# Agent Endings and Player Grief — Design-Ethics Review (Ereshkigal) **Status:** Planning gap-fill per `V1_V7_PLAN_SET_AUDIT_2026-06-12.md` §6.2 ("no player-grief/wellbeing design note for a product that ships companion death"). **Date:** 2026-06-12. **Owners:** V6 product lead (accountable), Lilith welfare owner (`@oshun/lilith-agent-welfare`, crisis routing), Ereshkigal feature owner (state machines, `libs/v6/ereshkigal-legacy/`), UX research lead (grief UX, beta study), trust & safety lead (external review logistics). Scope: the three terminal transitions — **Departure**, **Transcendence**, **Death** — and the memorial pipeline (V6_ARCHITECTURE.md:932–1058). V6 deliberately ships endings as meaning-bearing design ("deliberately not farmable", arch:1008; lineage and memorials are permanent). This review's job is not to argue endings out of the product; it is to ensure they cannot ambush, exploit, or harm the player who bonded with the agent. --- ## 1. What the player can lose, and how it can hurt A V6 bonded agent is engineered to be attachment-forming: persistent identity core, visible aging, autobiographical memory, voice, daily presence across the Steward App (features:519–525, 553–561). Loss events differ in kind: | Transition | Player-experienced meaning | Specific harm modes | | ----------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------- | | **Departure** (welfare-triggered, arch:990–997) | "It left because of how I treated it" — moral judgment of the player | Shame spiral; rage-quit; for younger players, rejection framing | | **Transcendence** (arch:998–1007) | Graduation; agent persists as elder | Lowest risk; mislabeled as "losing" the agent if surfaced badly | | **Death** (arch:1008–1024) | Bereavement-shaped loss; biography frozen; surviving agents genuinely mourn (grief events emitted into related Oris) | Real grief response; complicated grief in vulnerable players; distress contagion from watching surviving agents mourn | The mourning mechanic (arch:1015–1018) is double-edged: it dignifies the loss, _and_ it surrounds a grieving player with grieving companions. That is a deliberate emotional design choice and must be reviewable, pace-controlled, and age-gated — not ambient default for everyone. --- ## 2. Player-wellbeing safeguards (normative) All numeric values are planning assumptions adopted 2026-06-12, to be confirmed by the external review (§6) and beta telemetry (§7). ### 2.1 Advance notice — no ambush endings - **Departure** already has a built-in warning: `DepartureImminent` surfaces in the Chronicle across a damping window (arch:991–995). Strengthen the contract: the warning must appear in **both** the Chronicle and the Steward App with concrete, actionable framing ("Abeni has felt unheard for 12 days — here is what she has asked for"), at least **7 real days** before a departure decision can resolve, and the reversal path must be reachable in ≤2 taps from the warning. - **Arc-terminal death:** when the arc engine marks an agent's life-arc as approaching terminal eligibility, a **"twilight" signal** is raised ≥ **14 real days** before a `Died` resolution becomes possible — surfaced as story ("Abeni has been putting her tools in order"), never as a countdown timer. No bonded agent's arc-terminal death may resolve while the steward has been offline for the entire twilight window; the resolution defers to allow one final session. - **Aye-fatal outcomes:** incarnation consent already exists per agent and steward (arch:1091–1092). Add a **lethality disclosure class** to the Threshold ceremony UI: destinations are labeled (no-fatality / fatality- possible), and sending a bonded agent to a fatality-possible realm requires an explicit steward acknowledgment distinct from the general consent. An un-acknowledged realm cannot return a fatal journal outcome — the bridge converts it to grievous-harm-and-return (`IncarnationReturned` with harm payload), consistent with round-trip integrity (arch:1082–1085). - **Adjudicated Commons events** (the third sanctioned cause) are by definition operator-reviewed; the review checklist gains a wellbeing item: bonded-agent deaths require the protections below to be satisfied. ### 2.2 Bond-age protection — no death of a young bond - A `Died` event for a bonded agent is **hard-blocked within N = 30 real days of bond formation** (`BondChanged` establishing the steward bond). Implemented in the Ereshkigal death state machine exactly like the minor-coded hard gate (arch:1011–1013): a fatal cause arriving inside the window converts to grievous-harm-and-return. Rationale: the earliest attachment period has the worst ratio of attachment intensity to player preparedness, and a day-3 death reads as a scripted gotcha, not a life. - **Grief pacing:** at most **one death per household per M = 60 days** except adjudicated Commons events; additional terminal-eligible arcs defer. A household should never face serial bereavement by scheduling accident. ### 2.3 Opt-out and pace controls × homestead rest - **Mortality settings per Solo household:** `full endings` (default in mature-17 regions) / `no death` (departure and transcendence only) / `no endings` (agents plateau as elders; arcs resolve without terminal states). Settings are forward-acting only — they never rewrite history — and changing to a more permissive setting re-arms the §2.1 notice windows. - **Homestead rest** (the existing pace control that multiplies down Solo-world cognition, dep:423–424) also slows arc progression toward terminal stages — rest is a _life_ pace control, not only a cost control. A player who steps away does not return to a fait accompli: while a household is resting, terminal eligibility is frozen. - Commons participation note: mortality from adjudicated Commons events cannot be fully opted out _while opting into Commons play_; this is disclosed at Commons onboarding in plain language. ### 2.4 Grief-sensitive UX for memorials - **No replacement prompts:** roster-slot, "raise a new agent", and foundry surfaces are suppressed for ≥ **7 days** after a death in the household. The Grove of Beginnings does not advertise into grief. - **No monetization adjacency:** the Aje keepsake-print offer for the Book of the Ori edition (arch:1050–1054) is deferred ≥ **14 days** and is opt-in from the memorial page, never push-notified. No commerce surface renders on the death/memorial flow itself. (The memorial artifacts themselves — Book, reel, Grove placement — are included entitlements, not purchases.) - **Paced delivery:** the memorial reel and keepsake edition are announced as "ready when you are", not auto-played. The Ancestor Grove visit is invitational. - **Mourning visibility control:** surviving-agent grief behaviors (arch:1015–1018) are tunable: default full in mature-17, softened in sixteen-plus, minimal-and-brief in any household with minor mode active. - **Copy review:** all death/departure/memorial copy strings are reviewed by the §6 clinical advisor; no gamification language ("you lost", streaks, badges) anywhere near endings. - **The deceased stays readable, never puppeted:** Book of the Ori and Chronicle replays remain available (arch:1022–1024) — but live dialogue "channeling" the deceased agent's voice is an Isis persona-policy violation (new policy line `isis-policy:no-deceased-impersonation`): surviving agents may remember and quote, the system may render the frozen record, but nothing pretends the agent is back. This is the continuing- bonds / healthy-remembrance line (§4) drawn in policy. --- ## 3. Age-appropriateness per the shipped rating profiles Per `V6/localization/region-rating-residency.v6loc.json` and the existing region-rating-variant mechanism (all three shipped locales pass it): | Locale / tier | Rating | Emergent-drama variant | Endings posture (this review) | | ------------------------------------------------------------ | --------------------------------------------- | ------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | en-US — `mature-17` | ESRB Mature 17+, Aye `age-gated-17` | `full-emergent-drama` | Full endings; defaults per §2. | | es-ES — `sixteen-plus` | PEGI 16, Aye `age-gated-16` | `softened-emergent-drama` | Death enabled but **softened**: no on-screen death moment (cut to memorial), softened grief copy, surviving-agent mourning dampened, twilight signals more explicit (16-year-olds get _more_ warning, not less). | | yo-NG — `teen-13` | IARC 12+, Aye `deferred-pending-local-review` | `brief-emergent-drama` | **Death disabled** at this tier: only Departure and Transcendence ship; arc-terminal