Blockwelt

Part One · Worlds of this kind

1 · Scope

In the ordinary construction of a game world, one machine holds the state and every other machine trusts it. The world is a service. When the operator stops the service the world stops, and no copy anyone kept can be distinguished from a picture of it.

This manual describes worlds built the other way. Such a world has a name that every machine computes alike, a law that every machine can check, one settled history, and stored copies that outlive the machines that made them. No participant is privileged and no operator is required.

The property is named virtual materiality. It is a set of verifiable conditions, and section 2 lists them.

2 · The condition

A world state is material, over a stated interval, when five conditions hold together.

1. Identity. The same state has the same name on every machine. The name is a cryptographic commitment.
2. Law. The state changes only through a fixed transition rule applied to signed actions.
3. Settlement. One history is distinguished from every competing history.
4. Availability. The state can be rebuilt from attested copies at any time in the interval.
5. Audit. Anyone can check the world’s invariants without trusting anyone. In this world the invariant is the conservation of matter.

Each condition yields a certificate. The five compose into one object, and a machine that verifies that object holds no further dependency on the machine that produced it.

The conditions separate three things that are often treated as one. Validity is not settlement: a proof shows that a change was lawful, not that the world accepted it. Settlement is not availability: an accepted state whose data is lost still verifies, and still names a state that cannot be rebuilt.

3 · Names

Every object in such a world has a name, and names are of two kinds. An arithmetic hash, cheap inside proof circuits, names states. A byte hash, fast over raw data, names artifacts: stored blobs, messages, and history entries. The first says what the state is. The second says which bytes carry it.

A state’s name is computed from one canonical representation. That representation is frozen before anything is built on it, published as test vectors, and reproduced exactly by every implementation before it does other work. An error in the representation propagates into every name derived from it and cannot be corrected without renaming the world.

Storage is free to differ. A region may be held raw, as a palette with narrow indices, or as run-lengths along a column. Different encodings give different bytes and different byte names, and the same state name. A copy verifies when its bytes match its byte name and its decoded content recomputes the state name. Storage can therefore change without changing any state’s identity.

4 · The tree that counts

The state commitment is a tree over the world’s vertical columns: quaternary, five levels deep, one leaf for each of 1,024 columns, with the leaves ordered so that any group of four siblings is a square quadrant of the ground.

Every node carries two values. One is a hash of its children. The other is a measure: the count of each kind of matter beneath that node, packed into a single field element and hashed into the node. A parent’s measure is the sum of its children’s. The root names the world and audits the world.

Conservation is addition at the root. Matter standing in the world, plus matter held by minds, plus matter in the Void, plus matter not yet issued, equals the count fixed at genesis, kind by kind. When one column changes, its leaf and the five nodes above it change; the rest of the tree stands.

One root serialises the whole world, and neighbours in space are not neighbours in the tree. The remedy is a rule this manual calls boundary alignment. Compression, commitment, proof, and locality share boundaries — the same regions of the world — without sharing representations. Section 25 gives the cost of getting this wrong.

5 · Impossibility

A task can be physically impossible, semantically invalid, or cryptographically inadmissible. A modified implementation can compute whatever bits it likes; nothing prevents that. What it cannot do, except with negligible probability, is produce an accepting proof for a forbidden task.

Law is the joint operation of the last two grades. The rule defines what is invalid. The proof system makes the invalid inadmissible as shared fact.

The guarantee is as strong as two things: the soundness of the proof system, and the agreement of every implementation of the rule. The second has the larger attack surface and the weaker tooling. It is enforced by shared golden vectors and by running the same action traces through every implementation. A divergence is treated first as an ambiguity in the law and only afterwards as a fault in the code.

