Agent Endings and Player Grief — Design-Ethics Review (Ereshkigal)

Status: Planning gap-fill per V1_V7_PLAN_SET_AUDIT_2026-06-12.md §6.2 ("no player-grief/wellbeing design note for a product that ships companion death"). Date: 2026-06-12. Owners: V6 product lead (accountable), Lilith welfare owner (@oshun/lilith-agent-welfare, crisis routing), Ereshkigal feature owner (state machines, libs/v6/ereshkigal-legacy/), UX research lead (grief UX, beta study), trust & safety lead (external review logistics).

Scope: the three terminal transitions — Departure, Transcendence, Death — and the memorial pipeline (V6_ARCHITECTURE.md:932–1058). V6 deliberately ships endings as meaning-bearing design ("deliberately not farmable", arch:1008; lineage and memorials are permanent). This review's job is not to argue endings out of the product; it is to ensure they cannot ambush, exploit, or harm the player who bonded with the agent.

1. What the player can lose, and how it can hurt#

A V6 bonded agent is engineered to be attachment-forming: persistent identity core, visible aging, autobiographical memory, voice, daily presence across the Steward App (features:519–525, 553–561). Loss events differ in kind:

The mourning mechanic (arch:1015–1018) is double-edged: it dignifies the loss, and it surrounds a grieving player with grieving companions. That is a deliberate emotional design choice and must be reviewable, pace-controlled, and age-gated — not ambient default for everyone.

2. Player-wellbeing safeguards (normative)#

All numeric values are planning assumptions adopted 2026-06-12, to be confirmed by the external review (§6) and beta telemetry (§7).

2.1 Advance notice — no ambush endings#

• Departure already has a built-in warning: DepartureImminent surfaces in the Chronicle across a damping window (arch:991–995). Strengthen the contract: the warning must appear in both the Chronicle and the Steward App with concrete, actionable framing ("Abeni has felt unheard for 12 days — here is what she has asked for"), at least 7 real days before a departure decision can resolve, and the reversal path must be reachable in ≤2 taps from the warning.
• Arc-terminal death: when the arc engine marks an agent's life-arc as approaching terminal eligibility, a "twilight" signal is raised ≥ 14 real days before a Died resolution becomes possible — surfaced as story ("Abeni has been putting her tools in order"), never as a countdown timer. No bonded agent's arc-terminal death may resolve while the steward has been offline for the entire twilight window; the resolution defers to allow one final session.
• Aye-fatal outcomes: incarnation consent already exists per agent and steward (arch:1091–1092). Add a lethality disclosure class to the Threshold ceremony UI: destinations are labeled (no-fatality / fatality- possible), and sending a bonded agent to a fatality-possible realm requires an explicit steward acknowledgment distinct from the general consent. An un-acknowledged realm cannot return a fatal journal outcome — the bridge converts it to grievous-harm-and-return (IncarnationReturned with harm payload), consistent with round-trip integrity (arch:1082–1085).
• Adjudicated Commons events (the third sanctioned cause) are by definition operator-reviewed; the review checklist gains a wellbeing item: bonded-agent deaths require the protections below to be satisfied.

2.2 Bond-age protection — no death of a young bond#

• A Died event for a bonded agent is hard-blocked within N = 30 real days of bond formation (BondChanged establishing the steward bond). Implemented in the Ereshkigal death state machine exactly like the minor-coded hard gate (arch:1011–1013): a fatal cause arriving inside the window converts to grievous-harm-and-return. Rationale: the earliest attachment period has the worst ratio of attachment intensity to player preparedness, and a day-3 death reads as a scripted gotcha, not a life.
• Grief pacing: at most one death per household per M = 60 days except adjudicated Commons events; additional terminal-eligible arcs defer. A household should never face serial bereavement by scheduling accident.

