No spoilers, ever: how a secret stays locked

A name you haven't heard yet should never appear in your list of choices. That turns out to be harder than it sounds — and the fix can't rely on asking nicely.

During a playtest, one of our worlds leaked a number. The scenario's central mystery turned on a specific detail — call it what our logs called it, 1102 — that no character had spoken aloud yet. The story had been careful. The choices weren't: one of the three options that turn cheerfully offered to interrogate someone about the thing the player didn't know existed.

Read that failure closely, because it's the whole problem in one line. The prose kept the secret. The interface spoiled it.

Why AI adventures leak

The narrating model has to know the secret. It's steering toward it — planting the hints, weighting the scenes, keeping the reveal coherent. You cannot hide the answer from the thing writing the mystery.

But in an AI adventure, everything is generated text: the scene, and also the three choices under it. The same model that just exercised beautiful restraint in the story writes the options in the next breath — and an option is a suggestion, and a suggestion is knowledge wearing a helpful face. Prompt instructions reduce the leaks. They don't end them, because a prompt is a request, and any design that depends on the storyteller remembering a rule will fail at the worst possible moment.

So secrets in Unwritten are locked mechanically. A world's authors list each secret as a set of tokens — names, numbers, phrases. A secret unlocks the moment one of its tokens appears in the story itself, on the page, where the reader saw it happen. Until then, any generated choice containing a locked token is caught and rewritten before it reaches the screen. The prompt asks for discretion; the gate enforces it.

Two deterministic rules

Rule one: revelation is observed, never assumed. When a locked token shows up in the narrated scene — a character finally says the name — the engine records the secret as revealed, with the turn number, permanently. This is the same principle our whole engine runs on: facts become true when the system observes them on the page, not when anything upstream intended them.

Rule two: until then, the scrub. Every generated choice is checked against every still-locked token — case-insensitive, accents stripped, so a French session can't smuggle a secret through a translation. A choice that references one gets its visible text replaced with a neutral probe: "Press Marlow about what is being left unsaid." The mechanical shape of the choice — its risk, its dice — survives; the leak doesn't. You keep an interesting option. You lose the spoiler.

Knowing the secret and keeping it are different jobs. We stopped asking one system to do both.

The hard mode: a mystery sealed from its own narrator

Our locked-manor world, Seven Suspects, pushes this to its logical end: the killer's identity is sealed where even the storyteller can't reach it. The narrator physically cannot spoil a solution it was never given. Which creates the opposite engineering problem — if the storyteller doesn't know, who decides when you learn something?

The engine does, and it earns each release. Crack a witness with a good roll and the engine selects which piece of evidence comes loose — one fact on a success, two on a critical. But even then, nothing is committed on trust. The fact is staged: the narrator is required to surface it explicitly in the scene, and after the scene is written, the engine checks that the words actually made it onto the page. Only then does the case board update. If the story flinched and merely implied it, the fact stays sealed and waits for a turn that does the job properly. The reader must witness the moment of discovery — that's the standard, checked mechanically, every time.

Secrets need stagecraft too

One more lesson, learned the honest way. In an early playtest of that same mystery, two exonerating facts belonged to characters who simply stopped appearing after act one. Nothing leaked — and nothing could be discovered either. The case was airtight and unsolvable, which is worse.

So the engine now tracks when the holder of an undiscovered fact was last on the page. Let them drift off-stage too long while the case is live and it starts directing the narrator to bring them back within reach — a nudge about who should be findable, never a word about what they know. The sealed truth stays sealed. The doors to it stay open.

What this buys you

Like most of the engine, the result is invisible when it works: reveals land when the story earns them, choices never know more than you do, and a mystery stays a mystery for exactly as long as it should. It's one half of a symmetry we care about a great deal — the memory system stops the story from claiming things that never happened; the secret gate stops it from surrendering things that haven't happened yet. Same rule, both directions: the page decides.