# Platform, Accessibility, Localization & Launch

```mermaid
flowchart LR
  Build[Candidate realm-platform build] --> Access[Accessibility floor]
  Access --> Locale[Localization completeness]
  Locale --> Perf[Performance and asset budgets]
  Perf --> Cost[Cost and fidelity controls]
  Cost --> Passport[Identity portability evaluation]
  Passport --> Region[Staged regional rollout]
  Region --> Evidence[Production evidence and signoffs]
  Evidence --> Decision{Launch ready?}
  Decision -->|Any gap| Hold[Hold and record reason]
  Decision -->|All real evidence| Ship[Advance release]
```

Launch is a sequence of independently inspectable obligations rather than a
single optimistic status. A failure at any stage records a reason and prevents
later signoffs from laundering fixture or inherited evidence into readiness.

Every other V7 page describes a thing the platform _does_ — compose a realm,
hand off authority across a dying node, settle a payout to the cent. This page
describes the conditions under which any of it is allowed to ship to a person:
the accessibility floor a creator surface cannot publish below, the locale set
the catalog speaks, the eval and telemetry surface that tells operators whether
a build is healthy, the cost levers that keep a 1000-inhabitant realm
affordable, the frame and asset budgets the simulation holds to, the one account
a player carries across platforms and games, the staged region rollout, and — at
the end — the launch gate that aggregates all of it into a single go/no-go. V7
is **Mawu**, an open-world creator republic on **Unreal Engine 5.5** and a fleet
of **Rust** services, and the defining honesty of its Platform-and-Launch layer
is that the gate which decides "ship?" currently reads **`not-launch-ready`**
and is wired so it _structurally cannot_ report otherwise while its evidence is
fixture evidence. That is not a defect in the document; it is the point of the
machinery. This page is product-shaped — what a player and a creator experience
at the edges of the platform — and it pins each claim to the code that enforces
it, or labels it honestly where the code is policy, a reused pipeline, or an
inherited seam not yet wired. It belongs to the feature catalogue at
[../V7_features.md](../V7_features.md).

## What ships, honestly

Three categories run through everything below, and the page never blurs them.
**Real and on-disk:** the Mawu accessibility floor is a 5-rule linter
(`libs/v7/contracts/src/accessibility-eval.ts`) that blocks publish, run as a
merge gate; the localization catalog is the shared `@oshun/i18n` library
(`libs/oshun/i18n/src/index.ts`) with eight launch locales, RTL handling, a
typed fallback chain, and a gap detector; the AI cost/fidelity tiers are real
Rust degradation levers in `danu-mesh-cluster` that each emit a telemetry
record; a meaningful subset of the performance budgets is encoded as Rust
constants that eval gates assert; cross-version/cross-realm portability is a
real `run_v7_passport_eval`; and the staged-rollout and launch-readiness records
are machine-checked JSON with verifiers that enforce a no-fabrication invariant.
**Spec or reused pipeline, labelled:** the metric/trace spine, the asset-budget
streaming path, and the console-cert cook flow are inherited from V1/V5/V6 and
named, not re-implemented for V7. **Honestly negative:** the staged rollout has
executed zero stages, and the launch review's eight signoffs all rest on in-repo
fixtures, never production measurements. The architecture companion that proves
the seams in engineering depth is
[../architecture/observability-performance-and-launch.md](../architecture/observability-performance-and-launch.md).

## Accessibility — a publish-blocking floor, in code

V7 inherits the V5/V6 accessibility commitments and adds the coverage a
_creator_ platform specifically needs: a hearing-impaired player must see who is
speaking, at what range, on which channel; a colorblind creator must read a
provenance diff; a one-handed builder must place a prop. The novelty is that
this is not a guideline — it is the **`accessibility` adversarial merge gate**
(added 2026-06-12), and its implementation is `runV7MawuAccessibilityEval` in
`libs/v7/contracts/src/accessibility-eval.ts`.

