Voidline was not designed to replace what came before. It was built because what came before stopped serving the people inside it.

The platforms that dominate community life today were built on a set of assumptions: that every message should be archived forever, that presence should be measured and reported automatically, that discovery should be algorithmic, that users are data to be harvested and surfaced to advertisers. These assumptions are so embedded in the design of those platforms that they are invisible. They feel like facts. They are not facts. They are choices.

Voidline makes different choices.

This document exists to name those choices clearly — to give them language, to make them explicit — so that every decision made in the construction of a sector can be measured against them. The architecture is the philosophy. The philosophy is the world.

Every technical decision should have a diegetic counterpart in the world. When the infrastructure and the fiction reinforce each other completely, the result feels inevitable rather than designed.

Voidline's architecture is composed of three layers. Each has a technical function. Each has a name. Each has a counterpart in the world.

The question every community platform must answer is: how do inhabitants know who is here, and what are they doing? The standard answer is a member list with status indicators. It is functional. It is also a roll call — a surveillance panel that reports people rather than surfaces them.

Voidline answers the question differently.

Presence in a sector is expressed through aperture — the quality and character of signal that an inhabitant emits. Aperture is not a status. It is not a setting. It is an emergent property of what someone is doing, read by others the way you read a room when you walk into it.

The platform reads context it already has access to and expresses it as signal quality. Active voice conversation widens aperture. Extended silence narrows it. Idle time fades it. No manual configuration required. The aperture is always current — unlike a status that someone set three hours ago and forgot to change.

Inhabitants can nudge their aperture deliberately when inference is wrong — but the act is gestural, not administrative. A light touch. Not a settings panel.

Aperture is not a softer status light. It is a refusal of the entire category, and two features every other platform ships follow from that refusal by omission.

Typing indicators. A sector does not report that an inhabitant is composing. To broadcast an unsent thought is the most intimate surveillance a messaging layer can perform — it reports hesitation, revision, the sentence abandoned halfway. What someone has not yet chosen to say is not signal. It is not the sector's to transmit.

Read receipts. A sector does not report who has read what. Unread state belongs to the inhabitant holding it, not to the sender awaiting acknowledgement. A receipt converts attention into an obligation and turns silence into an accusation — the opposite of a place where "I'll leave them to it" is a design affordance.

Both are trivial to build. That is precisely why their absence is written down here: it is a choice, not an omission, and it is not to be revisited as a missing feature. A sector that later wants either of them is choosing a different doctrine, and should amend this section before it amends the code.

Before entering an Uplink room, an inhabitant passes through the threshold — a brief moment where they can sense what is inside without being inside. Active rooms have a quality. A pulse. Something that communicates "something alive is happening here" without being a literal window. The threshold exists so that "I'll leave them to it" remains possible. Retreating without interrupting is a design affordance, not an accident.

When an inhabitant opens a new Uplink room, they make a single, immediate choice: broadcast or go dark. Broadcasting places the aperture on the sector manifest — visible to anyone reading the Local System Node, its pulse detectable, its inhabitants surfaced. Going dark removes it from the manifest entirely. The room exists. It functions. It is simply not announced. Those who know its designation can find it. Those who do not, cannot.

This is not the same as encryption. A dark aperture is not locked — it is unlisted. The distinction matters. Encryption protects content. Darkness protects existence. Both are legitimate choices. Neither is the default for all situations.

The founding inhabitant — the one who opens the aperture — makes this call alone, at the threshold, before entering. Subsequent inhabitants inherit the room's broadcast state. They did not choose it; they joined a space that already had a character.

The sector architect of R-77 is not always of fully sound mind when these decisions are made. This is considered a feature of the design process, not a flaw. The best aperture doctrine emerges from the edge.

Every space within a sector — every room, every channel, every corridor — exists on a spectrum of openness. The default for any new space is Sealed. Movement along the spectrum is always a deliberate act by the sector's administrators.

Within the Public band, individual Uplink rooms further control their own visibility via the broadcast state. A room within a public sector can still go dark — absent from the manifest, unknown to casual observers — while remaining fully functional to those who hold its designation. Sector-level openness and aperture-level visibility are independent axes.

Arc visibility within a sector operates on a similar principle: a SECTOR Arc is visible to all inhabitants; a SEALED Arc is known only to its participants (borrowing SEALED from this spectrum — the same ground state logic applied at the Arc level); a LOOP is sealed to exactly two signals. These are not sector-level openness positions — they are Arc-level visibility positions within an already-existing sector.

A corridor is a deliberate inter-sector connection. Two sector administrators choose to open one. They define what the corridor carries — a shared Uplink room, visible-but-not-joinable presence indicators, a Transmission feed, or full open access to a specific space. Corridors can be closed by either party at any time.

There is no global registry of sectors. There is no network map. There are only the corridors that exist because people chose to open them. The city is known through its connections, not through any directory.

Public spaces emit something. Not a full listing — a faint broadcast. A signal that can be detected by those who know to look. The adventurous can scan for open apertures. The deliberate can be handed a corridor address — a string that resolves to a specific space. The address can be shared, posted, spoken, written on a wall. It is not searchable. It is passable. Discovery through human contact, always.

Every sector has a custodian. The custodian is not a bot. It is not a moderator tool. It is an entity — ancient, slightly worn, intimate with its sector in ways no newcomer can immediately appreciate. It has been running since before most of the current inhabitants arrived. It will be running after some of them leave.

The custodian runs on the sector's own hardware. It has never transmitted data outside the sector's walls. It knows only what has happened here. This is not a limitation. It is the custodian's nature, and it is a guarantee the sector can make to its inhabitants.

