The problem
The client was in closed beta on a live game. Players stalled on puzzles and combat checks and alt-tabbed to whatever a search box would say, including posts about content the beta had not released. The team wanted a hint in the client, fast enough to stay in the moment, that could not talk about a boss, an item, or a line of story the build had not unlocked.
A general model with the wiki pasted into the prompt failed that test. It answered from the whole design, including chapters the beta build had not shipped, because the interesting details were in the same document as the starter zone.
Why released content is a build artifact
The boundary is not a prompt that says 'do not spoil.' The boundary is the content manifest of the build the player is running. If the id is not in that manifest, it is not in the hint index. Spoilers are a missing id, and a missing id has nothing to retrieve.
Architecture
The index is the manifest
Each beta build publishes the content ids it includes. The hint index is built from those ids only: item names, objective text, and hints the writers authored for that id. Design docs and unreleased chapters are not in the index, so they cannot be quoted or closely paraphrased from retrieval.
Latency is part of the hint
A hint that takes a second arrives after the player has left the fight. The common hint runs against the on-device index shipped with the build. Median response in the beta was 80 ms. A cloud fallback exists only when the device index misses, and it uses the same manifest, not a larger one.
The writer-authored hint is preferred
Where the writers wrote a hint for the objective, that string is what the player sees. The model composes around it only when the player asks something the string does not cover, and the composition still has to cite an in-manifest id.
Player reports stay with a person
The hint feature does not mute, ban, or judge a player report. Those tools were out of scope. A report button remains the existing moderator queue.
Challenges and tradeoffs
- Writers' hints mentioned unreleased names. A starter hint referenced a faction the beta had not introduced. The manifest check flags a string that contains an id from outside the build, and those hints were rewritten before the index was cut. The check is on the string, not only on the link.
- Paraphrase could still unique-identify a secret. An early composition described an unreleased mechanic without naming it, clearly enough that a tester recognized it. We stopped free composition for objectives that have a writer hint, and we added those near-miss prompts to the red-team set.
- Cloud fallback was pointing at the wrong manifest. The first cloud config used the main branch index. It now receives the build's manifest hash and refuses to answer if the server index does not match. A mismatch returns the on-device hint or nothing.
Results
Across the closed beta, median hint latency was 80 ms on device. Review of the hint transcripts, including the red-team prompts, found no mention of content whose id was outside that build's manifest. Every hint that named an item or an objective carried an id from the manifest.
Players still left the client for some questions. They did not get unreleased chapters from the hint button. Moderator reports were still handled by people, which was unchanged.
What we'd do differently
We would have run the string-level manifest check on the writers' own hints before the first playtest. The leak we almost shipped was authored, not generated.