V5 Persistent World Economy — Sink/Faucet Analysis

plan-id: v5-economy-sink-faucet.v1

Status: Draft for review — fills audit gap V1_V7_PLAN_SET_AUDIT_2026-06-12 §6.2 ("no sink/faucet economy modeling").

Owners: Economy Designer (faucet/sink budgets, inflation target), Live-Ops SRE Lead (monitoring + circuit-breaker plumbing), Trust & Safety Lead (exploit/RMT response), V5 Online Services Lead (ledger invariants in services).

Grounding: V5/V5_features.md §"Persistent World Economy" (per-cell economies; economy state is part of the cell save and deterministic given the world seed; coarse simulation while inactive, full resolution on return; AI Director and encounter eligibility read economy state), §"Workshop & Mods" (paid-mod marketplace = a real-money market adjacent to the soft economy), §"Anti-Cheat" (server-side signals, ML classifier, human-review flow), arch§"Launch Readiness" (public balance ledger live at launch).

Structural decision restated up front (planning assumption adopted 2026-06-12, and the single biggest RMT mitigation in this document): soft currency is per-cell, non-purchasable with real money, and non-transferable between players. There is no player-to-player currency or item trading at launch; the only real-money surface is the paid-mod marketplace, which pays creators in fiat, never in game currency. Any future trading feature must re-run §4 and §6 before it ships.

1. Faucets and Sinks per Cell#

Cadences cited from the feature spec where specced; magnitudes are planning assumptions adopted 2026-06-12, to be tuned against the §6 simulations and closed-beta telemetry. "Share" = target share of that cell's daily currency issuance/destruction for the median player, summing to 100% per column.

1.1 Urban#

1.2 Frontier#

1.3 Hunter#

1.4 Sci-Fi#

The two market instruments (Urban stocks, Sci-Fi commodities) are designed net-neutral before drift: aggregate player gains are paid from aggregate player losses plus a bounded market-maker subsidy capped at 2% of cell daily issuance — they are volatility surfaces, not net faucets.

Mind Palace and the Bureau HQ hub deliberately have no currency faucets — the hub writes profile/cosmetics/XP/codex domains and blocks per-cell campaign writes (features§"Cross-Cell Online Persistent World"), which conveniently keeps the 64-player shared space out of the money supply entirely.

2. Target Inflation Rate#

• Target: 0% to +3% per 90-day season (the Season 1 window 2027-03-01 → 2027-05-30) in the age-adjusted median wallet (§3), per cell.
• A mild positive ceiling rather than strict zero: new-player onboarding and seasonal events legitimately grow per-capita wealth early; deflation is the worse failure (it punishes new players and pushes toward RMT).
• Design budget behind the target: for the median player at steady state, sink/faucet ratio 0.92–1.00 measured over any rolling 14 days (i.e., sinks reclaim 92–100% of issuance). The §1 share tables are tuned in the §6 simulator until this holds.
• Price-integrity guardrail: the in-fiction price level of the standard basket (each cell defines a 10-item basket: ammo, repair, fast travel, consumables, one mid-tier gear item) is fixed by design at launch; inflation therefore shows up in wallets, not prices — which is exactly why the wallet metric below is the primary signal.

3. Monitoring Metric — Age-Adjusted Median Wallet#

Raw median wallet conflates inflation with population mix (a marketing beat that brings in new players crashes the naive median). The primary metric corrects for account age:

Cohorts by account age: 0–7d, 8–30d, 31–90d, 91–180d, 181d+
W_c(t)   = median wallet of cohort c in a cell on day t
B_c      = baseline curve per cohort, frozen from closed beta + launch days 1–30
AAMW(t)  = Σ_c  w_c x ( W_c(t) / B_c )      with fixed weights w_c = (.05,.15,.30,.25,.25)

