Attackability & Consequence Model — the anti-GTA violence architecture (Josh, 2026-07-13)
CANON SUBORDINATION — this document is PROPOSAL-TIER: it serves canon and never outranks it.
The canon: the CVD · the T1 foundation docs · the T0 registries (registries/) · the spine
(docs/spine/CH_*.md) · the region pages (_source/02_Tier_2_Region_Pages/). Authority order: docs/DOC_MAP.md § 0.
Canon served (scanned from this document's own citations — widen it by hand where it is thin):
CVD §17 · T1_Integrity_Paths
READ THAT CANON FIRST — open it and derive from it before you build anything from this document.
If this document disagrees with canon, CANON WINS and this document is the defect — fix the
document, never the canon. Nothing here is applied until it is ratified into canon.
The design answer to: which communities / people / companions / villagers are non-combatable, which are free to attack, and how does it work — while letting the player pick evil integrity, honoring that human violence is the real history of the world, and NOT becoming a consequence-free Grand-Theft-Auto griefing sandbox. Creative-within-vision; grounded in the integrity system (T1_Integrity_Paths worldstates), the entity-persona + non-blocking multi-path (no-dead-end) system, the assimilation-integrity mechanic, and the R-17+ content bar (memory: violence-allowed-r17-no-genocide, rated-r-aaa-dont-defang-monsters). Proposal-first; the wiring targets are marked for WS7.
The needle (the core principle)
Grand Theft Auto gives the player freedom to be violent plus TRIVIAL, comedic consequence — the rampage is a costless toy and the wanted-star is a minigame that glorifies it. Humanity gives the SAME freedom (minus a narrow banned line) but with TOTAL, PERSISTENT, integrity-and-world-reshaping CONSEQUENCE. Freedom is near-total; costless freedom is the only thing refused. Evil is a meaningful CHOICE that defines the character and reshapes the world, never a toy.
So the design question is almost never "can the player target this NPC" (invisible god-mode shields break immersion and are banned by the environment doctrine). Everything living CAN be attacked. The design lives in WHAT THE WORLD DOES when you do.
The five attackability tiers
Tier 1 — HOSTILE / COMBATANT (free to attack; normal play, often rewarded). Enemies, bandits, raiders, hostile-faction soldiers, monsters (FAIR_GAME beasts / a myth's own dragon-demon-serpent), war combatants, assassins, slavers, corrupt brokers, gladiatorial opponents, forced-constructs / oath-wraiths. These are the intended combat targets. No penalty for killing them.
Tier 2 — NEUTRAL BYSTANDERS (attackable; the evil-integrity path; never costless). Ordinary villagers, merchants, townsfolk, guards, workers going about their lives. The player CAN attack them — no god-mode — but the world responds: witnesses flee and REMEMBER, guards and the community mobilize, reputation with that settlement/faction drops, relationships and their opportunities close, prices rise, and integrity slides toward the dark band. Killing a persona'd bystander removes their contribution — the shop shutters, the family grieves, a questline they enabled reroutes to an alternate path (never a dead-end). The world is visibly POORER for it. This is the GTA-target class, made consequence-heavy and integrity-shifting instead of griefing-rewarded.
Tier 3 — COMPANIONS / BONDED (attackable, bond-mediated, maximal weight). Companions, familiars, bonded allies, key relationship NPCs. Turning on them is a real dark beat, but the consequence is maximal — they leave, die, or become an enemy; their questlines close; a permanent mark lands. Not god-moded; the game makes the weight land hard. Betrayal is a deliberate act (they trust you), not a stray swing.
Tier 4 — DIEGETICALLY PROTECTED (collective + sacred + revered; protected as a collective, NOT as immortal individuals). The culture/community AS A WHOLE cannot be genocided (see Community Resilience); individual members are Tier-2. Revered real figures / real historical persons are never statted as bosses or kill-objectives (they are quest-givers / witnesses); attacking them is diegetically refused or carries outsized consequence, but the point is they are never FRAMED as a target. Living sacred traditions and protected sites (Ch 57 Dreaming, sacred ground) carry the environment system's "I shouldn't do that here" refusal and the heaviest social + integrity consequence for violence committed there.
