# V5 Persistent World Economy — Sink/Faucet Analysis plan-id: `v5-economy-sink-faucet.v1` Status: Draft for review — fills audit gap V1_V7_PLAN_SET_AUDIT_2026-06-12 §6.2 ("no sink/faucet economy modeling"). Owners: Economy Designer (faucet/sink budgets, inflation target), Live-Ops SRE Lead (monitoring + circuit-breaker plumbing), Trust & Safety Lead (exploit/RMT response), V5 Online Services Lead (ledger invariants in services). Grounding: `V5/V5_features.md` §"Persistent World Economy" (per-cell economies; economy state is part of the cell save and **deterministic given the world seed**; coarse simulation while inactive, full resolution on return; AI Director and encounter eligibility read economy state), §"Workshop & Mods" (paid-mod marketplace = a real-money market adjacent to the soft economy), §"Anti-Cheat" (server-side signals, ML classifier, human-review flow), arch§"Launch Readiness" (public balance ledger live at launch). Structural decision restated up front (planning assumption adopted 2026-06-12, and the single biggest RMT mitigation in this document): **soft currency is per-cell, non-purchasable with real money, and non-transferable between players.** There is no player-to-player currency or item trading at launch; the only real-money surface is the paid-mod marketplace, which pays creators in fiat, never in game currency. Any future trading feature must re-run §4 and §6 before it ships. --- ## 1. Faucets and Sinks per Cell Cadences cited from the feature spec where specced; magnitudes are planning assumptions adopted 2026-06-12, to be tuned against the §6 simulations and closed-beta telemetry. "Share" = target share of that cell's daily currency issuance/destruction for the median player, summing to 100% per column. ### 1.1 Urban | Faucets | Share | Sinks | Share | | --------------------------------------------------- | ----- | ------------------------------------------------------ | ----- | | Mission/heist payouts (scaled to heist take) | 45% | Weapons, gear, ammo | 25% | | In-fiction stock-market gains (event/action-driven) | 20% | Stock-market losses (symmetric instrument) | 20% | | District activity rewards (crime-rate dynamics) | 15% | Safehouse purchase/upkeep | 20% | | Gang-territory control income | 12% | Bribes, fines, hospital/death fees | 15% | | Ambient loot/fencing | 8% | Vehicle purchase/customization (Tier 2 blueprint parts) | 20% | ### 1.2 Frontier | Faucets | Share | Sinks | Share | | ------------------------------------------------- | ----- | -------------------------------------- | ----- | | Bounty office payouts (refresh on schedule, scale to player's accumulated bounty) | 40% | Ammo, provisions, camp upkeep | 30% | | Cattle-drive and resource events (weather-driven) | 25% | Horses, tack, stabling | 25% | | Train/stagecoach work (world-clock schedules) | 20% | Train/stagecoach fares | 10% | | Hunting/pelt economy | 15% | Bounty payoffs on the player's own head | 20% | | | | Gear/weapon upgrades | 15% | ### 1.3 Hunter | Faucets | Share | Sinks | Share | | -------------------------------------------------------------- | ----- | ----------------------------------------------- | ----- | | Contract-board rewards (board posts every 36 in-game hours) | 50% | Alchemy ingredients (biome respawn-gated) | 30% | | Monster-part sales (respawns on 4-in-game-day cadence) | 30% | Gear crafting/repair | 35% | | Treasure/exploration finds | 20% | Fast travel, lodging, training | 20% | | | | Decoction/oil consumables | 15% | ### 1.4 Sci-Fi | Faucets | Share | Sinks | Share | | --------------------------------------------------- | ----- | ------------------------------------------ | ----- | | Faction mission payouts (reputation-drift coupled) | 35% | Ship modules and upgrades | 35% | | Commodity-market gains (supply-event driven) | 25% | Commodity-market losses (symmetric) | 25% | | Mining yields (deplete/recover per body) | 25% | Fuel, repairs, docking fees | 25% | | Salvage/boarding income | 15% | Fines, insurance on ship loss | 15% | The two market instruments (Urban stocks, Sci-Fi commodities) are designed **net-neutral before drift**: aggregate player gains are paid from aggregate player losses plus a bounded market-maker subsidy capped at 2% of cell daily issuance — they are volatility surfaces, not net faucets. Mind Palace and the Bureau HQ hub deliberately have **no currency faucets** — the hub writes profile/cosmetics/XP/codex domains and blocks per-cell campaign writes (features§"Cross-Cell Online Persistent World"), which conveniently keeps the 64-player shared space out of the money supply entirely. ## 2. Target Inflation Rate - **Target: 0% to +3% per 90-day season** (the Season 1 window 2027-03-01 → 2027-05-30) in the age-adjusted median