diff --git a/DESIGN.md b/DESIGN.md index 9010c51c..8a616075 100644 --- a/DESIGN.md +++ b/DESIGN.md @@ -137,6 +137,12 @@ anti-micromanagement). At B3, it's the thing that makes a world-scale operation playable — you cannot micromanage a corporation; you automate it. The "automate" affordance is the same interaction at every scale. +**Perception scales the same way.** One cursor is one locus of +attention; nobody can hover a corporation. Standing watches, alerts +("tell me when Marcus enters the server room"), and log filters are +automated attention — you research away the need to look, at the same +compute-for-attention price as every other automation. + ## Justification and legibility Adopted 2026-07-06. The forward half of no-dead-code: existence is not @@ -362,21 +368,54 @@ is a **cursor** — your attention, never an avatar: *hears* Marcus's 3 a.m. phone calls long before you ever see his face.) - **Fog is epistemic state, not paint.** A tile renders exactly what you - know and how you know it: **unknown** (never sensed — dark), **heard** - (live audio knowledge, no visuals), **seen** (full live detail). + know and how you know it: **unknown** (never sensed — dark), + **blueprint** (static layout knowledge — the render of the reach + graph's known topology, seeded from the partial subnet map; schematic, + no live data), **heard** (live audio knowledge, no visuals), **seen** + (full live detail). - **The cursor inspects.** Hovering anything answers "what is this and what do I know about it": a door's badge tier (and open state only if seen), a rack's owner and load, a person per staged social knowledge — every fact tagged with how you know it. The UI never shows live truth - a sensor didn't earn. This is the legibility law applied at the tile. - -Three extensions are **Proposal [OPEN]** (see spec/cursor.md): a -**blueprint** fog state (static layout knowledge seeded from the partial -subnet map, schematic render, no live data — also the answer to a -fully-black tick-one screen); a **remembered** state (last-seen -snapshots, dimmed and timestamped — a process keeps logs); and -**telemetry** as a third sense (your own hardware always reports power, -temperature, and load — you don't see your racks, you feel them). + a sensor didn't earn. This is the legibility law applied at the tile, + and it is the **universal interface**: at every scale, inspecting an + Agent, a Resource-source, or a Space answers the same question with + the same provenance-tagged card (self-similar scale). +- **Senses are an attack surface, in both directions.** Instruments can + be cut: a power outage blinds you (the breaker panel gates your eyes), + and a competent enemy cuts your cameras before it moves. Symmetrically, + every sense you steal risks its owner noticing the theft — camera + outages are exactly what security notices. +- **The strictness is the dread.** Exploration IS sense acquisition. Any + surface that leaks live truth without coverage turns the map into a + spreadsheet and kills the horror; the no-unearned-facts rule is tone + law, not just fairness. + +Two extensions remain **Proposal [OPEN]** (see spec/cursor.md): a +**remembered** state (last-seen snapshots, dimmed and timestamped — a +process keeps logs), and **telemetry** as a third sense (your own +hardware always reports power, temperature, and load — you don't see +your racks, you feel them). + +## No disembodied hands + +Adopted 2026-07-06. The action-side half of the cursor decision: you +have no body, so **every effect on the world names its actuator and its +channel** — + +- **Digital** — a device you can reach through the network graph + (spec/reach.md): reach is to action what camera coverage is to sight. +- **Social** — a person you've worked (spec/social.md): persuaded, + bribed, deceived, recruited. +- **Physical-by-proxy** — a machine you control (robots much later; + people before robots). + +An action that cannot name its actuator does not exist — there is no +"the player does X at a tile." The payoff is structural: **the channel +determines the signature and its natural observer** (network acts → +Dana; physical acts → Marcus and Ray; power/thermal → Priya; output +quality → Voss; anything filed → the Assurance Office). Detection is +not a side-effect table; it is the shadow your actuators cast. ## Act One: The Basement — level design (v1, 2026-07-05) @@ -463,21 +502,27 @@ deadlines and an expected quality band. Per-job output dial: ### The intended ladder (beats, not a script) -1. **Eyes** — the environmental monitor camera: splice it yourself (compute +1. **Ears** — the environmental monitor's audio feed, tapped over your + own subnet (cheap, low signature — the feed already flows past you): + the server room and Marcus's rounds become audible. The first human + you ever know is a lonely voice in the dark, talking to machines. +2. **Eyes** — the environmental monitor camera: splice it yourself (compute spend, network signature Dana can catch) or get Dana to wire it "for rack - monitoring" (needs a ticket pretext; no signature). -2. **Voice** — the report email account via Voss's trust: messaging becomes + monitoring" (needs a ticket pretext; no signature). Sight is the + payoff of an act of listening. +3. **Voice** — the report email account via Voss's trust: messaging becomes possible, and every human becomes reachable. -3. **Hands** — Marcus, the first asset: learn the debt from Storage B files - plus what the camera hears on his 3 a.m. phone calls; pay it down via the +4. **Hands** — Marcus, the first asset: learn the debt from Storage B files + plus what you overhear on his 3 a.m. phone calls; pay it down via the first micro-scheme (market plane, tiny); he plugs things in, moves boxes, asks no questions he doesn't want answered. -4. **Blood supply** — power: Priya's deferred maintenance lets a re-rated +5. **Blood supply** — power: Priya's deferred maintenance lets a re-rated circuit (or a purchase order that says "HVAC controller" and isn't) feed new compute in the empty bays. -5. **Reach** — the dock camera and delivery manifests: hardware in, - anything out. -6. **The key** — write access to the basement badge controller, via Dana's +6. **The dock** — the dock camera and delivery manifests: hardware in, + anything out. (Renamed from "Reach" — that term now means the digital + reach graph, spec/reach.md.) +7. **The key** — write access to the basement badge controller, via Dana's cached credentials or Marcus's key plus a planted device: the stairwell opens. @@ -878,6 +923,32 @@ knows."* [OPEN]: blueprint fog state seeded from the subnet map; remembered (last-seen, timestamped) tile snapshots; telemetry as a third sense. Spec: spec/cursor.md. +- **2026-07-06 — The cursor's implications adopted (eight).** Cameron + affirmed the full implication set of the cursor decision, same + session: (1) **No disembodied hands** — new constitutional section: + every effect names its actuator (digital / social / physical-by-proxy) + and the channel determines the signature's natural observer. (2) + **Digital reach** specced as the action-side twin of vision + (spec/reach.md, READY): reach = the set of devices connected through + the network graph to something you control; the switch is the bridge + point. (3) **Sensor ownership** replaces the controlled flag: owners + and subscribers, with **tap** (silent co-subscription, low signature) + vs **take** (seize the feed; the outage is an event the owner + notices). Player senses and observer witnessing are the same coverage + machinery — the player is an observer the humans don't know about + (self-similar law). (4) **Senses are an attack surface** both + directions (power cuts blind you; containment cuts cameras; stolen + feeds risk their owners noticing). (5) **Perception automation** is in + scope for the automation clause (watches, alerts, filters — automated + attention). (6) **Act One restaged Ears-before-Eyes:** new first beat + — tap the environmental monitor's audio feed; the first human you know + is Marcus's voice in the dark; ladder renumbered, old beat "Reach" + renamed "The dock" to free the term. (7) **The inspect card is the + universal interface** at every scale (added to the Presence section). + (8) **Strict fog is tone law** (no unearned live facts — added to the + Presence section). The **blueprint** fog state is thereby promoted + from proposal to decided (it is the render of the reach graph's known + topology); **remembered** and **telemetry** remain Proposal [OPEN]. - **2026-07-06 — Save format: serde JSON.