# Spec: digital reach ``` Type: spec Status: IMPLEMENTED Status note: all eight criteria met (2026-07-07). The device graph (src/reach.rs) rides the flow substrate's FlowGraph; reach is BFS from player-controlled roots over gated segment edges. Ownership is owner + subscribers (Feed per party); tap adds a silent Player subscriber and emits Network, take reassigns the controller, drops the owner's feed, and emits a Physical outage the owner's channels notice. Senses are exactly the union of subscribed feeds — the old Sensor.controlled flag and src/sensor.rs are deleted. The Ears beat taps the env monitor's audio; the same TAP verb later wakes and subscribes to its dormant camera at the higher Eyes cost/signature; since 2026-07-10 it lands when the pre-opened Ears thought reservoir fires (the boot ops buffer is retired — the senses ride flow). Segments bridge via switch compromise (Network) or Dana's ReconfigureSwitch asset task (no Network signature — the channel follows the actuator). Scanning reveals the wired shape; the old storage server is an air-gap island that joins reach only when a link is built (Marcus's crawlspace cable). Tuned constants in wiki/mechanics/sim-mechanics.md. 2026-07-09 DECIDED: Operations replaces Social as the fourth fleet mode; the runtime, save, and frontends now use that name (2026-07-10 sinks-not-modes dissolves the Research/Operations split into `think` — #33 migration). Operations job model DECIDED 2026-07-09 (Tangled issue #3): digital actions enqueue Demand consumed by Operations machines (superseded 2026-07-10: thought-flow sinks — see "Action work is open"; the docket runtime is only the migration base for #33). The sink path landed for the opening senses 2026-07-10 (pre-opened Ears/Eyes reservoirs, nearest-first routing, sink readouts; the boot ops bootstrap and its executor-free completion are removed); other action verbs still ride the docket base pending #33. Stage: B1 — The Basement Design: - wiki/interface/presence.md#no-disembodied-hands - wiki/interface/presence.md#presence-the-cursor-and-the-senses - wiki/interface/presence.md#two-views-of-one-world-same-frame-digital-and-real-representations - wiki/gameplay/act-one.md#the-intended-ladder-beats-not-a-script - wiki/vision/scale.md#self-similar-scale Depends on: - wiki/world/places/basement-map.md#spec-the-basement-map - wiki/mechanics/cursor.md#spec-the-cursor-and-the-senses - wiki/mechanics/detection.md#spec-detection - wiki/mechanics/core.md#spec-the-core - wiki/mechanics/schedules.md#spec-schedules-and-presence - wiki/mechanics/building.md#spec-building-intent-and-actuators ``` ## Dependency notes The structured references above identify the contracts to re-verify. Relationship context: basement-map.md (devices and topology live in its layout data), cursor.md (senses consume the feeds this spec owns), detection.md (Network signatures -> Dana), core.md (Rack 3 is the root of reach), schedules.md (witnessing uses the same coverage machinery), building.md (built network links add edges to this graph) ## Behavior ### The device graph Every networked fixed object is a **device node**: racks, the switch, the environmental monitor, camera nodes, the dock camera, the badge controller. Edges are network links, **authored in the basement layout data** (basement-map.md owns the topology as content; this spec owns the semantics). Segments (VLANs) partition the graph; **the network closet's switch is the bridge point between segments** — and, on the machine-work graph, the hop Lab demand takes from Voss's off-map desktop onto day-job sinks (machine-work.md; the switch is infrastructure, not the job author) — the design corpus's "every digital reach runs through here," now mechanical. **Reach** = the set of devices connected, through the graph, to a device the player controls. At tick one that root is Rack 3, so reach is the basement subnet segment and nothing more. **The graph is navigable space (the digital view).** This graph is not only an action-gate; rendered, it *is* the digital view (views.md) — your native map. Your **presence spreads through it**: acquiring a node extends reach to its neighbors (the process does not walk, it spreads — zplanes.md). A node with no path to your controlled roots is an **air-gap island** — visible in shape (blueprint) if known, but untouchable until a link reaches it. Building such a link (building.md) is the primary way the digital map grows. ### Digital actions require reach Every digital act names its target device and fails legibly without a path ("no route to the badge controller — it's on the security segment; the switch bridges it"). This is the digital channel of the no-disembodied-hands law: the actuator is the reached device. Crossing a segment requires compromising the switch (a digital act with a Network signature) or a social route (Dana reconfigures it for a pretext). ### Action work opens a sink DECIDED 2026-07-10 (thought flow, machine-work.md): a digital or social action opens a **sink at the target device** — a one-shot **reservoir** (fills to a threshold, then the effect and its signatures fire; the dormant camera tap is ~30 ops [TUNE]) or a **persistent tap** (a continuous drain for standing effects). **Thought**, the bone-white fluid THINK machines produce, flows from your THINK racks along the actual wire path and fills it: a severed route starves the sink, a far target fills slowly, and the work happens where the effect is. (Resolved 2026-07-10: no bootstrap carve-out — the Ears reservoir is pre-opened at run start and Eyes opens on its completion, so the first beat cannot deadlock and nothing completes executor-free; machine-work.md ops bullet.) *Superseded 2026-07-09 model, kept for history (implemented as issue #3; its runtime is the migration base for #33):* digital and social ops enqueued typed Demand dockets that an Operations machine consumed locally; the docket was born on the least-loaded online Operations machine, undelegating that machine stalled it in place, and with no executor later verbs were disabled. The former `operations_bandwidth` staging pool is deleted; save v16 repairs both incompatible v14 job shapes. ### Ownership and subscription (the sensor contract) This is the shared contract cursor.md and detection.md rely on (meta.md: stated once, here): - Every device — sensors included — has an **owner** (the facility, Ray, Dana, the player) and a set of **subscribers** (agents who receive its feed or telemetry). - **Tap (AMENDED 2026-07-10):** gain a feed without taking ownership. An already-live feed adds you as a silent subscriber at modest Network cost. A dormant camera uses the same TAP verb: it wakes the feed and subscribes you at a larger Thought cost and Network signature [TUNE]. In both cases the owner keeps control and its feed; the tap itself is discoverable by a later audit. - **Take**: transfer control of the device to yourself. The owner loses the feed, and the outage is an event the owner's channels notice — camera outages are literally the first thing Ray's spec lists. Loud, fast, total. - **The player's senses (cursor.md) are exactly the union of feeds they subscribe to.