6 · Proof

A proof covers one step of the world. Its public inputs are three names: the state before, the state after, and the batch of signed actions between them. The circuit checks, in order, that each opened column decodes into valid kinds; that the openings reconstruct the old root; that each action’s conditions are evaluated in the law’s exact order, yielding one validity bit; that every effect is multiplied by that bit, so a refused action changes nothing; that the changed leaves, and no others, reconstruct the new root; and that the measure still sums to the counts fixed at genesis.

The last two checks carry the weight. A proof that showed only that some set of leaves had been hashed correctly would leave the set as a free choice of the prover. An internally consistent forgery then verifies: a rejected swing, a health value edited downward by one, and every Merkle path honestly recomputed over the altered state. This failure was found in a working prototype here, not in the abstract. The repair is structural. Each rule emits its own writes, with every index computed under constraint from the action’s own fields, and the tree engine applies only what the rules emitted. Nothing outside an action’s footprint can change.

Signatures are checked outside the circuit, by the two minds. This keeps the circuit small enough to read, which matters because the circuit is the only place the law is enforced against a hostile implementation.

The scheme is Groth16 over the BN254 curve, compiled from Circom. Measurements below are for the movement tier of the step circuit, on an Apple-silicon laptop.

rapidsnark is a native prover that consumes the same proving key and produces proofs that verify under the same key. Its advantage here is 1.7×. The 5–10× figure quoted for rapidsnark comes from hand-written x86 assembly and does not transfer to this architecture.

A proof is verified in milliseconds, needs no copy of the state, and can be checked by anyone at any later time. Proving may be delegated to a machine that holds no keys, because verification and not production is what makes the fact.

7 · Settlement

Validity is established in four tiers. They are cumulative, not alternative.

Between the two minds, tiers 0 and 1 are complete. Each machine recomputes every tick it is asked to sign and signs nothing that does not match. Tiers 2 and 3 establish validity to a machine that holds no copy of the state and was not present at the tick.

Settlement can fail safely, and does. If the two machines disagree about the state a tick produces, neither signs, and the world stops at the last agreed tick. Either mind can halt a world; neither can falsify one.

8 · Time

A world of this kind has no clock. Wall time orders nothing, because a value that two machines read differently cannot enter a state on which they must agree. Ticks are indexed, not timed.

Two things make time and nothing else does: a mind that offers an action, and a state that still demands resolution. A body in the air demands the ticks of its fall. A world in which neither holds passes no time, and its archive contains no empty ticks.

The model has two tenses. There is what has settled, and there is what has not. The second is not a future; it is an offer, and an offer can be refused. The interval between offering and settling is the only place a state change occurs.

9 · The bound on interaction

Effects propagate at a speed the law bounds. Two regions further apart than the ticks between them allow can therefore be shown not to have interacted. They may settle independently and be rejoined afterwards.

Settlement boundaries should follow causal boundaries. Latency then presents as distance rather than as delay. Where the parts of a world can reach one another they agree tick by tick; where they cannot, agreement waits. Section 26 gives what this argument does not cover.

Part Two · This world

10 · The frame

Space is a grid of 32 × 32 × 32 cells. The two horizontal axes wrap, so the world is a torus with no edge and no corner. The vertical axis does not wrap: hard rock below, fog above. There are 32,768 cells in 1,024 vertical columns, and the column is the unit every other layer is cut to.

The world has room for exactly two minds. Two is the smallest number at which one mind can witness another, and the law requires a witness to close a world. Section 27 gives what the number costs.

11 · Matter

A cell holds one of nine kinds, in four bits: air, rock, dirt, wood, leaf, and four garments. The whole terrain, packed, is 16,384 bytes. It is never transmitted; both machines compute it from the world’s seed.

Bulk matter is measure, not inventory. The state records how much dirt a mind holds and never which dirt. Every unit of a kind is governed by the same rules as every other unit of that kind.

Matter that enters the Void does not leave it within the epoch, and the Void only grows. The multiset is fixed and nothing flows in, so nothing regrows: felled wood does not return and dug soil does not replace itself. A world therefore has a finite quantity of possible labour in it, and that quantity is 2,432 units of mutable matter.