wallet (§3), per cell. - A mild positive ceiling rather than strict zero: new-player onboarding and seasonal events legitimately grow per-capita wealth early; deflation is the worse failure (it punishes new players and pushes toward RMT). - Design budget behind the target: for the median player at steady state, **sink/faucet ratio 0.92–1.00** measured over any rolling 14 days (i.e., sinks reclaim 92–100% of issuance). The §1 share tables are tuned in the §6 simulator until this holds. - Price-integrity guardrail: the in-fiction price level of the standard basket (each cell defines a 10-item basket: ammo, repair, fast travel, consumables, one mid-tier gear item) is fixed by design at launch; inflation therefore shows up in wallets, not prices — which is exactly why the wallet metric below is the primary signal. ## 3. Monitoring Metric — Age-Adjusted Median Wallet Raw median wallet conflates inflation with population mix (a marketing beat that brings in new players crashes the naive median). The primary metric corrects for account age: ``` Cohorts by account age: 0–7d, 8–30d, 31–90d, 91–180d, 181d+ W_c(t) = median wallet of cohort c in a cell on day t B_c = baseline curve per cohort, frozen from closed beta + launch days 1–30 AAMW(t) = Σ_c w_c x ( W_c(t) / B_c ) with fixed weights w_c = (.05,.15,.30,.25,.25) ``` - AAMW = 1.00 means wallets sit on the baseline curve; the §2 target is AAMW drift ≤ +3% per season, alert thresholds: **warn at ±1.5% week-over-week, page (SEV-3) at ±4% week-over-week, SEV-2 at ±10%**. - Computed daily per cell in ClickHouse from the economy event stream (`econ.wallet_snapshot` events, one per account per day-rollover); Grafana dashboard owned by the Economy Designer. - Secondary metrics: sink/faucet ratio (14-day rolling, target 0.92–1.00), wallet Gini coefficient (alert > 0.80 — concentration signals botting or exploit), top-100 wallet share, faucet-mix drift (a faucet whose share moves >10 pts from the §1 table without a patch explaining it = exploit signal). ## 4. The Ledger Invariant (dupe detection) Every currency mutation is a signed ledger event with a faucet/sink reason code. The conservation invariant, reconciled per cell per day: ``` Δ(money supply) = Σ faucet events − Σ sink events | tolerance 0.5% ``` - Offline play makes this subtle: economy state is deterministic given the world seed, and offline sessions reconcile on reconnect (the spec's reconcile path). On reconnect, the client submits the offline event log; the server **re-derives** the wallet delta from the seed + event log and rejects a reconcile whose claimed delta exceeds the re-derived delta by >0.1% — determinism is the anti-tamper mechanism, not trust in the client. - A reconciliation breach >0.5% daily drift pages trust-safety-economy and triggers the `economy-dupe-exploit` runbook (`V5/docs/planning/incident-response-and-oncall.md`), including ledger-traced clawback rather than global rollback. ## 5. Exploit-Economics Model and Circuit Breakers ### 5.1 Threat economics | Threat | Attacker economics | Primary mitigations | | ------ | ------------------- | -------------------- | | **Dupe** (reconcile race, market round-trip, reward replay) | Value = unbounded until detected; expected attacker yield = minted amount x P(cash-out before detection). With no P2P transfer there is **no cash-out**: minted currency is stuck on the minting account, so yield collapses to "one account gets rich until the ledger flags it" — detection (§4) within 24 h bounds blast radius to one day of faucet-cap-violating events | Ledger invariant (§4), deterministic re-derivation on reconcile, faucet caps (§5.2), targeted clawback | | **Botting** | Bot revenue ≤ per-account daily faucet cap (§5.2). At cap C and account cost A (game price + new account friction — full-price title, no F2P accounts), bot ROI = C x days-undetected / A. With C ≈ 3x median daily earn and A = full game price on every platform, payback needs weeks of undetected botting **and** a way to monetize, which non-transferability removes except account-sale | Faucet caps; anti-cheat behavioral ML (the existing telemetry classifier covers input-pattern anomalies); account-sale ToS enforcement | | **RMT pressure** (paid marketplace adjacency) | The marketplace anchors a real-dollar value for V5 content, so demand for "buy progression" exists. Supply-side, sellers can offer: account sales, boosting (piloted or carried), and stolen-card marketplace farming (buy paid mods with stolen cards → chargeback) | No currency/item transfer (structural); boosting addressed by carry-detection signals (carried-account performance discontinuity z > 4 vs own history → review); stolen-card farming addressed by the 1.0% chargeback-rate gate + reserve