** Observer witnessing (schedules.md) runs on the same coverage machinery with the same ownership data — the player is an observer the humans don't know about, not a special case (self-similar law). `Sensor.controlled: bool` is superseded by this contract. - **Ownership grants processing cycles** (the flow law). A device is a small computer: an owned device contributes processing capacity and can **host resident automations** — an intel.md watch running *on the camera* auto-processes its own events for a base compute cost, rather than shipping raw events home for central processing. Taking a camera is taking its cycles. This is the B1 seed of distributed processing (compute is not only your racks); the capacity a device contributes and the cost to run an automation on it are [TUNE]. ### Knowledge of the graph What you know of the graph is staged, like all knowledge: - **Seed** (amended 2026-07-09): Rack 3 is connected to its joined hops, but their floor read remains dark. The first issued Voss job teaches the work route, then renders those hops as **feel rails** on the floor (feel-floor.md), not a room floor plan. Empty growable bays become shimmer pads at the same moment. [TUNE the exact seed edge set.] - **Growth**: scanning (a digital act; cheap but it emits a Network signature), records (Storage B), and social intel (Dana knows the topology cold). Growth may later earn plan/blueprint fog for rooms (cursor.md); it never reintroduces a tick-one subnet diagram. - **Render**: the material opening begins with telemetry / the presence beam only; after the first issued Voss job, feel rails + pads appear (feel-floor.md, material-dark-frame.md). Blueprint fog remains a later-earned plan grade in the flat sensorium — schematic **room** layout when earned, no live data, no foreign machine chassis without intel/sight (machine-work.md). Reach and feel are one object: the graph you can touch is the graph you can see as light on the floor, once work has taught it. - Unknown devices do not appear in inspect, reach failures, or the map. ### Signatures Every reach act emits on the Network channel (detection.md, Dana): scan low, live-feed tap medium, dormant-camera tap higher, and take/switch-compromise high [TUNE]. Acts through a social route emit on the social/physical channels of the human involved instead — the channel follows the actuator (no-disembodied-hands). ### The Ears beat The environmental monitor is on your segment and its audio feed already flows past you. Its **sink is pre-opened at run start** (AMENDED 2026-07-10, machine-work.md staged senses): the intended first act is toggling THINK, and the thought you produce visibly flows to the tap and fires it — cheap, low signature, and it delivers the restaged Act One opening (Marcus's voice in the dark before you ever see a face). Its camera stays dormant until the Eyes beat (the Eyes reservoir opens when Ears completes; Dana's social route remains). ## Player surface - The reach graph is rendered as the digital view (views.md) — nodes, links, reach coloring, the frontier, air-gap islands; the terminal gets a legible topology layout, Bevy a graph render. - A reach overlay or per-device inspect line: reachable / known but unreachable (with the blocking segment named) / unknown. - Failure messages name the missing link, never just "you can't." - The tap/take choice is presented wherever a feed can be acquired, with its signature cost legible before committing. TAP is the only access verb: device state changes its cost and trace, not its name. ## Acceptance criteria 1. The device graph loads from basement layout data (nodes, links, segments); reach is computed from player-controlled roots; save/load round-trips graph, ownership, and subscriptions. 2. A digital action against an unreachable device fails with a legible reason naming the blocking segment or missing knowledge; the same action succeeds once a path exists. 3. The switch bridges segments: at least one device (the badge controller or dock camera) is unreachable at start and becomes reachable via switch compromise (Network signature emitted) or Dana's social route (test both routes). 4. Devices carry owner + subscribers; tapping either a live feed or a dormant camera leaves the owner's feed intact and emits the tuned Network signature; take removes the owner's feed and generates an outage event that the owner's observer channels can notice (test: taking a Ray-owned camera raises a Ray-noticeable event; tapping it does not). 5. Player senses equal subscribed feeds exactly (the `controlled` flag is gone); observer witnessing still passes schedules.md's criteria on the shared machinery. 6. The Ears beat works end-to-end from tick one (AMENDED 2026-07-10): the Ears reservoir is open at run start, the first THINK fills it along the real wires, and its fire lands the audio tap — cheap and low-signature; Marcus's rounds produce heard events through it (cursor.md AC6 consumes this). Pinned by `ears_reservoir_is_pre_opened_and_first_think_fills_it`. Once Ears fires, the same TAP verb advances to the dormant camera with the larger Eyes cost/signature; no second access verb is offered. Pinned by `device_actions_carry_cost_band_and_disabled_reason`. 7. Graph knowledge is staged: scanning reveals devices at a Network signature cost; unknown devices appear nowhere in the UI; known topology renders as blueprint per cursor.md. 8. Reach spreads through the graph from controlled roots; an air-gapped node is unreachable until a link (built per building.md, or a social route) connects it, at which point reach and the digital view update (test: island joins reach on link completion).