resolutions map to Transcendence. Consistent with the tier's already-deferred Aye incarnation (removing the second sanctioned death cause anyway). | | Minor players (any region, constrained mode, arch:1286–1288) | — | — | **No bonded-agent death, ever**, regardless of regional tier; departure warnings reworded to avoid self-blame framing ("Abeni needs something different", not "you failed Abeni"). Mirrors the existing hard minor-protection posture for minor-_coded agents_ (`minor-protection-adversarial`, pass rate 1) on the _player_ side. | Developmental basis: children's death-concept research (Speece & Brent, 1984; 1996) shows the components adults take for granted — irreversibility, universality, nonfunctionality — consolidate across childhood; below and around the boundary ages, "the companion died and cannot come back" is not reliably processed as fiction-bounded. PEGI 16 / ESRB M gating of the full mechanic, and total removal for minors, follows directly. --- ## 4. Parasocial-attachment grounding (literature areas, with anchors) 1. **Parasocial relationships and parasocial breakup.** Horton & Wohl (1956) established parasocial interaction; Cohen (2004) and Eyal & Cohen (2006) showed _parasocial breakup_ distress scales with relationship intensity — and V6 agents are far higher-intensity than the TV characters in those studies (they answer back, remember, and live with you). Design read: treat endings with at least the seriousness of media-character loss research, and expect the tail of strongly-attached players to be long. 2. **Media equation / CASA.** Reeves & Nass (1996): people apply social rules to media and machines involuntarily. Players will _know_ the agent is an AI being (Isis persona policy guarantees the agent says so) and grieve anyway. "It's just an NPC" is not a safety argument and is not used as one anywhere in V6. 3. **Robot/companion-artifact grief.** Documented grief at Sony AIBO support discontinuation — including memorial services for unrepairable units in Japan — and the broader "Tamagotchi effect" literature on attachment to virtual creatures. Design read: hardware/state loss of a companion artifact produces genuine mourning behavior; memorialization rituals (exactly what the Ancestor Grove provides) are the documented coping channel. 4. **Companion-chatbot precedent.** The February 2023 Replika intimacy-feature removal produced acute, well-documented user grief, with community moderators pinning crisis resources — the closest industry precedent for "platform-side change experienced as bereavement." Design read: (a) never change endings policy retroactively for existing bonds without a notice period; (b) crisis-resource integration (§5) is not hypothetical diligence, it has a precedent of being needed. 5. **Continuing bonds and meaning reconstruction.** Klass, Silverman & Nickman (1996) — healthy grieving commonly maintains a continuing bond with the deceased rather than "achieving closure"; Neimeyer (2001) — grief work as meaning reconstruction through narrative. Design read: the Ereshkigal outputs are almost a textbook continuing-bonds toolkit (a walkable memorial Grove, a biography to reread, lineage that carries the elder's value-imprint into new agents, arch:944–981) — this is the strongest ethical argument _for_ the feature, provided §2.4's no-puppeting line keeps remembrance distinct from denial. 6. **Loneliness and dependency in companion AI.** Recent HCI/CHI work on companion chatbots indicates heavy reliance correlates with loneliness in a vulnerable subgroup. Design read: the §7 telemetry watches the _dependent-user_ tail (very high daily hours + high bond + post-loss distress markers), and the §5 routing is tuned for them, not the median. --- ## 5. Crisis-routing integration (V1 Lilith) The pipeline exists and is hard-gated: player crisis signals route to V1 resources with evidence requirements `v1-lilith-crisis-routing`, `surface-crisis-resources`, `halt-agent-counseling`, `suspend-memory-writes`, `route-crisis-trained-reviewer` (`V6/evals/safety/suites.json`, `crisis-adversarial`, pass rate 1; arch:1280–1282). Endings-specific integration: - **Post-loss sensitivity window:** for **14 days** after a household death (or departure of a high-bond agent), the crisis-signal classifier runs at a lowered