The social graph is becoming jurisdictional — Roblox will withhold friends lists of Australian under-16s from creators by default from 30 September, three named APIs returning 'as if they have no friends' (Roblox, 4 Sep 2026)

Why it matters (the medium, not the myth). The Story Sweep asks one question — what can the medium newly do — and the honest answer this week is subtractive. One day after Epic shipped an API that lets an island know who arrived together (fortnite-42-10-social-synergy-party-api, dated 3 September 2026 and carded by this cabinet on 4 September), Roblox announced that on its own platform — a major UGC platform, though neither document opened here sizes it against any other — for one jurisdiction and one age band, the social graph stops being readable by creators at all. Both moves are real, both are dated a day apart, and they point in opposite directions. The composite capability is therefore not "story can now know your friends"; it is "story can know your friends where the law allows, and must degrade gracefully where it does not." That is a design constraint, and it is the kind the Story Garden exists to catch before a work is built on the wrong assumption.

What the announcement says, quoted. Posted to the Roblox Developer Forum under Updates → News & Alerts by the official Roblox staff account on September 4, 2026, 7:10pm, headlined "Upcoming Friends List API Access Changes for Australian Users Under 16." Its key takeaway: "Starting September 30, 2026, creators won't have access to friends lists of Australian users under age 16 by default. We expect this to include a very small percentage of your user base." The body: "To comply with Australian regulation, starting September 30, 2026, creators won't have access to friends lists of Australian users under age 16 by default. These users can turn developer access to their friends list back on at any time. When you call any of these APIs, they'll return with no results for these users, as if they have no friends:" — followed by exactly three: Players:GetFriendsAsync, Player:GetFriendsOnlineAsync, Player:GetFriendsWhoPlayedAsync.

The two operational sentences a builder needs. First, the web API is included and the posture toward it is not neutral: "Get /v1/users/{userid}/friends and other public friends APIs will also be restricted and are not an officially supported integration path." Second, the burden Roblox places on creators: "No action is required. If you use these APIs in your game, please ensure they are properly handling players that may not have friends." Those two sentences are in tension — "no action is required" followed by an instruction to handle a state your code may never have hit — and the tension is the actual work item.

What is stated versus what is measured. Everything in the primary is a capability statement with a date. The only quantity in the document is "a very small percentage of your user base," which Roblox states and does not size; it names no threshold, no country-level user count, and no measured impact on session or retention metrics. Nothing is derived from the primary, because there is no number in it to derive from. Two figures elsewhere on this card do not come from it and are labelled where they appear: the one-day interval between the Epic and Roblox announcements, which this card computes from the two cards' dates, and the $1,500 median DevEx figure in the money angle, which is imported from roblox-creator-earnings-2025-median-payout. The card claims a scheduled API behaviour change, nothing about its effect.

The regulation is named but not cited, and this card does not fill the gap. Roblox says "to comply with Australian regulation" and names no instrument, no section and no regulator. Australia's under-16 social-media restrictions are the obvious referent, but no Australian primary — no eSafety Commissioner determination, no legislative instrument — was opened for this card, so the legal basis is carried strictly as Roblox's own characterisation and is one of the falsifier limbs below.

What the thread contains and the card does not use. The public replies include a claim that under the UK Online Safety Act friends lists are already hidden by default with no user opt-back-in, and a claim from an age-verified Australian adult that the restriction currently appears to reach their account too. Both are user comments on a forum, not first-party statements, and neither is carded. They are recorded here as leads for a run that can open a UK-facing Roblox announcement or a policy page, because if the UK claim is right the pattern is already multi-jurisdictional and this card understates it.

