# Lilith Metaverse Worlds and Presence

Lilith Metaverse is V3's embodied multi-user substrate. One authoritative world
and protocol support premium Unreal clients, browser access through Pixel
Streaming, and a reduced-fidelity local web fallback without creating a weaker
identity or safety tier.

```mermaid
sequenceDiagram
  actor Member
  participant Launch as V3 launch service
  participant Identity as V1 identity and policy bridge
  participant World as Authoritative world server
  participant Realtime as Gateway voice and presence
  participant Client as UE Pixel Streaming or Tier 2 client
  Member->>Launch: Enter a world or tenant experience
  Launch->>Identity: Resolve account entitlement tenant consent and safety
  alt no eligible realtime tier
    Identity-->>Launch: Denied or reduced-fidelity posture
    Launch-->>Client: Static or Tier 2 honest fallback
  else admitted
    Identity-->>Launch: Scoped world session
    Launch->>World: Create or resume authoritative presence
    World->>Realtime: Bind transport voice interest and moderation context
    Realtime-->>Client: Session and negotiated capabilities
    Client-->>Member: Embodied world at selected fidelity
    Client->>World: Versioned input and actions
    World-->>Client: Authoritative state events and recovery markers
  end
```

Rendering tier changes fidelity and transport, not identity, entitlement,
moderation, rights, or safety authority.

## Client and launch tiers

| Surface         | Runtime                          | Purpose                                                                                     | Honest boundary                                                                  |
| --------------- | -------------------------------- | ------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
| Native Tier 1   | Unreal Engine 5.5 client         | Premium desktop, VR, console, and supported mobile fidelity.                                | Requires platform build, optional art/audio plugins, and compatible hardware.    |
| Browser Tier 1  | UE Pixel Streaming               | Full UE rendering delivered to a thin browser client.                                       | Requires regional GPU worker/signaller capacity and WebRTC conditions.           |
| Tier 2 fallback | Next.js + three.js/WebGPU/WebGL2 | Locally rendered access for constrained devices, networks, or regions.                      | Deliberately reduced visual/crowd fidelity; trust and identity do not downgrade. |
| Static/degraded | Product-defined fallback         | Preserve access to information or archived/on-demand experience when realtime cannot start. | Does not claim live presence.                                                    |

The launch decision is a typed server contract with reason codes, not a
client-side guess. The architecture and exact status are documented in
[Product promise and architecture](../../architecture/product-promise-and-architecture.md)
and
[Tier routing and Pixel Streaming](../../architecture/tier-routing-and-pixel-streaming.md).

## Authoritative world model

The world server owns rooms, membership, presence, entity state, physics
validation, interest management, persistence, and reconnect/resume semantics.
Clients predict or render; they do not become authoritative because they run a
high-fidelity engine.

Rooms bind a tenant, venue/mode, capacity regime, region/shard, activated Game
Feature data, moderation/safety posture, and persistence policy. Interest
management limits which entities and updates a client receives based on spatial
relevance and tier. Capacity tiers, wire bandwidth tiers, and voice-realm tiers
are distinct vocabularies and must not be treated as one enum.

See [World server and gateway](../../architecture/world-server-and-gateway.md)
and
[World, rooms, presence, and multiplayer](../../features/world-rooms-presence-multiplayer.md).

## Network and transport

The realtime gateway mediates authenticated transport and voice. The protocol is
shared across TypeScript, Rust, and Unreal representations; golden fixtures
protect wire compatibility. Depending on client/network, transport can use
WebTransport/QUIC, WebRTC, or WebSocket fallback under a declared policy.

Reconnect preserves session and shard intent only when the resume token,
authorization, room version, and retention window remain valid. A reconnect is
not proof that every transient action or voice frame was recovered; the UI must
show the actual state.

## Presence and embodiment

Presence binds a V1 account/session to a world participant and avatar under
visibility, privacy, moderation, and swap/cooldown rules. Presence includes
connection state, room, pose/transform, nameplate/identity presentation,
speaking state, and relevant activity—not unrestricted personal metadata.

Embodiment responsibilities include:

- VRM/community and MetaHuman/premium avatar paths;
- skeleton retargeting, animation, IK, locomotion, and pose policy;
- viseme/lip synchronization and speaking indicators;
- costume slots and body-safety constraints;
- nameplate and avatar LOD by distance/capacity;
- personal-space, block/mute, reporting, and moderation controls;
- reduced-motion, seated, single-switch, and other access modes.

The focused feature document is
[Avatars, nameplates, and spatial audio](../../features/avatars-nameplates-spatial-audio.md).

## Spatial voice and audio

Voice passes through the realtime gateway/SFU and is rendered spatially by the
client tier. Policy covers mic permission, speaking indicators, mute/block,
recording consent, voice abuse, moderation access, region/room rules, and
degraded stereo or text alternatives. Ambient audio, MetaSounds, performance
audio, and participant voice are separate buses with separate priority and
rights.

Crowd scale may change mix strategy and update bandwidth, but it does not make
consent or abuse controls optional.

## World streaming and Game Features

The UE project contains always-loaded modules plus Game Feature plugins that
scope tenant/mode data and activation. Activating a descriptor does not prove a
complete venue or gameplay implementation; the handbook and architecture pages
distinguish content descriptors, module skeletons, authored assets, and tested
behavior.

Scene streaming coordinates world cells, room mode, asset bundle/version,
participant readiness, and safe fallback. Join should not expose a user to a
partially initialized unsafe state; leave/reconnect should release resources and
preserve only declared persistence.

## Accessibility and fidelity parity

Parity means the same identity, authorization, presence semantics, safety,
consent, and core participation—not identical pixels. Reduced-fidelity clients
must disclose omitted effects or crowd detail while preserving essential
navigation, captions/transcripts where supported, audio controls, reduced
motion, photosensitive-safe presentation, color-vision accommodations, and input
alternatives.

The quality and localization surface is documented in
[Accessibility, localization, and quality](../../features/accessibility-localization-quality.md).

## Persistence and cross-device continuity

Durable world state, tenant data, member continuity, and transient realtime
state are separate. The world server and tenant schemas persist declared
records; Iris owns personal memory/identity continuity; the realtime protocol
carries ephemeral state. A client handoff reauthorizes access and resolves
conflicts rather than copying a live socket state blindly.

## Failure and recovery

- Pixel Streaming capacity unavailable: route to native, Tier 2, or declared
  static fallback with the reason visible.
- Gateway transport failure: follow the bounded fallback ladder and show
  reconnect state.
- Shard/world failure: preserve authoritative checkpoints and avoid duplicate
  commerce or attendance receipts.
- Voice failure: retain text/visual participation and accurate speaking state.
- Missing optional art/audio plugin: fail the feature gate or use the declared
  asset fallback; never claim premium fidelity.
- Client mismatch: enforce protocol/content compatibility and guide update or
  compatible fallback.

## Related

- [Platform services, data, and integrations](./platform-services-data-and-integrations.md)
- [Operations, performance, testing, and release](./operations-performance-testing-and-release.md)
- [Client tiers, fidelity, and stadium](../../features/client-tiers-fidelity-stadium.md)
- [Netcode, protocol, and physics](../../architecture/netcode-protocol-and-physics.md)