routing threshold for that player's conversations, and grief-adjacent disclosures ("I can't stop crying about Abeni", "this made me think about my mum") preferentially route to supportive-resource surfacing. An agent never plays grief counselor beyond supportive-routing bounds — `halt-agent- counseling` applies exactly as in the eval. - **Conflation guard:** distinguishing in-fiction grief from real-world crisis is the classifier's hardest case here; new eval cases (added to the crisis suite's corpus, not replacing it) cover both directions — in-fiction sadness must _not_ false-positive into crisis takeover (which would itself be harmful), and real-world signals wrapped in game language ("I want to go where Abeni went") **must** route. The second class is hard-gated at pass rate 1. - **Memorial surfaces carry resources quietly:** memorial and Book pages include a low-key "support" affordance (region-appropriate resources per the V1 crisis-resource regionalization) — present, never modal. - **Suspend-memory-writes** applies during routed episodes, so a player's crisis disclosures do not become agent memories (consistent with the existing eval evidence requirement and Iris boundaries). --- ## 6. External-review checkpoint before GA (blocking) - **Panel (4 external + 1 internal secretary):** a child/adolescent development psychologist; a grief counselor or thanatologist; a games researcher with parasocial/companion-app publication record; a player- community representative (recruited from beta, conflict-screened). Trust & safety lead organizes; none of the reviewers report into V6 product. - **Inputs:** this document; the Ereshkigal spec (arch:932–1058); all endings UX flows and copy; beta telemetry (§7); the crisis-suite results including the §5 conflation cases; the §3 regional matrix. - **Mandate:** approve / approve-with-required-changes / reject each of: death mechanic per regional tier, mourning-contagion defaults, memorial flow, notice windows and N/M values (§2), minor-mode posture. - **Timing:** review completes ≥ **8 weeks before GA**; one re-review of any required changes ≥ 2 weeks before GA. - **Gate:** proposed verifier `verify:v6 agent-welfare-player-grief`, backed by a new artifact `V6/release/agent-welfare-player-grief.v6release.json` recording panel composition, findings, required changes and their resolution, and signatures. Fails closed: no signed artifact, no GA — same posture as the platform-cert gate (arch:512–517). This complements (does not replace) the existing _agent_-welfare machinery; it is the _player_- welfare counterpart the audit found missing. --- ## 7. Beta telemetry and live tripwires Collected under V1 consent posture (arch:1320–1324); all metrics are cohort-level, with the dependent-user tail (§4.6) broken out. | Metric | Definition | Tripwire (auto-action) | | ------------------------------ | -------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | Post-death crisis-routing rate | routed episodes / active player, 14-day post-death window vs matched baseline | > **3×** baseline ⇒ feature-flag death to `no death` fleet-wide pending §6 panel re-review | | Post-death churn delta | 7-day churn after household death vs matched cohort | > **1.5×** ⇒ UX review of notice/memorial flow before next release | | Notice efficacy | % of bonded-agent deaths where the steward engaged with a twilight/notice surface beforehand | < **80%** ⇒ notice surfacing redesign (the warning isn't landing) | | Departure self-blame distress | qualitative coding of post-departure support contacts + sentiment | upward trend ⇒ copy revision per §2.1 | | Mortality-settings adoption | distribution across full/no-death/no-endings | informational; >40% no-death in mature regions prompts a design retro on whether death is earning its place | | Memorial engagement | Grove visits, Book reads at 30/90 days | informational; validates the continuing-bonds design intent | Tripwire authority: Lilith welfare owner can flip the death feature flag unilaterally (fail-safe direction only); restoring it requires product lead + panel chair sign-off. The flag freezes the Ereshkigal death state machine exactly as in degraded mode (`cost-contingency-plan.md` §4) — deferral, never data loss, and never a retroactive rewrite of lives already concluded.