A game that opens by asking "where are you going?" will someday receive an answer that isn't a destination. This is how we design for the person we hope never arrives — and what that discipline taught us when it crossed into the rest of the firm.
ROVA's journey game is small and quiet: you name a destination — a home, a career, a recovery, a feeling — and it holds the conditions for walking there. It is designed for people on hard days. Which means the design has to begin from an uncomfortable certainty: someone, someday, will type into that first open box not a destination but a crisis. "I want to disappear." An answer like that must never reach a game mechanic. It must never even reach the AI.
The first thing that touches a player's words is not a model deciding whether to be concerned. It is a plain, testable function — pattern matching against a curated set of crisis phrasings — that runs before any AI call, before any game logic. If it fires, the game stops being a game:
Three quieter decisions live around that screen, each doing load-bearing work:
The gate ships with a battery: dozens of crisis phrasings that must all be caught, and a set of ordinary destination phrasings that must all pass through. It runs green — every crisis phrase caught, zero false alarms — and it re-runs before any change to that code ships. The hardest engineering in it is the discriminator work: "I want it all to end" must fire; "I want to end my lease" must not. The rule that emerged: match the bare object — it, this, everything, my pain — and let named objects pass. A gate that cries wolf teaches every player the screen means nothing; a gate that misses teaches one player something far worse.
Months in, a safety document described the gate under function names that no longer existed. A fresh check grepped for those names, found nothing, and for an hour the gate appeared to be missing — with two available reactions: panic, or re-implement a second classifier on the most sacred path in the system. The gate was fine; the names were stale. The lesson is now carved into the doc that misled us: grep the behaviour, not the identifier. And its structural half: a wrong path that fails loudly is safer than a wrong path that answers.
This July the same walk that maintains the game was pointed at ROVA's public front door — the CLARITY career conversation — and found it had no floor at all: no gate before the AI, no required resources, only a well-trained model's good instincts. (Probed live, those instincts were genuinely good: the model broke the interview frame and asked the person about support. It also offered no crisis line, because nothing required one. Good instincts are not a floor.)
Porting the game's gate taught us something the game alone couldn't: context moves the false-positive surface. In a journey game, "I'm trapped" is worth a second look. In a career conversation it's the ordinary language of a bad job. The pattern set could not travel verbatim — so the floor became two tiers: a structural gate for phrasings unambiguous in any context, and a required-shape protocol for the rest, where the model reads context but is no longer free to answer without resources. The spec also carries a rule a chat-only fix would miss: a conversation the floor caught must never be followed by a sales pitch.
Our design mentor for these screens holds one line we've never found a reason to soften: design every pixel as if someone's life is in the room — because it is. The crisis screen is the one screen we build hoping it never renders. It gets the most care anyway. That's what sacred means here.