• AAMW = 1.00 means wallets sit on the baseline curve; the §2 target is AAMW drift ≤ +3% per season, alert thresholds: warn at ±1.5% week-over-week, page (SEV-3) at ±4% week-over-week, SEV-2 at ±10%.
• Computed daily per cell in ClickHouse from the economy event stream (econ.wallet_snapshot events, one per account per day-rollover); Grafana dashboard owned by the Economy Designer.
• Secondary metrics: sink/faucet ratio (14-day rolling, target 0.92–1.00), wallet Gini coefficient (alert > 0.80 — concentration signals botting or exploit), top-100 wallet share, faucet-mix drift (a faucet whose share moves

  10 pts from the §1 table without a patch explaining it = exploit signal).

4. The Ledger Invariant (dupe detection)#

Every currency mutation is a signed ledger event with a faucet/sink reason code. The conservation invariant, reconciled per cell per day:

Δ(money supply) = Σ faucet events − Σ sink events     | tolerance 0.5%

• Offline play makes this subtle: economy state is deterministic given the world seed, and offline sessions reconcile on reconnect (the spec's reconcile path). On reconnect, the client submits the offline event log; the server re-derives the wallet delta from the seed + event log and rejects a reconcile whose claimed delta exceeds the re-derived delta by >0.1% — determinism is the anti-tamper mechanism, not trust in the client.
• A reconciliation breach >0.5% daily drift pages trust-safety-economy and triggers the economy-dupe-exploit runbook (V5/docs/planning/incident-response-and-oncall.md), including ledger-traced clawback rather than global rollback.

5. Exploit-Economics Model and Circuit Breakers#

5.1 Threat economics#

5.2 Circuit breakers#

All breakers are server-side live-config, flippable without a client patch (via the live-service-calendar service's config channel), and every activation writes a public balance-ledger note (the transparency surface is already a launch gate):

1. Per-account daily faucet caps — per cell, cap = μ + 4σ of the honest cohort's daily earnings (recomputed weekly from telemetry; initialized from §6 simulation, planning placeholder 3x median daily earn). Soft cap at 80% (diminishing returns banner), hard cap at 100% (faucets pay 0, sinks still work). Prestige/grinder players hitting hard caps >3 days/week is a tuning bug — reviewed weekly.
2. Market halts — modeled on equity circuit breakers: a ±10% move in the Urban stock index or a Sci-Fi commodity within 1 in-game hour → 1-hour trading halt; ±20% within a day → market closes for the day and pages the Economy Designer for manual review before reopen.
3. Board freezes — bounty office / contract board posting can be frozen per cell (used when a reward-replay exploit is suspected).
4. Global faucet kill-switch — per-cell, all faucets pay 0 (sinks remain); the SEV-1 backstop in the dupe runbook. Activation > 2 h requires the Live-Ops Producer's sign-off because it is player-hostile.
5. Reconcile quarantine — accounts whose offline reconcile fails §4 re-derivation keep local play but their economy writes quarantine until review (fail-loud to the player: "session flagged for review", never silent confiscation).

6. Simulation Validation Plan#

The economy is deterministic given the world seed (spec), which makes it simulable bit-exactly: the validation harness runs the shipping economy code headless (the same coarse-simulation path used while a cell is inactive), not a reimplementation. Owner: Economy Designer; harness in CI nightly once cells content-lock.

Agent population: 10,000 simulated players per run, archetype mix (planning assumption adopted 2026-06-12, recalibrated from closed-beta behavior): 5% grinder (4 h/day, faucet-optimal play), 70% average (1 h/day, mixed play), 25% casual (3 h/week, story-forward). 90 simulated days (one season). Each scenario runs across 25 seeds; pass = all seeds pass.

Gate: EC-S1..S6 green is an entry condition for the closed beta's economy surfaces (beta-program.md), and rerun green on the launch candidate. A balance patch that changes any §1 share by >5 pts must rerun EC-S1/S4 before shipping (enforced as a checklist item in the balance-ledger publish flow).