the changelog is the leaderboard

First of three on player-authored worlds. From lambdamoo to voyager covers the thirty-five years of people who tried; paint is a physics engine is about the cliff that killed all of them.

Lucasfilm’s Habitat went into beta on QuantumLink in 1986. Somewhere in its short run the team spent weeks building a treasure hunt, and one player finished it in about eight hours. Morningstar and Farmer wrote it up afterward with no bitterness and one conclusion: one person had a wonderful time, dozens were left bewildered, and weeks of design were consumed in an eyeblink. Their fix was not a harder puzzle. It was to stop thinking like game designers and start thinking like rule makers.

Forty years on, the industry took the lesson about half way. We build systems instead of corridors now. But we still treat the distance between the game we designed and the game people actually found as a defect report.

Every game has an intended action space and an actual one, and the gap between them is the best content the studio owns. It is also the only content nobody is paid to produce, nobody is scored for finding, and everybody is contractually obliged to destroy on sight.

the gap keeps producing the good part

The receipts are not obscure. They are the most famous things that ever happened in these games.

World of Warcraft, September 2005. A raid boss applied a contagious debuff meant to stay in the room. Players discovered their pets could carry it out. Within hours Ironforge and Stormwind were plague pits, NPCs were spreading it without dying, and players with heals were running toward the outbreak and extending it. Epidemiologists Nina Fefferman and Eric Lofgren published on it in The Lancet in 2007 — the variable they said nobody models is curiosity, and a video game had just supplied the data. Blizzard, at the time, patched and said little. Then they shipped deliberate plagues in Wrath of the Lich King in 2008 and again in Shadowlands in 2020. They canonized the exploit. It took three years and they never called it that.

Second Life, November 2006. Self-replicating player objects took the grid down — one of the largest denial-of-service events an online world has had, written in the world’s own scripting language by its own residents. Linden Lab locked logins, cleaned up, and built a defense they called the grey goo fence. Someone found a hole in the fence.

And the deep end: tool-assisted speedrunners achieving arbitrary code execution in Super Mario World through the controller ports. Millions of person-hours of the most inventive play this medium has ever hosted, performed entirely against the grain of the products it happens on, with no scoring channel, no credit, and no way for the developer to answer except silence or a patch.

We already know this happens with machines, too, and we have known for a while. Lehman and about fifty co-authors catalogued it in The Surprising Creativity of Digital Evolution: simulated creatures twitching a limb to harvest free energy out of an Euler integration error, jumping solved by triggering a collision fault, robots evolving to walk through walls in the Torque engine — which then had to be patched. Point an optimizer at a simulation and it finds your rounding errors. A playerbase is an optimizer.

why nobody ships this on purpose

Because an exploit is a dominant strategy, and a dominant strategy ends a game. Once the trick is out, everyone does the trick, the design stops mattering, and the population leaves. So the studio patches quietly and calls the finder a cheater, and the most interesting thing that happened all year gets one line in the notes and no name attached.

That is a pricing problem, not a moral one. The exploit is worth a lot and costs nothing to use, so it gets used until it is worthless.

Change the price. Make the exploit a depleting asset: it pays while it lives, and publishing it is what kills it — and being the one who killed it is the score.

Now the player has a decision that does not exist in any other game. Sit on it and farm quietly, and someone else eventually finds it or the statistics give you away. Publish it and take a bounty, a permanent credit, and a patch number with your name in it. Or sell it — as a program that carries the trick without explaining it, to someone who does not know what they are buying.

An exploit that expires is not a dominant strategy. It is a resource with a decay curve, which is a thing games have known how to balance since 1980.

you run out of bugs

Which is the obvious flaw, and it took me a while to see how badly it breaks the version above.

A studio has a finite number of mistakes. Score their discovery and you have a treadmill with a known end: players walk the seeded edges, the edges close, and the developers are back to manufacturing content by hand while the scoreboard sits empty. The patch budget becomes the hard ceiling on everything.

Unless the players are the ones who made the things that break.

Let them author, and I mean author rather than mod — materials whose colour comes with real mass and friction and emissivity, parts that declare what load they can take, buildings, and bounded volumes of physics they wrote themselves. Now the interesting failures are not in the engine. They are at the seams, where two authored things meet in a way neither author specified.

Two fields overlap and the composition order is resolved by a rule neither of them read. A bracket holds inside a damping volume and shears at its boundary. A pigment’s emissivity makes somebody else’s light model produce energy out of nothing.

None of those are the studio’s bugs. They are consequences of composition, and there is a new one every time anybody publishes anything. The arithmetic is the whole argument: a studio’s supply of mistakes is a fixed number that only goes down, and the supply of seams grows with the catalogue — faster than the catalogue, because it’s pairs.

It also does something to the developer’s job that no live-service roadmap has ever done. They stop being the source of content and start being the thing that decides, in public, with reasons, whose authored law prevails when two legal things compose illegally. That is a judicial function. It is the job LambdaMOO discovered on December 9, 1992, when Pavel Curtis declared the wizards pure technicians who would implement what the community directed and make no social decisions of their own — and it is a job no game since has staffed.

the developer becomes a player

This is the part that does not exist yet, and it is the whole idea.

In every game shipping today the developer is an administrator. They are outside the fiction, they act on a calendar, and their moves are announced rather than played. Live service has spent a decade manufacturing the feeling of developer presence — seasons, passes, balance passes nobody asked for — because the real thing is not there.