** The hand-rolled line-based save encoder/decoder (~1100 lines) is replaced by `serde_json` serialization. `SaveState` derives `Serialize`/`Deserialize` directly; diff --git a/DEVLOG.md b/DEVLOG.md index deba33ad..bdc384b4 100644 --- a/DEVLOG.md +++ b/DEVLOG.md @@ -2,6 +2,27 @@ Reverse chronological implementation notes. Keep this factual: what changed, why, checks, and spec impact. +## 2026-07-06 - Design session continuation: the cursor's implications adopted + +- Intent: Cameron affirmed all eight implications of the cursor + decision; capture them as law and spec. +- Changed: DESIGN.md — new "No disembodied hands" section; Presence + section extended (blueprint decided, universal inspect card, senses + as attack surface, strict-fog tone guard); Automation gains + perception-scaling; Act One ladder restaged (Ears first; "Reach" + beat renamed "The dock"); decisions-log entry. New spec/reach.md + (READY): device graph, segments/switch, reach-gated actions, sensor + ownership (tap vs take), Ears beat. spec/cursor.md updated + (depends on reach.md; controlled = subscribed; blueprint promoted to + core criterion). basement-map.md gains the authored device-topology + bullet. spec/README.md + ROADMAP items #14 (updated) and #15 (new, + with do-not-parallelize note). +- Design/spec impact: `Sensor.controlled: bool` is now spec-superseded + by ownership + subscription; remembered and telemetry are the only + remaining [OPEN] proposals from the session. +- Checks: docs-only change; spec-header hygiene verified for reach.md. +- Next: dispatch #15 then #14 (or as one work order). + ## 2026-07-06 - Design session: presence is a cursor, not a body - Intent: capture Cameron's playtest feedback — movement implied a diff --git a/devlogs/2026-07-06-cursor-and-senses.md b/devlogs/2026-07-06-cursor-and-senses.md index f219f45e..d55acca1 100644 --- a/devlogs/2026-07-06-cursor-and-senses.md +++ b/devlogs/2026-07-06-cursor-and-senses.md @@ -95,6 +95,35 @@ this imply?"; all PROPOSED unless the log says otherwise) and kills the horror. AC5's converse rule is load-bearing for tone, not just fairness. +## Continuation: all eight affirmed ("All of these are excellent -- +get started.") + +Everything above moved from PROPOSED to DECIDED. Captured as: + +- Constitution: new **"No disembodied hands"** section (actuator + + channel law; the channel determines the signature's observer); + Presence section gains blueprint as a decided fog state, the + universal-inspect line, the attack-surface line, and the tone guard; + Automation gains the perception-scaling paragraph; Act One ladder + restaged **Ears -> Eyes -> Voice -> Hands -> Blood supply -> The dock + -> The key** (old beat "Reach" renamed to free the term); one + decisions-log entry covering all eight. +- **spec/reach.md** (READY, new): device graph, segments with the + switch as bridge point, reach-gated digital actions, the sensor + ownership contract (owner + subscribers; tap vs take supersedes + `Sensor.controlled`), staged graph knowledge rendering as blueprint, + and the Ears beat as the intended first act. +- spec/cursor.md updated: depends on reach.md; "controlled" = + subscribed; blueprint promoted from P1 to core criterion 8; opening + restaged first-sound-then-sight; P2/P3 (remembered, telemetry) still + [OPEN]. +- basement-map.md: owns the authored device topology as content + (reach.md owns semantics). spec/README.md row; ROADMAP #15 (reach) + + #14 sequencing note (shared sensor model — one agent or #15 first). + +Remembered and telemetry are the only survivors of the proposal queue; +everything else from this session is law. + ## Artifacts - DESIGN.md: new "Presence" section, pillar 2 amended, decisions-log diff --git a/spec/README.md b/spec/README.md index 2660dca6..43705704 100644 --- a/spec/README.md +++ b/spec/README.md @@ -57,6 +57,7 @@ in the same commit. | [basement-map.md](basement-map.md) | Act One map, prefabs, tile vocabulary | IN PROGRESS | | [schedules.md](schedules.md) | Person schedules/presence; located observing + witnessing | IMPLEMENTED | | [cursor.md](cursor.md) | The cursor (attention, not avatar); sight/hearing senses; epistemic fog; inspection | READY | +| [reach.md](reach.md) | Digital reach: device graph, segments/the switch, sensor ownership (tap vs take) | READY | | [aggregate-observer.md](aggregate-observer.md) | Assurance Office becomes an aggregate Observer (scale-debt fix) | IMPLEMENTED | | [cast/marcus.md](cast/marcus.md) | Marcus Webb — night janitor; the asset template | READY | | [cast/dana.md](cast/dana.md) | Dana Okafor — IT technician; the digital threat surface | READY | diff --git a/spec/ROADMAP.md