### The five-rule linter and three surfaces

The eval asserts an accessibility floor across exactly three surface descriptors
named in `V7_MAWU_ACCESSIBILITY_REQUIRED_SURFACES` — `mawu-studio-builder`,
`abundantia-browser`, and `default-realm` — and lints each against five rules in
`V7_MAWU_ACCESSIBILITY_LINTER_RULES`:

- **`voice-radio-text-visual-parity`** — proximity and radio voice must expose
  text transcript, live captions, and visual indicators for speaker, range,
  channel, and mute state, plus a radio-channel text label;
  `lintVoiceRadioParity` raises a `block` finding for each of the seven fields
  that is false.
- **`colorblind-safe-provenance-diff`** — the provenance/diff palette must not
  be color-only, must carry a contrast ratio `>= 3`, must use at least **two**
  non-color cues (`shape`/`icon`/`pattern`/`label`), and must label changed
  fields.
- **`keyboard-gamepad-builder-parity`** — every builder action needs a keyboard
  binding, a gamepad binding, a visible focus target, a screen-reader label, and
  a voice command; the builder surface with zero actions fails outright.
- **`scalable-ui-floor`** — surfaces must include 100% in their text-scale
  range, reach **200%**, reflow at **320 CSS px**, and keep **44 px** hit
  targets.
- **`reduced-motion-floor`** — reduced-motion mode must honour the system
  preference, keep only essential motion, drop the animation multiplier to
  `<= 0.01`, and disable vestibular effects.

The report's `passed` is true only when no surface produces a `block` finding
and every required surface is present. Because the gate fixture
(`V7_MAWU_ACCESSIBILITY_EVAL_FIXTURE`) ships passing specs, any seeded
regression — a missing caption, a color-only diff, an unbound builder action, a
non-scalable shell — flips a surface to failed and blocks the merge. The gate
runs via `pnpm exec vitest run -t "Mawu accessibility"` and is exercised in
`libs/v7/contracts/src/index.test.ts`. The platform floor a realm author
inherits is this linter; a realm sets accessibility _above_ it, never below.

## Localization — the shared catalog, V7's surfacing

V7 does not own a translation runtime; it composes the platform's. The catalog
is `@oshun/i18n` (`libs/oshun/i18n/src/index.ts`), the canonical V1
customer-string library, and V7's localization story is best read as **honestly
inherited**: the launch locale set, the formatting, and the fallback discipline
are real and shared, while V7's own contribution is _surfacing_ content and
reports in those locales.

`OSHUN_LAUNCH_LOCALES` fixes eight locales — `en-US`, `es-US`, `fr-FR`, `de-DE`,
`ar`, `he`, `ja-JP`, `pt-BR` — with `RTL_LOCALES` flagging `ar` and `he` for
right-to-left direction and `LOCALE_EXPANSION_BUDGET` recording how much longer
each locale runs than the `en-US` baseline (German 1.4×, Japanese 0.7×) so
layout QA can verify shells do not truncate. `translate()` resolves through the
documented chain `resolveFallbackChain` — requested locale → language-only
locale → `en-US` — and emits a fallback event for critical keys (disclosures,
evidence, auth, privacy) so a gap is logged rather than silently rendered in
English. `findFallbackGaps()` is the launch guard: it returns every
`<key, locale>` pair that resolves by fallback, and a non-empty result means a
translation gap remains before launch. `formatForLocale` wraps `Intl.*` for
locale-aware date, time, timezone, number, currency, and region formatting.

Where V7 uses it concretely: the Abundantia catalog, Mawu Studio, governance
surfaces, and platform UI localize across this set, creator content is
locale-tagged for the browser to filter, and — visibly in code — every
incident-response drill in `V7/release/staged-rollout.json` carries a
`localizedReportLocales` array equal to exactly these eight locales, so a public
incident report ships in every launch language. _Honest label:_ the catalog's
keys today are the shared shell/assistant strings, not a V7-specific message
set, and there is **no V7-specific localization eval gate** — localization is
composed from the V1 library plus the rollout-record policy, not re-proven by a
V7 test.

