable logic that a player joins cross-platform; mods compose as Ixchel layers with SAT-resolved dependencies and Collections install reproducibly; a meshed realm carries 1000+ with clean handoff and dynamic split/merge; persistent characters, jobs/economy, civic institutions, proximity+radio voice, and the crew graph persist and travel under federation treaty; untrusted code runs only in the six-tier sandbox under budgets, every artifact scanned and content-addressed; creators are paid and communities self-govern; and a character is portable into V2–V6 with no loss of the V1 trust guarantees. Until each flips on real evidence, the verifier keeps the aggregate negative — which, pre-GA, is worth more than a green that lies.
Where this connects#
- The streaming, spectating, and live-service loop this page's rollout and launch cadence run alongside: ./streaming-incarnation-and-live-service.md.
- The product promise and design posture every commitment here is downstream of, including the mock-seam map this page reuses: ./overview-promise-and-posture.md.
- The architecture companion — the
/healthcontract, the constant-backed budgets, the 29 gates, the golden-replay determinism guard, and the de-fabricated launch verifier in engineering depth: ../architecture/observability-performance-and-launch.md. - The feature catalogue this page belongs to: ../V7_features.md.