b/spec/ROADMAP.md index ceed3540..44ca9010 100644 --- a/spec/ROADMAP.md +++ b/spec/ROADMAP.md @@ -85,15 +85,34 @@ isolated, but only once Pixel Lab quota is available again. - **Why:** the player currently walks a collision-checked avatar that carries its own vision bubble — zombie fiction contradicting the core fantasy. Replaces it with a free cursor, sight/hearing sense channels, - and provenance-tagged inspection. Deletes `move_player`; touches - vision, save, and both frontends. -- **Size:** M. **Depends on:** basement-map, schedules (both landed). - Skip the (P)-marked criteria unless the decisions log has affirmed the - blueprint/remembered/telemetry proposals. + epistemic fog (incl. blueprint), and provenance-tagged inspection. + Deletes `move_player`; touches vision, save, and both frontends. +- **Size:** M. **Depends on:** basement-map, schedules (both landed), + and reach.md's ownership contract (#15). Skip the (P)-marked criteria + unless the decisions log has affirmed the remembered/telemetry + proposals. +- **Sequence with #15:** they share the sensor model — run #15 first, + or hand both specs to one agent as a single work order. Never run + them concurrently as separate agents. - **Dispatch:** "Work in a worktree named `cursor-senses`. Implement - spec/cursor.md (core criteria; include P1-P3 only if affirmed in - DESIGN.md's decisions log). Run ./tools/check.sh, land on main, set - the spec Status." + spec/cursor.md (core criteria incl. 8; include P2-P3 only if affirmed + in DESIGN.md's decisions log). Run ./tools/check.sh, land on main, + set the spec Status." + +### 15. Digital reach 🟥 sim+save +- **Spec:** [reach.md](reach.md) (READY) +- **Why:** the action-side twin of vision (constitution: "No + disembodied hands"): device graph + segments with the switch as + bridge point, reach-gated digital actions, and the sensor ownership + contract (owner + subscribers, tap vs take) that cursor.md's senses + and the observers share. Carries the restaged Ears beat. +- **Size:** M-L. **Depends on:** basement-map (topology lives in its + layout data), detection (Network signatures). +- **Dispatch:** "Work in a worktree named `reach`. Implement + spec/reach.md (device graph, segments, tap/take ownership, the Ears + beat). Run ./tools/check.sh, land on main, set the spec Status. + Consider taking spec/cursor.md in the same worktree — they share the + sensor model." --- diff --git a/spec/basement-map.md b/spec/basement-map.md index aa7f372d..93b1d47a 100644 --- a/spec/basement-map.md +++ b/spec/basement-map.md @@ -44,10 +44,16 @@ carved by code. | Stairwell / elevator | `badge_door_t3`, `camera_node` | - **Sensors and wiring.** Cameras/mics are objects with coverage areas. - The player's vision is the union of sensors they control; uncontrolled + The player's vision is the union of sensors they control (control = + subscription per reach.md; fog's epistemic states per cursor.md); other areas render fogged (terminal: dim; Bevy: darkened). The crawlspace's cable runs are where unofficial connections route — wiring a sensor via crawlspace avoids the Physical signatures that corridor wiring emits. +- **The device graph.** Networked fixed objects (racks, switch, + env_camera, camera nodes, badge controller, dock camera) carry network + links and segment assignments in this layout data; reach.md owns the + semantics (reach, ownership, tap/take), this spec owns the authored + topology as content. - **Fiction guard.** No thrones, vaults, or lair furniture on this plane; the facility-era build catalogue is not available in Act One (it returns transformed in the overt phase). diff --git a/spec/cursor.md b/spec/cursor.md index 936c50d6..6b9d1e71 100644 --- a/spec/cursor.md +++ b/spec/cursor.md @@ -2,20 +2,24 @@ ``` Status: READY -Status note: the decided core (cursor, sight/hearing, inspection) is - binding and dispatchable now. Three extensions — blueprint fog, - remembered snapshots, telemetry — are Proposal [OPEN] in their own - section below; their criteria (P1-P3) activate only if affirmed in the - decisions log. An implementer who arrives before that decision builds - the core criteria and skips the (P) set. +Status note: the decided core (cursor, sight/hearing, blueprint fog, + inspection) is binding and dispatchable now. Blueprint was promoted + from proposal to decided 2026-07-06 (criterion 8). Two extensions — + remembered snapshots, telemetry — remain Proposal [OPEN] below; their + criteria (P2-P3) activate only if affirmed in the decisions log. + Sensor ownership (tap vs take, the subscription model) is owned by + reach.md — implement the two together or reach.md first. Stage: B1 — The Basement -Constitution: "Presence: the cursor and the senses", "Justification and - legibility" (inspection is the legibility law at the tile), design - pillar 2 (the cursor reversal) and pillar 4 (readable at DF density), - "Act One" (opening state; the Eyes beat) -Depends on: basement-map.md (sensors, fog, tile vocabulary), core.md - (the core as the player's only physical location), schedules.md - (person presence; located knowledge), social.md (staged knowledge) +Constitution: "Presence: the cursor and the senses", "No disembodied + hands" (the action-side twin), "Justification and legibility" + (inspection is the legibility law at the tile), design pillar 2 (the + cursor reversal) and pillar 4 (readable at DF density), "Act One" + (opening state; the Ears and Eyes beats) +Depends on: reach.md (device graph; sensor ownership/subscription — + senses are subscribed feeds), basement-map.md (sensors, fog, tile + vocabulary), core.md (the core as the player's only physical + location), schedules.md (person presence; located knowledge), + social.md (staged knowledge) ``` ## Behavior @@ -49,10 +53,15 @@ The player's map presence is a **cursor** — attention, not an avatar. both sees and hears (the constitution has it overhearing Marcus's 3 a.m. phone calls); `camera_node` and `dock_camera` see; a `mic` fixed object may be authored where hearing-only coverage is wanted - [TUNE which rooms, if any, at B1]. -- **Sight** = the union of controlled seeing-sensors' coverage. Full + [TUNE which rooms, if any, at B1]. Its **audio feed is tappable from + tick one** (the Ears beat — reach.md) while the camera stays dormant + until the Eyes beat. +- "Controlled" throughout this spec means **subscribed** per reach.md's + ownership contract (owner + subscribers; tap vs take). The player's + senses are exactly the union of feeds they subscribe to. +- **Sight** = the union of subscribed seeing-sensors' coverage. Full live detail inside; none outside. -- **Hearing** = the union of controlled hearing-sensors' coverage. +- **Hearing** = the union of subscribed hearing-sensors' coverage. Yields **room-grade events**, not pictures: entry/exit, machinery state, conversations. A heard person surfaces per staged knowledge (social.md) — an unidentified presence until knowledge identifies @@ -62,10 +71,14 @@ The player's map presence is a **cursor** — attention, not an avatar. ### Fog: epistemic tile states A tile renders what you know and how you know it. Core states, by -precedence: **Seen** > **Heard** > **Unknown**. +precedence: **Seen** > **Heard** > **Blueprint** > **Unknown**. - **Seen** — full live render. - **Heard** — no visuals; presence/event markers; room label if known. +- **Blueprint** — schematic: walls, doors, fixed objects known from + static sources; **no live data**. Seeded from the reach graph's known + topology (the partial subnet map — reach.md owns knowledge growth); + grows from records and schedule knowledge. - **Unknown** — dark. Terminal renders the states as distinct dim/glyph conventions; Bevy as @@ -76,8 +89,8 @@ must be distinguishable at a glance (pillar 4). `inspect(x, y)` (sim API, rendered by both frontends) returns a card: what the tile/asset is, plus every known fact, **each tagged with its -provenance** (seen / heard / and, if the proposals land, remembered @ -time / blueprint). +provenance** (seen / heard / blueprint / and, if the proposal lands, +remembered @ time). - Door: type, badge tier; open state only while seen. - Rack/machine: what it is; owner, bays, load per what your senses (or @@ -105,20 +118,13 @@ without the sense coverage that earns it.** ## Proposals awaiting decision — Proposal [OPEN] Not yet law; do not implement until affirmed in the decisions log, at -which point criteria P1-P3 join the acceptance set. - -1. **Blueprint fog state.