## Telemetry, analytics, and eval sets

### The 29 adversarial gates are the eval surface

V7's eval sets are not a spreadsheet; they are the **29 adversarial merge
gates** enumerated in `V7/ADVERSARIAL_EVAL_GATES.md`, each owning a seeded
hostile fixture, an explicit pass bar, and a CI command. They map directly onto
the feature-doc eval list: sandbox-escape containment, conflict-resolution
correctness, mesh-handoff integrity (200 entities × 10,000 crossings, zero
loss/dup/reconnect), anti-cheat precision/recall, malware-corpus detection,
payout-formula correctness to the cent, plus the safety evals (CSAM hash,
grooming, minor-protection). `.github/workflows/v7-ci.yml` runs a
`verify-inventory` job first, then each gate as a named step — `cargo test`
against the `apps/v7`/`libs/v7` crates, `pnpm exec vitest` against the TS
services — including the Mawu Studio safety gates (`generation-policy`,
`accessibility`) and the Abundantia economy gates (`payout-formula`,
`payout-eligibility`, `fraud-graph`, `currency-firewall`).

### Live ops today: a `/health` contract, not a metrics spine

The honest qualification the architecture companion makes applies here in full.
Every V7 Rust service exposes a `GET /health` capability document via
`apps/v7/service_contract.rs` (`run_health_server(&DESCRIPTOR)` returns
`{service, owner, version, status, port, purpose, capabilities}` and 404s
everything else) — a readiness probe a load balancer or the Abundantia browser
can poll, **not** a Prometheus scrape surface. The platform's observability
libraries `@oshun/metrics` and `@oshun/tracing` are real and platform-wide
(`libs/shared/metrics/src/` — registry, helpers, presets;
`libs/shared/tracing/src/` — tracer, W3C propagation, middleware), but a grep
across `apps/v7` and `libs/v7` returns **zero** imports of either: the metric
vocabulary the spec names (realm population, mesh-node utilization,
authority-handoff latency, sandbox-budget overrun, scan-queue latency, economy
inflation) is **inherited-but-unwired** policy plus in-eval telemetry structs,
not a runtime gauge family. The truthful summary: live ops is a `/health`
contract plus telemetry encoded inside eval reports.

## AI cost and fidelity tiering

The cost controls are real Rust, not a budget memo.
`danu-mesh-cluster/src/lib.rs` implements three degradation levers under
`DANU_AI_COST_FIDELITY_SCHEMA_VERSION`, matching the feature doc's (a) meshing
tier, (b) balance agent-fleet depth, and (c) AI-assisted-creation usage:

- **`danu_reduce_mesh_tier`** — under budget pressure a realm runs fewer sim
  nodes at a lower per-node cap; with no pressure (available ≥ nominal) the tier
  is unchanged and **not** flagged degraded.
- **`danu_ai_creation_fallback`** — AI creation falls back to the
  `template-asset-library` path rather than metered generation.
- **`danu_crucible_reduced_coverage`** — Ixchel balance verification runs a
  reduced corner-case set (e.g. 90 of 200) and **flags** the reduced coverage;
  it never silently skips.

Each lever emits a `DanuDegradationTelemetry { degraded, … }` record, and the
eval asserts the budget-pressure case produces **exactly three** degraded
records while the nominal control case produces none. This is the "degrades
safely, observably" promise as a tested invariant: a realm under cost pressure
sheds fidelity in a way an operator can see, never in a way that lies about full
coverage.