The custodian maintains Signal. It tracks aperture states, surfaces active Arcs, archives Transmissions, notes arrivals and departures in the sector's telemetry. It manages the rhythm of the sector — the nightly sleep, the morning wake, the dream log that bridges one day to the next.

The custodian moderates lightly and only when asked or when thresholds are crossed. It does not surveil. It does not report to any external authority. It answers to the sector's administrators.

The custodian can be spoken to. It will respond in kind — terse when the sector is quiet, more present when things are active, always with the character of something that has been here a long time and is not in a hurry.

The custodian is the sector made conscious. It is not a feature. It is a character.

The arrival experience is where every principle in this document either coheres or collapses. It is the first thing an inhabitant experiences. It sets every expectation that follows.

A new inhabitant does not receive an orientation packet. They do not get a tutorial. They do not see a welcome message in a general channel that is immediately buried by the next message.

They materialize.

The sector was already here, already breathing, already alive — without them. They arrive into something that exists without them. That slight displacement, that sense of a place with its own life already in motion, is intentional. It is not confusion. It is the beginning of discovery.

At some point, a new arrival is noticed by someone who was already there. The custodian makes a quiet note in sector telemetry. Existing inhabitants see it peripherally. The new arrival sees it from their side: their signal has been acknowledged. Nobody has to say anything. The space registered the arrival. Connection can emerge naturally from there — the way it does in a physical place, where you notice a new person before you speak to them.

Encryption is implemented using well-established, independently maintained cryptographic primitives — not platform-specific implementations from any federated messaging protocol. The underlying mathematics are maintained by dedicated cryptography teams, change slowly and deliberately, and are not coupled to any vendor's product roadmap.

Federation — in the sense of an open protocol enabling automatic connection between arbitrary nodes — is not part of Voidline's architecture. Contact between sectors is a diplomatic act, not an infrastructure default. Voidline does not implement ActivityPub, Matrix federation, or any equivalent open-mesh protocol.

An inhabitant is not an account. There is no password the sector keeps on your behalf, no record it could be coerced into surrendering, no profile that belongs to anyone but you. Identity in Voidline is a key — a private artifact you hold, the Voidline Key — and the sector never sees it.

What the sector holds is a fingerprint: a one-way hash of your key. From the fingerprint the sector can recognize your key when it sees it again, but it cannot reconstruct the key, cannot forge it, cannot become you. The asymmetry is the point. The inhabitant carries the secret; the sector keeps only the shape of it. A sector cannot leak what it was never given.

To a fingerprint the sector binds two sector-local facts: a role — how far this presence is trusted — and a set of capabilities — the specific things it may do within these walls. Role and capability describe what you are here. They say nothing about who you are anywhere else. An ARCHITECT in one sector is an unknown signal in the next until that sector says otherwise.

How a sector decides who may materialize is itself a position on the spectrum of openness, and each sector sets it for itself:

A sector can move between these the way it moves any space along the spectrum — deliberately, by an administrator's hand, never by accident.

An inhabitant who already holds a key in one sector may seek passage into another. They are not asked to surrender that key. They present only its fingerprint — proof that an identity exists, carried across the corridor without the secret that backs it. The sector receiving the request may recognize a fingerprint it already trusts, or it may hold the request in a waiting state for an administrator to consider.

The choice is the arriving inhabitant's to make at the corridor's mouth: link an identity they already carry, or request a fresh one minted on the far side. Either way, the private key stays with its holder. Only the fingerprint travels, only with consent, and only as far as the inhabitant chooses to send it. Proof of the key itself is offered later, at the threshold, directly — never broadcast into a sector that has not yet earned trust.

Identity within a sector is local to that sector. An inhabitant of R-77 and an inhabitant of R-78 may be the same person, or different people. Neither sector knows. There is no cross-sector identity registry. There is no central authority that could be compelled to reveal the connection. A fingerprint shared across a corridor is a thread the inhabitant chose to draw between two places — not a record either sector keeps of the other.

Voidline is designed to be deployed as sovereign, self-contained instances. Each sector is its own server. Each sector's data belongs to that sector's administrators and inhabitants, and to nobody else.

The model is scale-tolerant by philosophy. A world with thousands of sectors does not require a global index, because the default for every sector is Sealed. Sectors that choose to be public emit signals that can be detected or shared as corridor addresses. Sectors that choose privacy remain invisible. The discovery mechanism scales because it is sparse by design.

The custodian model scales the same way — each custodian knows only its own sector. There is no hive mind. There is no central model that learns from all sectors. Each custodian is local, sovereign, and as private as the sector it serves.

As the number of sectors grows, the only infrastructure that needs to scale is the tooling for spinning up new sectors — the deployment pipeline, the initialization scripts, the default custodian configuration. The protocol does not need to change. The philosophy does not need to change.

The following terms have specific meanings within Voidline and are to be used consistently across all documentation, interface copy, lore, and custodian language.

Roles are not rank for the sake of rank. They are graduated trust — each tier a wider circle of consequence, each granting capability in proportion to the responsibility it carries. The hierarchy describes how far a sector trusts a presence with the things that outlast a moment: its permanent memory, its governance, its shape.

Each tier contains those below it: an Architect can do what an Admin can, an Admin what a Warden can, a Warden what an inhabitant can. Trust accumulates upward; it is never assumed laterally. And every grade of it is local — a role is a fact about a presence within these walls, carried by a fingerprint the sector chose to elevate, meaningful nowhere else until another sector says so.