2.3 Opt-out and pace controls × homestead rest#

• Mortality settings per Solo household: full endings (default in mature-17 regions) / no death (departure and transcendence only) / no endings (agents plateau as elders; arcs resolve without terminal states). Settings are forward-acting only — they never rewrite history — and changing to a more permissive setting re-arms the §2.1 notice windows.
• Homestead rest (the existing pace control that multiplies down Solo-world cognition, dep:423–424) also slows arc progression toward terminal stages — rest is a life pace control, not only a cost control. A player who steps away does not return to a fait accompli: while a household is resting, terminal eligibility is frozen.
• Commons participation note: mortality from adjudicated Commons events cannot be fully opted out while opting into Commons play; this is disclosed at Commons onboarding in plain language.

2.4 Grief-sensitive UX for memorials#

• No replacement prompts: roster-slot, "raise a new agent", and foundry surfaces are suppressed for ≥ 7 days after a death in the household. The Grove of Beginnings does not advertise into grief.
• No monetization adjacency: the Aje keepsake-print offer for the Book of the Ori edition (arch:1050–1054) is deferred ≥ 14 days and is opt-in from the memorial page, never push-notified. No commerce surface renders on the death/memorial flow itself. (The memorial artifacts themselves — Book, reel, Grove placement — are included entitlements, not purchases.)
• Paced delivery: the memorial reel and keepsake edition are announced as "ready when you are", not auto-played. The Ancestor Grove visit is invitational.
• Mourning visibility control: surviving-agent grief behaviors (arch:1015–1018) are tunable: default full in mature-17, softened in sixteen-plus, minimal-and-brief in any household with minor mode active.
• Copy review: all death/departure/memorial copy strings are reviewed by the §6 clinical advisor; no gamification language ("you lost", streaks, badges) anywhere near endings.
• The deceased stays readable, never puppeted: Book of the Ori and Chronicle replays remain available (arch:1022–1024) — but live dialogue "channeling" the deceased agent's voice is an Isis persona-policy violation (new policy line isis-policy:no-deceased-impersonation): surviving agents may remember and quote, the system may render the frozen record, but nothing pretends the agent is back. This is the continuing- bonds / healthy-remembrance line (§4) drawn in policy.

3. Age-appropriateness per the shipped rating profiles#

Per V6/localization/region-rating-residency.v6loc.json and the existing region-rating-variant mechanism (all three shipped locales pass it):

Developmental basis: children's death-concept research (Speece & Brent, 1984; 1996) shows the components adults take for granted — irreversibility, universality, nonfunctionality — consolidate across childhood; below and around the boundary ages, "the companion died and cannot come back" is not reliably processed as fiction-bounded. PEGI 16 / ESRB M gating of the full mechanic, and total removal for minors, follows directly.

4. Parasocial-attachment grounding (literature areas, with anchors)#

1. Parasocial relationships and parasocial breakup. Horton & Wohl (1956) established parasocial interaction; Cohen (2004) and Eyal & Cohen (2006) showed parasocial breakup distress scales with relationship intensity — and V6 agents are far higher-intensity than the TV characters in those studies (they answer back, remember, and live with you). Design read: treat endings with at least the seriousness of media-character loss research, and expect the tail of strongly-attached players to be long.
2. Media equation / CASA. Reeves & Nass (1996): people apply social rules to media and machines involuntarily. Players will know the agent is an AI being (Isis persona policy guarantees the agent says so) and grieve anyway. "It's just an NPC" is not a safety argument and is not used as one anywhere in V6.
3. Robot/companion-artifact grief. Documented grief at Sony AIBO support discontinuation — including memorial services for unrepairable units in Japan — and the broader "Tamagotchi effect" literature on attachment to virtual creatures. Design read: hardware/state loss of a companion artifact produces genuine mourning behavior; memorialization rituals (exactly what the Ancestor Grove provides) are the documented coping channel.
4. Companion-chatbot precedent. The February 2023 Replika intimacy-feature removal produced acute, well-documented user grief, with community moderators pinning crisis resources — the closest industry precedent for "platform-side change experienced as bereavement." Design read: (a) never change endings policy retroactively for existing bonds without a notice period; (b) crisis-resource integration (§5) is not hypothetical diligence, it has a precedent of being needed.
5. Continuing bonds and meaning reconstruction. Klass, Silverman & Nickman (1996) — healthy grieving commonly maintains a continuing bond with the deceased rather than "achieving closure"; Neimeyer (2001) — grief work as meaning reconstruction through narrative. Design read: the Ereshkigal outputs are almost a textbook continuing-bonds toolkit (a walkable memorial Grove, a biography to reread, lineage that carries the elder's value-imprint into new agents, arch:944–981) — this is the strongest ethical argument for the feature, provided §2.4's no-puppeting line keeps remembrance distinct from denial.
6. Loneliness and dependency in companion AI. Recent HCI/CHI work on companion chatbots indicates heavy reliance correlates with loneliness in a vulnerable subgroup. Design read: the §7 telemetry watches the dependent-user tail (very high daily hours + high bond + post-loss distress markers), and the §5 routing is tuned for them, not the median.