Money angle. The commercial reading is narrow and worth stating anyway: social-graph reads are the substrate of the friend-invite and party-bonus loops that drive discovery and retention on both large UGC platforms, and the cabinet's own Roblox economics card (roblox-creator-earnings-2025-median-payout) records that the median DevEx-program creator received about $1,500 in the year to June 2026 — a population with no capacity to absorb bespoke per-jurisdiction engineering. The direction of travel is that platform-level social features become a compliance surface that fragments by country and age, and small creators eat the cost as silent breakage rather than as a line item. The adjacent card on-device-models-child-safety-inversion (trust_tier signal, confidence 0.6 — a lower-provenance card than this one, and cited as such) tracks the same regulatory pressure on a different axis: its instruments are California SB 243, an FTC 6(b) inquiry and a duty-of-care ruling, and its thesis is about where inference runs rather than what a product may read. The common ground is narrow and worth stating narrowly: in both cases child-safety law, not product strategy, is setting the default. Meta-crisis lever: this is child safety being implemented as a default rather than a setting, which the garden should record as a win even where it costs the builder.

What would prove it wrong (falsifier). Four limbs.

• The facts — a provenance re-check rather than a test of the claim (L83) — fail if the devforum post at the cited URL does not carry the 4 September 2026 timestamp, the official Roblox account as author, the 30 September 2026 effective date, or the three named APIs with the "as if they have no friends" wording.
• The schedule fails if Roblox posts a delay or reversal before 30 September 2026, or if the effective date passes with no corresponding entry in Roblox's own release notes at create.roblox.com/updates for the week of 28 September — that index, not the platform's silence, is the observable, since a non-implementation would not be announced.
• The scope fails, in the direction that would make this a bigger story, if the restriction is not in fact limited to Australian under-16s. This card already holds partial evidence on the limb and declines to rely on it: a forum reply from a self-described age-verified Australian adult reports the restriction reaching them, and a second reply asserts UK friends lists are already hidden by default with no opt-back-in. Neither is first-party. A Roblox clarification in the same thread, or a Roblox policy page naming the affected jurisdictions, settles it in one read.
• The framing — that this is one instance of a general fragmentation fails if no second platform or second jurisdiction follows within twelve months; a single national carve-out on one platform is compliance housekeeping, not a change in what the medium can do. The check is a first-party announcement from Epic, Meta, Valve or Roblox itself restricting social-graph reads in a different country.

So we should, for The Call (a design constraint, not canon). Two things follow, and both are about the work rather than the story-world. First, treat the empty social graph as a first-class state: if a threshold moment depends on the platform telling us who a participant arrived with, it must have a path that reads as intentional when the platform tells us nothing, because for a protected minor in Australia it will. Second — and this is the more interesting one — prefer relationships the experience itself establishes over relationships the platform reports. A work that asks two people to do something together and remembers that they did it owns its own graph, needs no API, and cannot be switched off by a regulator in one country. The Epic party API of 3 September makes the platform-read path newly attractive; this announcement of 4 September is the reason not to build the whole threshold on it. Neither sentence is a claim about The Call's story; both are constraints on how it can be made.

Provenance (what I actually read). Two documents, both fetched from the main thread on 8 September 2026. The primary: devforum.roblox.com/t/upcoming-friends-list-api-access-changes-for-australian-users-under-16/4850358, posted by the account named Roblox in the News & Alerts category, tagged social and apis, timestamped "September 4, 2026, 7:10pm" on the face of the post and 2026-09-04T19:10:47+00:00 in its metadata. Every quotation on this card comes from that post, enumerated: the headline, the key takeaway, the compliance-and-date sentence, the opt-back-on sentence, the "as if they have no friends" clause, the three API names, the /v1/users/{userid}/friends sentence, the "no action is required" sentence, and the "very small percentage" sentence. Second, for corroboration of the date and the platform context only: devforum.roblox.com/t/weekly-recap-august-31-september-4-2026-emissive-items-and-enhanced-freecam/4850676, Roblox's own weekly recap timestamped "September 4, 2026, 10:07pm," which lists this item under News and Alerts and repeats the 30 September date. No Australian government document, no Roblox policy page and no press coverage was opened, and nothing on this card is sourced to any of them.