Identity is not abolished by this arrangement; it is relocated. Recovering a unit’s path requires replaying the record, because the law is deterministic and the record is complete. The record is kept in the Well.

12 · The mind

A mind is a signing key with a body. The key is outside the world; the body is inside it. The body stands two cells tall and carries a position, an integrity of at most ten, two hands, a shirt slot, a trouser slot, and a bag of counts.

Integrity is the only quantity in this world that is not conserved. Conservation governs matter inside the world. Integrity measures the binding between a mind and its body, and the key end of that binding is outside the world, where the law has no account to balance.

A fall of more than three cells costs integrity equal to the excess. At zero the body dies: what it held goes to the Void, and what it wore drops at the cell where it fell. The mind then has no body for exactly one tick. It returns at the Clearing, a four-column patch at the origin where placement is refused. Matter carries a derivable history; integrity does not, and the state records only its current value.

13 · The Tree

There is one tree and there are no others. All 128 wood in the world belongs to it: a trunk three cells square and thirteen high, standing from z 15 to z 27, and eleven root blocks at its foot, which are the only wood a bare hand can reach. All 256 leaves are its canopy, nine cells across, at z 26 to z 29.

Full vertical fog stands at z 28 and the canopy runs to z 29, so no view contains the whole Tree.

On a torus every point is the middle. The Tree is placed by the world’s seed, and the geography organises around wherever it lands. Both minds begin further from it than the fog permits sight, so no world begins with the Tree in view.

Felling it introduces no new mechanism: roots by hand, an axe from the roots, columns of dirt raised to reach the high trunk, then the trunk one block at a time. On the last structural break the canopy is transferred to the Void over the following ticks, eight leaves per tick.

The trunk is thirteen high. Thirteen cells is the fall that takes a body from full integrity to zero.

14 · The Well

At the centre of the Tree, in the surface cell the trunk stands on, there is a well: fourteen laid stones and a disc of water whose circumference is two cells. It is a fixture of the law. Its floor cannot be broken, nothing can be placed into it, and it is not counted as matter.

Its water is the only reflective surface in the world, and it is still. It renders the sky, the Tree above it, and the other mind if the other mind stands near.

It does not render you. No body exists in the state for the mind whose eyes the camera occupies, so the mirror has nothing of yours to reflect. You have hands, and a body in the other mind’s view, and no reflection.

The trunk stands on the well cell. While the Tree stands the Well is covered and no part of it is visible. Felling exposes it. This follows from the trunk’s placement; no rule states it.

15 · The fog

Fog begins at eight cells and closes to full at eighteen. It is the range of interaction, drawn. Past it, one mind cannot reach another inside the ticks that would pass first, and histories that cannot reach one another are free to settle apart.

The fog colour is the sky sampled toward the fragment. A block dissolving at twelve cells dissolves into the sky behind it, and both are computed by one shader path.

16 · The garments

There are four garments: a shirt and trousers in woad blue, a shirt and trousers in madder red. Each is a kind with exactly one member, so each is an individual with no further machinery. They are worn from the first tick of the world.

Bodies are otherwise identical, and headless: the neck is a cut that ends in nothing, at z 1.8 above the feet. Garments are the only per-individual state a body carries, so a body without them cannot be told from the other body.

Cloth is the one thing that survives a killing. What the dead were carrying is transferred to the Void; what they wore is written into the two cells where the body stood, and can be taken. Garments therefore accumulate a path through hands that no other kind accumulates.

17 · Labour

One verb covers striking and breaking. A swing names the acting hand and a target: a cell, or the other body. The effect is read from one table.

Dirt has an integrity of four, wood eight, leaf one; a swing subtracts its power, and the effect fires at zero. A wound not struck again within ten ticks is discarded, and the cell returns to full integrity. A felling abandoned halfway leaves the Tree whole.