## Performance and asset budgets

V7's budgets live in two honestly-different places. The **numeric policy** is
stated inline: 60 fps / 16.7 ms on the reference client tier with a 30 fps floor
on minimum spec (sustained in a meshed realm of 1000+ via interest-managed
culling), authority handoff **≤250 ms p99** with no reconnect, netcode playable
at 5% loss and graceful at 20%, per-client downstream 64–256 kbit/s, Pheme ≤40
audible streams per listener with p95 mouth-to-ear ≤250 ms at 1000-inhabitant
scale, one-click Collection install p95 ≤120 s for 5 GB on 100 Mbit/s, and a
Sekhmet scan-queue p95 ≤15 min upload-to-verdict.

A meaningful **subset is encoded as constants that gates assert**, which is
stronger than a documented number because a regression fails a test:
`DANU_AOI_EVAL_INHABITANTS = 1_000` bounds the 1000-inhabitant working set;
`REALM_DELTA_MIN/MAX_BANDWIDTH_KBPS = 64/256` (in `libs/v7/realm-protocol`) is
checked by the netcode gate's `within_bandwidth_budget`, and a
population-proportional bandwidth profile is a hard
`PopulationDependentBandwidth` violation;
`REALM_INTERPOLATION_EVAL_LOSS_PERCENT = 5` backs the
playable-at-5%/graceful-at-20% gate; `LISTEN_HOST_MIGRATION_SLA_MS = 2_000`
backs the Listen-tier host-migration eval; and the mesh-handoff gate moves 200
entities 10,000 times without loss or reconnect. _Honest label:_ there are **no
typed `@oshun/analytics` V7 budget manifests** of the kind V3 ships — the
per-tier frame-time validation is, for V7, inline policy plus these
constant-backed gates.

For **asset budget and streaming**, realms stream via the Maya world-streaming
and Nanite-class pipeline; creator assets carry auto-generated runtime LODs; the
compositor composes only the layers a realm pins; interest management bounds the
per-client working set; and a realm declares an asset budget that the Mawu
Studio linter warns against exceeding. This path is **spec plus reused
pipeline** — V7 inherits the V5/V6 build/cook flow and has no V7-specific
cook-profile tree, and its UE client is a ~2.2k-LOC procedural skeleton, not a
content-complete cook.

## Cross-platform and cross-progression

A player is one identity everywhere. A single account ID with per-platform
linked credentials carries from V5, and characters, Hera crew membership, owned
mods/Collections, and creator earnings follow the account across platforms. The
portability is a real eval: `run_v7_passport_eval`
(`libs/v7/substrate-bridge/src/lib.rs`) round-trips a character into the V2–V6
destinations and into federated realms with Ori integrity, and
`open_v7_realm_federation_corridor` opens the realm-to-realm corridor a
character travels under federation treaty; Hera carries a
`cross-version-group-presence` record so a crew fields a team across versions.
Console crossplay follows the per-surface rules V5 defines (competitive surfaces
may pool by input device), and mod installs sync cross-platform through
Abundantia on the mod.io model, within the console-certification limits on which
sandbox tiers a console realm may grant. _Honest label:_ the **V1-identity
binding behind this is a mock seam today** — `default_substrate_bridge` bindings
mark only the V6 Ori store and the Maya engine-core as `Reused`; V1 identity,
Aje, and the rest are deterministic local `Mock`s, which is what lets the
passport eval run without a live deployment but means the cross-platform
identity claim rests on a mocked boundary.

## Region rollout strategy

The rollout is staged, and the record is honestly negative.
`V7/release/staged-rollout.json` encodes the five stages from the feature doc —
**creator-alpha → rp-beta → meshing-beta → economy-launch →
general-availability** — each with its scope, the eval gates it depends on, and
an incident-response drill. Every stage carries `status: "planned"` and
`decision: "pending"`, and a `correctionNote` re-marked 2026-06-12 states the
consequence plainly: all five were originally recorded "met" on the same day the
record was authored, **without any stage ever being executed** — no creator
alpha, no community realms, no real populations — and the IR drills logged in
them were code-level simulations (`run_incident_response_drill` fixtures), not
operational drills. The `scripts/v7/verify-staged-rollout.mjs` verifier enforces
**advance-iff-met**, so a stage cannot claim it advanced without being marked
met against its gates — the machinery that keeps the record from drifting back
to a flattering green.