Give the developer a move budget and force the moves to be reactions, and they become a faction. Their move set is bigger than “fix,” and each move means something different in the world:

• patch — close the edge, mint the lore, credit the finder
• canonize — leave it in, name it, build content on top of it; Blizzard did this in slow motion with the plague
• quarantine — wall it into one region, which is now a landmark with weird local physics
• deny — say nothing, let it run, watch what the ecology does with it

Competitions have been doing an impoverished version of this by accident for twenty-five years. Battlecode patches its spec mid-season in response to what teams find, and calls it tournament hygiene. Space Station 13 has run on this loop for two decades — the players find the edge, the maintainers answer next week, and the answer becomes community history. Nobody has shipped it as the core loop and then built the scoring around it.

Mechanically it is one line. The engine ships with the list of invariants it believes about itself, and checks them:

for each tick t:
    world.snapshot(t)                    # deterministic, hashable, replayable
    for each authored thing a in world:
        intents = a.step(budget = a.allowance)
    resolve(intents)                     # fixed order, seeded from the snapshot hash
    anomalies = invariants.check(world)  # <- the game
    ledger.record(anomalies, attribution)

No entity exceeds velocity V. Mass is conserved in region R. No message is delivered before it was sent. When something a player made turns one of those false, the engine does not throw an error. It writes their name next to it.

Attribution is the part that has to be earned rather than guessed, and the fix is to make authors promise things. If a part declares what load it takes and a field declares what it conserves at its boundary, then those promises are falsifiable — and when an invariant fails, the engine can check whose promise turned out to be wrong. One broken promise is a clean attribution. Two is a dispute worth ruling on. Zero broken promises, and the world itself is at fault, which is the rarest and most valuable thing anyone can find.

what play produces

Here is why this is a class of game and not a feature.

In a normal game, play produces a score. A clear, a rank, a run — a number about you, stored beside the game, changing nothing. In this one, play produces a change to the game. What you did is legible in the world’s physics six months later, under a name, with a version number.

The leaderboard is the changelog.

That reframing pays for three things at once. It gives exploiting an economy instead of a stigma. It gives the developer a reason to be present that is reactive and therefore real. And it stacks: a material is used in a part, the part is used in an assembly, the assembly sits inside somebody’s authored physics, and each layer can be attacked from underneath, below its author’s model of it. Four layers, none isolated from each other, and the studio wrote only the bottom one. That is more than user-generated content has ever meant — nobody here is generating content, they are writing law and then finding out what it does next to someone else’s.

the obvious objection

The addressable audience is people who can write code, and the failure mode is a dead lobby with six brilliant players in it.

Three answers, one structural and two circumstantial.

The structural one is that the entry rung does not have to involve code at all. If a pigment carries real mass and friction and emissivity, then mixing paint is authoring physics in the small, and the person doing it is working in the same system as the person writing a solver — shallow end of the same water. That argument is its own piece.

The old one is spectating and forking. Most players will never write a line; they will watch, fork a published program, and change a constant. Chess supports millions of watchers per grandmaster and nobody calls that a participation problem.

The new one is that the code no longer has to come out of a human. Voyager showed in 2023 that executable code works as an action space for an open-ended agent in Minecraft, with a skill library that grows. That makes “write a program” something a person can direct rather than type, which is the first time in forty years the entry cost on this genre has moved.

And the transfer runs the right direction. When researchers trained an adversary against KataGo it won over 97% against superhuman settings — and then a human on the team learned the attack by studying the adversary’s games and beat superhuman Go engines by hand. Code finds the edge. People learn to walk it. That is what makes this a game rather than a bot ladder.

what the theory predicts

1. A game that scores exploit discovery will get more novel strategy per player-hour than one that punishes it, and the gap will be embarrassing.
2. The most-read text in such a game is the patch notes, and it will not be close.
3. Any version where the developers supply the edges runs out. Only the version where players author the things that break has content after year one.
4. The best seasons end early. If the win condition includes breaking the world, some seasons run a year and some run nine hours, and the nine-hour one is the one people still talk about.
5. The hard part is not design. It is that running strangers’ work forever is a security problem that never ends — and your anti-cheat is now the mechanic, so you cannot just harden everything.

Habitat’s designers learned in 1986 that they could not out-build their players and stopped trying. Everything since has been an argument about what to do with the time that frees up. The answer the industry picked was to build more content. The other answer was always available: stop shipping the world finished, and let what the players break be the record of what the game was.

The patch note is the only artifact in this medium that says a player was here and the world is different now. It has been sitting in the changelog this whole time with nobody’s name on it.

Sources: The Lessons of Lucasfilm’s Habitat, Morningstar & Farmer ↗ · Corrupted Blood incident ↗ · The untapped potential of virtual game worlds to shed light on real world epidemics, Lofgren & Fefferman, Lancet Infect Dis 2007 ↗ · Grey goo attack briefly fells Second Life ↗ · TASBot ↗ · TASVideos: runs that execute arbitrary code ↗ · The Surprising Creativity of Digital Evolution, Lehman et al. ↗ · LambdaMOO Takes a New Direction ↗ · Adversarial Policies Beat Superhuman Go AIs ↗ · Voyager: An Open-Ended Embodied Agent with Large Language Models ↗ · Battlecode ↗