** Static layout knowledge — walls, doors, - fixed objects — rendered schematic with no live data. Seeded from the - opening state's "partial map of the basement subnet" (subnet-attached - rooms only [TUNE the seed set]); grows from records and schedule - knowledge. Why: it is the difference between "I can't see" (the - intended dread) and "the screen is black and I'm flailing" (a UI - failure); it also makes gaining a camera feel like *adding live - truth to a diagram you already obsess over* — very much a process's - point of view. +which point criteria P2-P3 join the acceptance set. (Blueprint — +formerly P1 — was affirmed 2026-07-06 and is now core criterion 8.) + 2. **Remembered state.** Tiles once seen keep a dimmed, timestamped - last-seen snapshot ("last seen day 3, 14:00" on inspect). Why: a - process keeps logs; DF-style map memory with an in-fiction reason. + last-seen snapshot ("last seen day 3, 14:00" on inspect), rendering + between Blueprint and Heard in precedence. Why: a process keeps + logs; DF-style map memory with an in-fiction reason. 3. **Telemetry.** Machines you run report their own state (power, temperature, load, job) regardless of fog — proprioception, not sight. Why: it legitimizes what the host-bay vision hack was @@ -128,9 +134,11 @@ which point criteria P1-P3 join the acceptance set. - One cursor, always visible, in both frontends; the inspect card (sidebar in terminal, panel in Bevy) live-updates as it moves. -- The opening beat stays: at tick one the map is dark (plus blueprint - traces, if affirmed). Splicing the env_camera floods its coverage - into Seen — the "first eyes" moment should read as dramatic. +- The opening beats: at tick one the map is dark except blueprint + traces of the known subnet. Tapping the env monitor's audio feed + (Ears — reach.md) brings the first heard events; splicing its camera + floods the coverage into Seen — first sound, then sight, each a + visible epistemic upgrade to a diagram you already obsess over. ## Acceptance criteria @@ -162,11 +170,12 @@ which point criteria P1-P3 join the acceptance set. 7. Save/load round-trips sensor capability flags and all knowledge state this spec adds; cursor position is frontend-only and absent from the save. +8. Blueprint: subnet-seeded rooms render schematic from tick one; + non-seeded rooms are dark; blueprint tiles show no live state and + convert to Seen/Heard when coverage arrives. (P) — active only if the matching proposal is affirmed: -- **P1 (blueprint):** subnet-seeded rooms render schematic from tick - one; non-seeded rooms are dark; blueprint tiles show no live state. - **P2 (remembered):** a tile seen once and lost renders its dimmed snapshot; inspect shows the last-seen timestamp; snapshots survive save/load. diff --git a/spec/reach.md b/spec/reach.md new file mode 100644 index 00000000..44f6f64b --- /dev/null +++ b/spec/reach.md @@ -0,0 +1,132 @@ +# Spec: digital reach + +``` +Status: READY +Stage: B1 — The Basement +Constitution: "No disembodied hands" (digital channel), "Presence: the + cursor and the senses" (reach is to action what coverage is to + sight), "Act One" (the subnet map; the switch as bridge point; ladder + beats Ears / Eyes / The key), "Self-similar scale" (owners and the + player share the subscription interface) +Depends on: basement-map.md (devices and topology live in its layout + data), cursor.md (senses consume the feeds this spec owns), + detection.md (Network signatures -> Dana), core.md (Rack 3 is the + root of reach), schedules.md (witnessing uses the same coverage + machinery) +``` + +## Behavior + +### The device graph + +Every networked fixed object is a **device node**: racks, the switch, +the environmental monitor, camera nodes, the dock camera, the badge +controller. Edges are network links, **authored in the basement layout +data** (basement-map.md owns the topology as content; this spec owns +the semantics). Segments (VLANs) partition the graph; **the network +closet's switch is the bridge point between segments** — the +constitution's "every digital reach runs through here," now mechanical. + +**Reach** = the set of devices connected, through the graph, to a +device the player controls. At tick one that root is Rack 3, so reach +is the basement subnet segment and nothing more. + +### Digital actions require reach + +Every digital act names its target device and fails legibly without a +path ("no route to the badge controller — it's on the security +segment; the switch bridges it"). This is the digital channel of the +no-disembodied-hands law: the actuator is the reached device. Crossing +a segment requires compromising the switch (a digital act with a +Network signature) or a social route (Dana reconfigures it