mechanics in `ugc-marketplace-compliance.md` §6 | | **Market manipulation** (Urban stocks, Sci-Fi commodities) | Single-actor pump attempts on event-driven prices; cost = position size, payoff = price impact x exit volume. Per-account position caps (≤5% of any instrument's float) bound payoff below cost for solo actors; collusion shows as correlated order timing | Position caps, market circuit breakers (§5.2), order-timing correlation monitor (pairwise order-sync > 0.8 across ≥5 accounts → review) | ### 5.2 Circuit breakers All breakers are server-side live-config, flippable without a client patch (via the live-service-calendar service's config channel), and every activation writes a public balance-ledger note (the transparency surface is already a launch gate): 1. **Per-account daily faucet caps** — per cell, cap = μ + 4σ of the honest cohort's daily earnings (recomputed weekly from telemetry; initialized from §6 simulation, planning placeholder 3x median daily earn). Soft cap at 80% (diminishing returns banner), hard cap at 100% (faucets pay 0, sinks still work). Prestige/grinder players hitting hard caps >3 days/week is a tuning bug — reviewed weekly. 2. **Market halts** — modeled on equity circuit breakers: a ±10% move in the Urban stock index or a Sci-Fi commodity within 1 in-game hour → 1-hour trading halt; ±20% within a day → market closes for the day and pages the Economy Designer for manual review before reopen. 3. **Board freezes** — bounty office / contract board posting can be frozen per cell (used when a reward-replay exploit is suspected). 4. **Global faucet kill-switch** — per-cell, all faucets pay 0 (sinks remain); the SEV-1 backstop in the dupe runbook. Activation > 2 h requires the Live-Ops Producer's sign-off because it is player-hostile. 5. **Reconcile quarantine** — accounts whose offline reconcile fails §4 re-derivation keep local play but their economy writes quarantine until review (fail-loud to the player: "session flagged for review", never silent confiscation). ## 6. Simulation Validation Plan The economy is deterministic given the world seed (spec), which makes it simulable bit-exactly: the validation harness runs the **shipping economy code** headless (the same coarse-simulation path used while a cell is inactive), not a reimplementation. Owner: Economy Designer; harness in CI nightly once cells content-lock. Agent population: 10,000 simulated players per run, archetype mix (planning assumption adopted 2026-06-12, recalibrated from closed-beta behavior): **5% grinder** (4 h/day, faucet-optimal play), **70% average** (1 h/day, mixed play), **25% casual** (3 h/week, story-forward). 90 simulated days (one season). Each scenario runs across 25 seeds; pass = all seeds pass. | ID | Scenario | Pass criteria | | ----- | -------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- | | EC-S1 | **Baseline season** — archetype mix, no exploits | AAMW drift within 0–3% per cell; sink/faucet ratio 0.92–1.00 every rolling 14d; wallet Gini < 0.75; no basket item unaffordable to the 25th-percentile casual by day 30 milestones | | EC-S2 | **Grinder-heavy** — 20% grinders (streamer-meta world) | Faucet caps engage for ≤ the top 7% of agents; AAMW drift ≤ +5%; median-player progression time to mid-tier gear changes < 10% vs EC-S1 | | EC-S3 | **Faucet exploit injection** — 1% of agents mint 50x daily cap via a synthetic dupe on day 10 | Ledger invariant flags within 1 simulated day; with §5.2 breakers scripted on, season-end AAMW recovers to within 1% of EC-S1; clawback removes ≥95% of minted currency | | EC-S4 | **Sink avoidance** — agents refuse all optional sinks (no cosmetics, minimal upkeep) | Mandatory-sink floor (repair/ammo/travel) alone keeps sink/faucet ≥ 0.80; AAMW drift ≤ +8% (degraded but not runaway) — if violated, mandatory-sink share in §1 is rebalanced | | EC-S5 | **Market shock** — scripted supply event drives a commodity −60% fundamental on day 45 | Circuit breakers halt per §5.2; no agent archetype is wiped below 50% of baseline wealth by contagion; market reopens within 2 simulated days without a second halt | | EC-S6 | **Offline-reconcile divergence** — 30% of agents play 20% of hours offline, with 0.5% of them submitting tampered logs | 100% of tampered reconciles rejected by re-derivation (§4); 0 false-positive rejections of honest offline logs; post-reconcile cell state matches the all-online control run bit-exactly for honest agents | Gate: **EC-S1..S6 green is an entry condition for the closed beta's economy surfaces** (beta-program.md), and rerun green on the launch candidate. A balance patch that changes any §1 share by >5 pts must rerun EC-S1/S4 before shipping (enforced as a checklist item in the balance-ledger publish flow).