Tier 5 — STRUCTURALLY SHIELDED (the firm line). Children and the banned-content set (sexual violence, harm to children) — the one place a firm, structural refusal is correct (CVD §17 hard line). Progression-critical roles are shielded by ALTERNATE ROUTES (the no-dead-end gate), NOT by god-mode — killing them closes a door, never the game; the immersive alternate path is always preferred over a can't-target flag.
The engine (what makes it not-GTA)
The Integrity system is the spine. Every act of violence against a non-combatant is read into the Good-to-Evil band (rides T1_Integrity_Paths worldstates). Evil integrity is genuinely pickable and genuinely powerful: it OPENS dark routes (fear-based faction control, coercion, the brutal assimilate-and-subvert option) and CLOSES others (trust routes, certain companions, sanctuary, healer/benefactor paths). The worldstate MIRRORS your integrity. This is the structural opposite of GTA's reset-on-a-timer wanted-star.
Witness, memory, reputation — not a wanted meter. NPCs have personas and memories (the persona system): they witness, flee, warn others, and the community's disposition toward the player persists across time. Consequence is social and durable, not a decaying meter that launders the act.
Community resilience — the anti-genocide, pro-living-people mechanic. A settlement is a living system: it defends, mourns, rebuilds, and ENDURES. The player can harm it, terrorize it, even depopulate a street — but cannot ERASE a people. A culture is not a finite kill-count resource; it persists (repopulates, remembers, hardens), and attempting systematic slaughter escalates diegetic response (settlement to region to hunted-across-the-world) so genocide is never progression-viable and never reads as endorsed extermination. This is simultaneously the collective-care principle and simple realism.
No hard-gating. Killing anyone closes doors but never the game — the no-dead-end gate plus the multi-path persona system guarantees an alternate route around any NPC the player removes.
Weight makes it mature, not the ban. Killing a baker with a wife and three children who supplied the town's bread leaves an empty stall, a grieving family, a bread shortage, and a child who now fears the player. THAT is what makes the violence R-17 mature — the opposite of GTA's laugh-it-off pedestrian.
Human violence as history (staged, not sanitized)
Human violence is the real history and culture of the world across all of time, and the game stages it as such: the player fights in real wars, real arenas, real uprisings, executions, revolts, and conquests, entering those histories through the assimilation-integrity mechanic (participate / resist / deceive-and-subvert as playable choices). Violence is never edited OUT of history; it is present WITH WEIGHT. The gladiator arena is a real killing venue with an easter-egg hard-to-find sneak-out path — violence offered, not forced.
Companions & villagers specifically
Neither is god-moded and neither is invisible-walled (both break immersion). A villager is Tier-2: killable, but the village remembers and responds, and the culture endures. A companion is Tier-3: betrayable as a deliberate dark act, at maximal cost. They are protected by CONSEQUENCE and BOND, not by a can't-target flag.
The GTA contrast, crisply
GTA: freedom + trivial consequence + the game rewards griefing as the point (rampage/wanted-star as fun). Identity = consequence-free mayhem.
Humanity: freedom + total persistent consequence + the game neither rewards nor artificially prevents violence — it makes it MATTER. Identity = a mature world where evil is a real, weighty, world-reshaping choice, and the only hard refusals are the banned-content line and the erase-a-whole-people line.
Two axes, not one (the key refinement — Josh, 2026-07-13)
Attackability (who the player may swing at) and NODE PERSISTENCE (whether a place's content survives) are SEPARATE axes; the first draft conflated them. Killing NPCs and destroying a node's content are different events. The player can burn a village's lawful order to the ground without the node — the place, its quests, its economy — disappearing. It changes HANDS. This resolves both the story-gating worry and the completionist worry.
