A real rules engine rolls the dice. The AI only tells the story.

Engine is truth.

Every d20, attack, save, and crit is rolled on the server, checked against the actual rules, and written to a tamper-evident HMAC ledger before a single word of narration is generated. The AI never sees a blank die to fill in - it sees the result and describes it.

Even the spells are honest. Cast Bless and it rolls a real +1d4 into your next attack AND your saving throws - the engine rolls them, records them, and the AI narrates what already happened. Bane clips a foe's accuracy with a real die. Banishment removes them from the fight entirely, no tricks. Greater Invisibility flips the advantage; base Invisibility ends the instant you attack, exactly as written. Every spell does what the rulebook says it does - no AI guesses, no "I think that probably means" - because the engine owns the result before the narration starts.

It cannot fudge a roll for you, and it cannot fudge one against you. No invented spell slots, no "you hit" when you missed, no rules it half-remembers. The story bends; the math does not. That one decision is what makes a LoomMaster session feel like a real table instead of a generous parrot.

And it is not a black box. That deterministic core is published source-available - one Rust core compiled to WebAssembly, native Python, and a C-ABI, so the same seed gives a byte-identical result in TypeScript, Python, and Rust. It is on npm, PyPI, and crates.io, it cleared an external security and determinism audit, and it ships with 4,270 tests green. Cross-language byte-parity is the thing that makes "the engine owns the dice, the AI only narrates" provable instead of a promise - and you can read and replay it yourself.