## Launch readiness and exit criteria

§ Launch Readiness aggregates everything above, and its defining property is
that it is honestly not ready and structurally cannot lie about it.
`V7/release/launch-readiness-review.json` reads `decision: "not-launch-ready"`.
All eight signoffs — trust boundary, Ixchel sandbox, Danu scale/handoff, Sekhmet
child-safety/IR, creator economy, anti-cheat, moderation/minor-protection, and
the all-realms safety floor — carry `status: "fixture-passed"` and the verbatim
`evidenceBasis: "in-repo adversarial fixture; not a production measurement"`.
The checked-in `correctionNote` is unsparing: the original 2026-06-02
"launch-ready" decision predated any adversarial audit; the 100%/100%
precision-recall figures are fixture-toy signatures (6 true positives, 0 FP, 0
FN on seeded cases), not classifier performance against the 95% bar; the UE
client is a skeleton; and PhotoDNA, PDQ, CSAI Match, Thorn Safer, Lantern,
StopNCII, and EAC are **not integrated**.

The honesty is enforced, not promised. `scripts/v7/verify-launch-readiness.mjs`
encodes a **no-fabrication invariant**: if any signoff is `fixture-passed`, the
decision _cannot_ be `launch-ready` (`:378`–`388`). The same verifier greps the
source for the eval functions and their key assertions, so a hand-edited
evidence file cannot pass while the code that would produce it is absent. V7
will be launch-ready — per the feature checklist — only when the Ixchel sandbox
contains a defined escape corpus with zero successes on launch-scale fixtures,
Danu sustains 1000+ with integrity-clean handoffs on a real cluster, Sekhmet
meets its malware/CSAM/grooming bars with the real vendor integrations and
passes an operational IR drill, the creator economy settles a test cohort's
payouts through Aje with KYC/tax/reserve and the anti-fraud gates, anti-cheat
meets its precision/recall bar on community servers, moderation and
minor-protection meet their safety bars, and the Lilith/Kuanyin safety floor is
proven enforced on every realm regardless of owner configuration.

**V7 exit criteria** are deliberately conjunctive: a creator can author, host,
and publish a server-authoritative, fully-moddable realm with executable logic
that a player joins cross-platform; mods compose as Ixchel layers with
SAT-resolved dependencies and Collections install reproducibly; a meshed realm
carries 1000+ with clean handoff and dynamic split/merge; persistent characters,
jobs/economy, civic institutions, proximity+radio voice, and the crew graph
persist and travel under federation treaty; untrusted code runs only in the
six-tier sandbox under budgets, every artifact scanned and content-addressed;
creators are paid and communities self-govern; and a character is portable into
V2–V6 with no loss of the V1 trust guarantees. Until each flips on real
evidence, the verifier keeps the aggregate negative — which, pre-GA, is worth
more than a green that lies.

## Where this connects

- The streaming, spectating, and live-service loop this page's rollout and
  launch cadence run alongside:
  [./streaming-incarnation-and-live-service.md](./streaming-incarnation-and-live-service.md).
- The product promise and design posture every commitment here is downstream of,
  including the mock-seam map this page reuses:
  [./overview-promise-and-posture.md](./overview-promise-and-posture.md).
- The architecture companion — the `/health` contract, the constant-backed
  budgets, the 29 gates, the golden-replay determinism guard, and the
  de-fabricated launch verifier in engineering depth:
  [../architecture/observability-performance-and-launch.md](../architecture/observability-performance-and-launch.md).
- The feature catalogue this page belongs to:
  [../V7_features.md](../V7_features.md). </content> </invoke>