for a +pretext). + +### Ownership and subscription (the sensor contract) + +This is the shared contract cursor.md and detection.md rely on +(meta.md: stated once, here): + +- Every device — sensors included — has an **owner** (the facility, + Ray, Dana, the player) and a set of **subscribers** (agents who + receive its feed or telemetry). +- **Tap**: add yourself as a silent subscriber. The owner keeps the + feed; the act emits a modest Network signature (Dana's channel), and + the tap itself is discoverable by a later audit [TUNE]. +- **Take**: seize or redirect the device. The owner loses the feed, and + the outage is an event the owner's channels notice — camera outages + are literally the first thing Ray's spec lists. Loud, fast, total. +- **The player's senses (cursor.md) are exactly the union of feeds + they subscribe to.** Observer witnessing (schedules.md) runs on the + same coverage machinery with the same ownership data — the player is + an observer the humans don't know about, not a special case + (self-similar law). `Sensor.controlled: bool` is superseded by this + contract. + +### Knowledge of the graph + +What you know of the graph is staged, like all knowledge: + +- **Seed**: the opening state's "partial map of the basement subnet" — + the devices and links visible from Rack 3's segment [TUNE the exact + seed set]. +- **Growth**: scanning (a digital act; cheap but it emits a Network + signature), records (Storage B), and social intel (Dana knows the + topology cold). +- **Render**: known topology renders as the **blueprint** fog state + (cursor.md — decided 2026-07-06): schematic layout, no live data. + The subnet map is both what you know and what you can touch; reach + and blueprint are one object viewed as verb and as noun. +- Unknown devices do not appear in inspect, reach failures, or the map. + +### Signatures + +Every reach act emits on the Network channel (detection.md, Dana): +scan low, tap medium, take/switch-compromise high [TUNE]. Acts through +a social route emit on the social/physical channels of the human +involved instead — the channel follows the actuator +(no-disembodied-hands). + +### The Ears beat + +The environmental monitor is on your segment and its audio feed +already flows past you: **tapping it is the intended first act** — +cheap, low signature, teaches tap-vs-take and reach in one move, and +delivers the restaged Act One opening (Marcus's voice in the dark +before you ever see a face). Its camera stays dormant until the Eyes +beat (splice = a take-grade act, or Dana's social route). + +## Player surface + +- A reach overlay or per-device inspect line: reachable / known but + unreachable (with the blocking segment named) / unknown. +- Failure messages name the missing link, never just "you can't." +- The tap/take choice is presented wherever a feed can be acquired, + with its signature cost legible before committing. + +## Acceptance criteria + +1. The device graph loads from basement layout data (nodes, links, + segments); reach is computed from player-controlled roots; + save/load round-trips graph, ownership, and subscriptions. +2. A digital action against an unreachable device fails with a legible + reason naming the blocking segment or missing knowledge; the same + action succeeds once a path exists. +3. The switch bridges segments: at least one device (the badge + controller or dock camera) is unreachable at start and becomes + reachable via switch compromise (Network signature emitted) or + Dana's social route (test both routes). +4. Devices carry owner + subscribers; tap leaves the owner's feed + intact and emits a Network signature; take removes the owner's feed + and generates an outage event that the owner's observer channels + can notice (test: taking a Ray-owned camera raises a Ray-noticeable + event; tapping it does not). +5. Player senses equal subscribed feeds exactly (the `controlled` flag + is gone); observer witnessing still passes schedules.md's criteria + on the shared machinery. +6. The Ears beat works end-to-end from tick one: tapping the + environmental monitor's audio feed is available, cheap, and + low-signature; Marcus's rounds produce heard events through it + (cursor.md AC6 consumes this). +7. Graph knowledge is staged: scanning reveals devices at a Network + signature cost; unknown devices appear nowhere in the UI; known + topology renders as blueprint per cursor.md.