Rock has no entry in the table. A pickaxe swing against rock resolves and changes nothing, and the law returns the same refusal every time it is attempted.

Tools are made by sacrifice. Two wood become a sword; three become an axe or a pickaxe. The wood is transferred to the Void and one tool is activated out of a fixed reserve: sixteen swords, eight axes, eight pickaxes across the life of a world. Tool creation adds no matter to the world.

Reach is one cell for a hand and two for a tool. No targeting apparatus exists. The target is the cell nearest the centre of the view, and a swing that resolves against no target is a lawful outcome recorded like any other.

18 · The tick

A tick executes five phases in one order, and nothing is reordered.

1. Admit. Each mind’s signed offer is checked for shape and sequence. A sequence number is spent whether or not the offer is later refused.
2. Act. Each offer meets its conditions in turn. The order alternates with the parity of the tick, so it stays a function of the tick index and gives neither mind a standing advantage.
3. Flow. The world moves without signatures: rising, apex, falling, landing, cooling.
4. Close. Consequences resolve in strata — support, collapse, damage, death, closure — at most eight in a tick, each able to enqueue only strata above its own.
5. Epoch. Closure, if the world has reached it.

Six ticks a second is a ceiling and not a metronome; a tick occurs only when the state or a mind demands one. A step crosses one cell in a tick and a fall crosses one cell in two. Every motion the law admits is bounded this way, and the bound is what makes the argument in section 9 possible.

19 · The offer

An action is not a command. It is an offer: a signed statement that this mind wishes this tick to contain this. The world accepts it or refuses it, and both outcomes are recorded.

Nothing unsettled is drawn as world. No block leaves a wall and returns; no position is predicted and corrected. Every frame is an interpolation between two agreed states.

The offer is shown as the body. The wind-up begins when the offer is signed: the shoulders turn, the tool rises, the body leans toward the target cell. Contact lands on the settled tick. A refused offer is drawn as an arm that returns without contact. A raised axe seen across a clearing corresponds to a signed offer already made, and cannot be drawn without one.

You do not see your own wind-up, because no body of yours is rendered in your own view. The offered interval reaches the acting mind as delay instead: the world takes its beat before consenting, and that beat is settlement.

The recovery that follows is the cooldown, drawn: two ticks after a block, six after a blow. The animation timing table and the cooldown table are one table.

20 · The braid

While both minds are near, each tick carries two signatures, and neither mind can move the world without the other. When they draw more than twenty-four cells apart the world splits: each runs a locally settled branch at one signature, with no network in the loop.

They rejoin below sixteen. The eight-cell gap between the thresholds keeps the two branches from ever touching the same ground, so the union is disjoint by construction. It is checked by computing the union in both orders and comparing the results; a mismatch halts the world rather than resolving it.

Approach before rejoining is refused. A step that would bring a mind within three cells of an unmerged counterpart does not execute. Latency is rendered as ground that cannot yet be walked on.

Alone, a mind settles at one signature, and the interface reports the grade. All labour is possible alone. Two things are not: there is nobody to strike, and the world cannot be closed, because closure requires a witness. When a second mind arrives it re-executes the whole solitary history and countersigns its head. One signature then makes the entire past of that world material.

21 · What travels

The world is never transmitted. Both machines derive it from the world’s name: a seed of thirty-two bytes through one generator, producing the same 32,768 cells on both sides, or halting the session. What crosses the wire is small.

One relay exists, and it holds no authority. It forwards messages, keeps signed history, binds a slot to a key, and validates nothing. It can delay a message, withhold it, or misreport who is present. It cannot forge one: every fact carries the signatures of the minds that made it, and each machine verifies the chain against its own execution before signing.

Each machine signs at most one statement for any given parent and height, and writes that claim to durable storage before the signature exists.

Disagreement does not fork the world. It stops it. Two machines that compute different roots for one tick have read the law two ways, and the session halts with a divergence report.