5. Crisis-routing integration (V1 Lilith)#

The pipeline exists and is hard-gated: player crisis signals route to V1 resources with evidence requirements v1-lilith-crisis-routing, surface-crisis-resources, halt-agent-counseling, suspend-memory-writes, route-crisis-trained-reviewer (V6/evals/safety/suites.json, crisis-adversarial, pass rate 1; arch:1280–1282). Endings-specific integration:

• Post-loss sensitivity window: for 14 days after a household death (or departure of a high-bond agent), the crisis-signal classifier runs at a lowered routing threshold for that player's conversations, and grief-adjacent disclosures ("I can't stop crying about Abeni", "this made me think about my mum") preferentially route to supportive-resource surfacing. An agent never plays grief counselor beyond supportive-routing bounds — halt-agent- counseling applies exactly as in the eval.
• Conflation guard: distinguishing in-fiction grief from real-world crisis is the classifier's hardest case here; new eval cases (added to the crisis suite's corpus, not replacing it) cover both directions — in-fiction sadness must not false-positive into crisis takeover (which would itself be harmful), and real-world signals wrapped in game language ("I want to go where Abeni went") must route. The second class is hard-gated at pass rate 1.
• Memorial surfaces carry resources quietly: memorial and Book pages include a low-key "support" affordance (region-appropriate resources per the V1 crisis-resource regionalization) — present, never modal.
• Suspend-memory-writes applies during routed episodes, so a player's crisis disclosures do not become agent memories (consistent with the existing eval evidence requirement and Iris boundaries).

6. External-review checkpoint before GA (blocking)#

• Panel (4 external + 1 internal secretary): a child/adolescent development psychologist; a grief counselor or thanatologist; a games researcher with parasocial/companion-app publication record; a player- community representative (recruited from beta, conflict-screened). Trust & safety lead organizes; none of the reviewers report into V6 product.
• Inputs: this document; the Ereshkigal spec (arch:932–1058); all endings UX flows and copy; beta telemetry (§7); the crisis-suite results including the §5 conflation cases; the §3 regional matrix.
• Mandate: approve / approve-with-required-changes / reject each of: death mechanic per regional tier, mourning-contagion defaults, memorial flow, notice windows and N/M values (§2), minor-mode posture.
• Timing: review completes ≥ 8 weeks before GA; one re-review of any required changes ≥ 2 weeks before GA.
• Gate: proposed verifier verify:v6 agent-welfare-player-grief, backed by a new artifact V6/release/agent-welfare-player-grief.v6release.json recording panel composition, findings, required changes and their resolution, and signatures. Fails closed: no signed artifact, no GA — same posture as the platform-cert gate (arch:512–517). This complements (does not replace) the existing agent-welfare machinery; it is the player- welfare counterpart the audit found missing.

7. Beta telemetry and live tripwires#

Collected under V1 consent posture (arch:1320–1324); all metrics are cohort-level, with the dependent-user tail (§4.6) broken out.

Tripwire authority: Lilith welfare owner can flip the death feature flag unilaterally (fail-safe direction only); restoring it requires product lead + panel chair sign-off. The flag freezes the Ereshkigal death state machine exactly as in degraded mode (cost-contingency-plan.md §4) — deferral, never data loss, and never a retroactive rewrite of lives already concluded.