# The player contract

```
Type: law
```

## The player contract (non-technical law)

What we owe the player, with the same force as any mechanic. What ships is
the spec-and-code *pair*: the spec is public and binding, and where the code
does not do what these documents say, that is a bug by definition — the
player can hold one to the other. Violations of this section are
highest-severity tick findings.

1. **Correctness.** No release ships with a known correctness bug. Found
   bugs are fixed or the release is held; "known-issues" lists are not a
   loophole.
2. **Security and privacy.** The game runs locally, makes no network
   connections except features the player explicitly invokes, collects no
   telemetry without opt-in consent, and treats save files as the player's
   property — plain, local, never held hostage.
3. **Continuity.** Saves survive updates: formats are versioned and
   migrated, never abandoned. A player's persistent world is the point of
   the game; breaking it breaks the contract. Saves also survive the act of
   saving: the game never truncates the existing save in place. Every save
   write goes to a sibling temp file that is synced and atomically renamed
   over the target, and the prior save is first rotated (by copy) to exactly
   one backup generation (`misaligned_save.txt.bak`). A failed or killed
   write — or a junk overwrite — leaves the previous save readable at the
   save path or its backup. The backup is manual recovery material only; the
   load path never reads it automatically.
4. **Performance.** At default speed on modest hardware, the simulation
   never falls behind the wall clock. Depth may cost content; it may not
   cost the heartbeat.
5. **Honesty.** Patch notes say what actually changed. The design corpus and
   specs are in the repository, readable by anyone who plays.