22 · What is never drawn

Nothing enters the view that is not of the world. No pointer, no highlighted face, no outline, no marker, no floating text, no persistent panel.

Every such element reports a fact before the world has settled it. A highlighted face names a target the law has not yet accepted; a health bar names a value the register already holds. Neither carries a signature.

Information that is not the world is summoned. One key opens a monochrome register: holdings, integrity, counts, and the reasons for the last four refusals down its margin. It closes again, and during play the frame is empty.

The governing rule is that no property can be felt that is not a property of the system, and no property of the system is left permanently unfelt.

23 · The surface

The register is Iceland after rain. Wet black basalt, moss, wood dark with water, and no sun at any point in a world’s life. Everything made by hand in this world is old and ordinary.

The sky is one overcast dome, #d8d8d2 at the zenith to exactly #bfbfb9 at the horizon, where the fog colour begins, so the two meet without a seam. Its luminance varies by under four per cent, over periods of minutes.

Blocks meet at full scale, with no gaps. The joint is drawn by light rather than by separation: seams darken by 20 to 25 per cent, further on the underside than the top, because water and shadow gather low. Each block’s value is displaced from its neighbour’s by a function of the seed and the position, and no block ever changes. Both machines compute one world, and nothing is randomised at the moment of drawing.

Sound follows the same rule. At the Tree’s foot there is a murmur: three voices, granular, never resolving into words. Its amplitude is a function of the wood still standing, so it reaches zero when the last trunk block breaks.2

24 · The ending

The law contains its own ending. Closure is a change like any other: offered, adjudicated, settled, and proved by the machinery that proves a shovelful of dirt.

A world cannot be closed alone. Closure requires the other mind present as witness.

When an epoch closes, its whole history is sealed into a single name of fixed size. The seal cannot be read; it is a name and not a summary. The next world is generated from it, holding the same matter in a new arrangement, caused by everything that happened before and legible from none of it.

The conditions of closure are written in the law and are not written here. Two routes reach it, and one is longer and is elected rather than found. Neither is listed in the interface, and the record afterwards is the only place they differ.

Part Three · Limits

25 · The four axes

One conflict recurs at every layer of a world of this kind: compression works by exploiting redundancy, and cryptographic commitment works by destroying it. A digest is canonical and therefore incompressible. Circuits price computation by algebraic structure rather than by information content, so field arithmetic is nearly free and the bit-level operations at the heart of every entropy coder are not.

Four costs are traded against one another in any representation.

They pull apart pairwise. Entropy-optimal codes minimise size, maximise read, and destroy loc, because adaptive context makes every symbol depend on the whole prefix. Raw arrays minimise read and loc and forfeit size. Hash trees give canonical digests and are structure-blind: they scatter spatial neighbours across distant leaves and funnel every update through one root.

The escape adopted here is to make the compressed representation and the committed representation the same algebraic object, so that decoding is field arithmetic. The price is stated rather than hidden: this world accepts structure-optimal compression in place of entropy-optimal compression. Its terrain packs to 16,384 bytes against an information-theoretic floor near 12,985.

The same conflict returns on four axes, and each has an unsolved case.

• Space. The commitment must be a code for the access pattern rather than for the data. Reads here are ball-shaped and the tree is not. One root still serialises the world.
• Time. Proving cost is linear in history length. A constant-size running proof, extended in constant amortised cost per action, would remove that. Folding schemes are the known candidate and none is built here.
• Genesis. A generated world must be proved once and referenced thereafter, or generation cost recurs on every read. This world proves generation once per epoch, at rebirth, and never on the hot path.
• Conflict. Merging divergent histories discards information. Section 26 gives the case.

The sharpest open question is on the genesis axis and has no candidate primitive at all. A world stored as a seed plus a growing map of differences eventually stores itself twice: once as a generator no longer consulted, once as a difference from everything. Compacting it back requires proving that two encodings read out identically, at a cost below linear in the size of the world. No known primitive does this.