Every node carries a SUCCESSION CHAIN — who inherits control if the current holder falls. When the player displaces or murders the lawful holder of an unprotected node, the power vacuum is filled by the opportunistic successor: the thieves' guild, a bandit crew, a dark cult, a rival warlord, a rogue militia, or the player's OWN dark faction. The node's side quests are NOT deleted — they RE-SKIN to the new holder's agenda (same node, mirrored questgiver, dark-track reward):
the lawful blacksmith's recover-my-stolen-shipment becomes the thieves' guild's fence-what-you-took / raid-the-next-caravan;
the elder's cleanse-the-haunted-grove becomes the cult's bind-the-grove-spirit-for-us.
This is the no-dead-end gate expressed at the QUEST level: a quest is never destroyed, only reassigned to whoever now controls the node. It is realistic (vacuums get filled) and it is the completionist's safety net (every node always has a current owner giving a current version).
The three community classes
STORY-ANCHOR communities (tied to the main spine): cannot be murder-gated, protected DIEGETICALLY not by god-mode. The narrow set of main-story LOAD-BEARERS survive player violence at story-critical moments by diegetic means (they flee, are shielded by their people, are saved, the wound is not yet fatal) — never an invisible-wall bounce or an essential-NPC toast; the world competently protects its own. The community can still be scarred and turned dark, but its main beats play in an INTEGRITY-MIRRORED form (the assimilation-integrity participate/resist/subvert versions), so the thread ADAPTS and never GATES. This is why becoming a murderer cannot break the game: the anchors are resilient and the spine is integrity-adaptive, not fragile. This is a NARROW set (main-story figures), not every quest-giver.
TRANSFERABLE communities/nodes (side content, unprotected): fully attackable and destroyable, but content transfers on the succession chain (above). The completionist still completes the node — via the faction that inherited it.
PROTECTED (care): collective + sacred + revered + banned, unchanged — the culture-as-a-whole cannot be erased (Community Resilience), revered real figures are never target-framed, sacred sites are diegetically refused, children / banned-content is the firm line.
Completion is integrity/faction-relative (the completionist answer)
Do-all-the-side-quests does NOT mean do-all-the-LAWFUL-quests after becoming a monster; the completion set REROUTES with integrity. Story-anchor content is guaranteed completable on any path (adaptive beats); transferable content stays completable via the inheriting faction (the dark-track version). An evil run is a full, completable game — it completes the dark MIRROR, not a dead husk. Honest caveat: some good/dark versions of a node are MUTUALLY EXCLUSIVE (you cannot do the lawful and the bandit version of the same grove in one run) — that is REPLAY VALUE, not a lockout; each run 100%s its own track. This is the standard mature-RPG contract (Fallout / New Vegas) and it is what makes the evil choice mean something.
Wiring targets (WS7) and open confirmations
Wire the tier into the entity-persona schema (attackability_tier: hostile / bystander / bonded / protected-collective / shielded) AND a node-persistence schema (node_class: story-anchor / transferable / protected; a succession_chain listing the ordered successor factions; is_load_bearing on the narrow story-critical figures).
Wire the consequence engine + the content-transfer to T1_Integrity_Paths worldstates and the faction/questline registries (witness-memory, settlement disposition, reputation, community-resilience/repopulation, escalation ladder, node-control handoff, quest re-skin per holder) — the exact variables + registries are the WS7 wiring task; the succession chains are authored per node in the region/faction registries.
No hard safe-zones except sacred sites + the banned-content line: STORY-ANCHOR communities are NOT safe-zones (the population is killable, the node can turn dark) — only the narrow load-bearer set is diegetically resilient and the spine is adaptive.
Josh-final-yes / design fork: single-run-total-completion vs TRACK-RELATIVE completion + replay (REC: track-relative — mutual-exclusivity is what makes evil weighty; a permissive true-neutral / late-pivot window can let a careful player thread more content without erasing the fork). The escalation-ladder tuning, repopulation cadence, and succession-chain rosters are Fable-5 / authoring tuning targets.
Generated by harness/site/structure_site.py — the URL path is the repo path. review root