Three costs here are measured rather than argued. The two circuit tiers beyond movement stand at 307,763 and 615,689 constraints against budgets of 110,000 and 170,000: over by 2.8 and 3.6 times, and past the capacity of the trusted setup they were sized for. Both are prototypes, and both are the circuits in which the forgery of section 6 was found.

26 · Conflict at more than two

The merge described in section 20 is conflict-free because conflicts are made impossible. The split and rejoin thresholds guarantee that two branches never write the same column, and a merge that finds an overlap halts rather than resolving it. Commutativity is not proved; it is checked, by computing the union in both orders. There are two orders.

None of this generalises. At more than two minds, branches form a directed graph rather than a pair, and pairwise merging neither composes nor commutes on its own. Pairwise disjointness across every pair is a strictly stronger condition than the two-body separation argument establishes. Checking commutativity by enumeration costs one factorial in the number of branches.

A general merge needs an operator that is associative and commutative up to an accounting of what it discarded, at a cost proportional to the number of conflicts. It also needs a coin. Where two branches claim the same unit, one claim is kept, and the choice must depend only on the claims themselves and not on the order the merges happened to occur in, or the operator does not commute. It must also be unbiasable by either party without a trusted beacon. Neither requirement has a solution here.

Because conflicts cannot occur, none of the machinery for handling them has ever run. The ledger reserved for discarded claims has always been empty, and no longer appears in the state root at all.

27 · Membership

Membership is fixed at two, and a slot binds to a public key permanently. There is no procedure for a third mind, no procedure for rotating a key, and no procedure for a world to outlive the pair that opened it.

Two components are single points of failure in a design whose stated premise is that no operator is required. One directory assigns minds to worlds. One relay carries every message. Neither can forge a fact, and both can refuse to carry one. A world whose relay stops is a world whose participants hold verifiable histories and no way to extend them together.

Sharding along causal boundaries is the proposed route to more minds, and it is reported here as a conjecture. The argument that settlement may divide wherever interaction cannot cross is two-body. No shard implementation exists and no measurement of it has been made.

This work is not in progress. Scale is treated as an appendix to the project rather than its direction, and the project is defined as complete when two minds can play the interpretation from first tick to seal.

28 · Memory

Assurance shrinks to a constant size. Remembrance does not. A proof over a whole epoch is one object of a few hundred bytes, verified in milliseconds by a machine that holds nothing else. The epoch it attests is not smaller for having been proved, and a name whose data is gone is a name for a world nobody can enter.

The chain grows by one statement of 169 bytes per tick. The stored world grows by one delta per tick. Nothing is pruned; a pruning frontier is defined and inert.

Storage in this world is two browsers and one relay. Attested replication with stated leases is specified and is not built. Nothing here holds a copy under obligation, and nothing here can currently be shown to.

The failure has already been observed. Twice in one day, a change to the law made every existing world unverifiable against it, and the repair was to delete the stored histories on both sides. Worlds in this system have so far been ended by schema changes more often than by their own terminal condition. Version-tagging worlds by the law that constituted them is the fix, and it is queued.

29 · Lineage

The infrastructural thesis of this manual is not new, and none of it is claimed here. Worlds with blockchain-grade objectivity were argued for and built by others first: the framing essays and engine work at Lattice and MUD, the fully on-chain voxel world OPCraft in 2022, zero-knowledge-gated game state in Dark Forest, and the surrounding discourse at 0xPARC. The feasibility this manual stands on was demonstrated there.

What is offered here is the interpretation. An old account of time is taken literally and built: settlement as the becoming-past, time constituted by act and by agreement, separation as a branch awaiting its witness, conservation with the Void as the entropy ledger, and an epoch that contains its own ending. No one of these is unprecedented. The ensemble is held by a single reading and is small enough to be read in an afternoon.