Galaxy — Game Design

Status: draft v0.1, 2026-11-09. Owner: Jonathan (@PuKoren). This is the spine; subsystem docs hang off it. Nothing here is implemented. We are in planning. See ROADMAP.md for what gets built when.

---

1. Premise

An eternal, procedurally generated galaxy the size of the Milky Way. You arrive as a single pilot in one ship and end up, if you want it, running a sovereign stretch of space. The galaxy is too big to conquer and too big to map — it can only be settled, and settlement is expensive, so civilization breathes: it expands when players are rich and active, and the frontier rots back toward the core when they are not.

You play it like a spreadsheet MMO — queues, logistics, reports, markets, politics — rendered as a place you can actually look at.

2. Pillars

These are the tiebreakers. When two features conflict, the one that serves a pillar wins.

1. The galaxy is bigger than everyone. No player, alliance or event ever "finishes" it. Scarcity is local, never global.
2. Distance is the core mechanic. Everything costs more, takes longer and is less safe the further out it is. Every other system is a consequence of this one.
3. Civilization is paid for. Safety is a service with a price. Stop paying and the dark comes back. This is the engine that makes the map breathe.
4. Information beats firepower. What you know, and what others don't know about you, is the deepest resource. This is what keeps solo play viable.
5. Asynchronous by design. A satisfying session is 3 minutes on a phone. Nothing important requires you to be online at a specific moment.
6. Power plateaus, options don't. A three-year veteran has vastly more reach, flexibility and knowledge than a one-month player — not 100× the combat power. Required for an eternal universe to stay joinable.

3. Anti-pillars

Things we deliberately refuse, written down so no one re-proposes them in month six.

• No pay-to-win, no monetization at all for now. Not a roadmap item. Not "designed for later". Design as if money will never exist; we'll find an honest model once the game is fun.
• No tracking. No analytics SDKs, no third-party scripts, no ad identifiers, minimal PII. Aggregate game telemetry (server-side, anonymous) only, for balance.
• No twitch skill. Reflexes must never decide an outcome. Phones, bad networks and other time zones are first-class.
• No mandatory socialising. Alliances are the strongest path, not the only path.
• No daily-login jail. Missing two days must cost you opportunity, never your assets (outside lawless space, where you chose the risk).
• No global auction house. Goods move physically or they don't move.

4. The world

4.1 The galaxy is a function, not a table

The galaxy is generated deterministically from a single seed. Position → star → planets → resources is a pure function. Nothing exists in the database until a player touches it; then we store only the delta (discovered, claimed, built, destroyed).

Consequences, all of them good:

• Hundreds of billions of stars cost zero storage and zero upkeep.
• "Too big to seize" is literally true rather than a balance number.
• A cheap client can render anything locally from the seed — the server only sends deltas and the things it's willing to let you see.
• No galaxy-generation step, no world size cap, no migration when we grow.

Structure mirrors the Milky Way: a barred spiral disc, dense core, four arms, thin halo. Density drives everything — travel cost, encounter frequency, resource richness, loneliness.

4.2 Regions, not zones

There are no hardcoded safe/unsafe boxes. A system is safe because the colonies in it are currently paying for it to be — and there are only four states in the whole galaxy:

State	Who keeps order	PvP stakes
Imperial Core	The Empire, unconditionally, forever	Consensual only — duels and declared wars
Safe	The imperial navy, because every revenue-earning colony in the system subscribes and the system is inside the Imperial Ring	Partial loot: cargo and stores can be taken, hulls are disabled and recoverable
Contested	The navy, late and thin — partial coverage, or full coverage beyond the Ring	Partial loot, and it falls to lawless the moment the last subscriber leaves
Lawless	Nobody	Full destruction, podding, permanent loss

Nobody flips a switch for everyone else. Protection is a subscription each colony buys for itself, charged as a rate on the revenue that colony actually takes in, and the Empire splits the cost of patrolling the region between the subscribers — so each share falls as neighbours join and climbs as they leave.

Safety is therefore a collective action problem, and that is where the politics of the game comes from. Full protection needs every revenue-earning colony in the system paying: one holdout drops the whole place to partial loot, the colonies that paid included. Neighbours have every reason to lean on that holdout, subsidise them, or pay their bill outright — any colony may pay another's subscription.

Two things move the boundary of safe space, and neither is anyone's decision alone: coverage, who nearby is paying, and the Imperial Ring — a radius in jumps that pushes out one jump per cycle while its edge is colonised and pulls back when it thins, never past a floor the Empire will not abandon. See SECURITY-AND-SOVEREIGNTY.md; that document is the heart of the game.

4.3 Roads

Travel happens two ways:

• Lanes — the FTL road network. Fast, cheap, scheduled, and visible: anything on a lane can be seen by anyone watching it. Core lanes are ancient and imperial. Beyond the Core, a lane exists only because a player built the gates at both ends.
• Free burn — crossing open space under your own drive. Slow (hours to days) but nearly undetectable — the exact inverse of a lane, which is fast and watched. The smuggler's road, the scout's road, the solo player's road.

This single split produces: emergent highways, meaningful chokepoints, a reason for infrastructure to be a strategic asset, a stealth game that needs no stealth stat, and the "main roads" that the tax formula measures distance from.

Crossing the galaxy is a weeks-long expedition, not a commute. You live in your region. Politics is local. This is intentional and must not be softened.

5. The player's arc

Four acts. Each one adds a layer without removing the previous one — the pilot layer is still there when you're a sovereign.

Act I — Pilot (first session, ~30 min) One ship, in Core space. Fly, scan, mine, haul, sell, die safely. Opens on a derelict with a story in its logs. Goal of this act: the player understands that space is big and that information is worth money.

Act II — Operator (first week) Drones. Your ship becomes a small mobile command node — mining drones and scout probes launched from the hull, working the deposit beside you, more yield per hour of your presence and none in your absence. This is "empire mode at kitchen-table scale" and it is where the spreadsheet game actually starts. First real decisions: specialize, and go where it's less safe for better margins.

Act III — Commander (first month) A base on a planet, in the ring of systems just outside the Core. Command mode: build queues, production chains, a small fleet, NPC crew, standing orders. You now have something that can be taken from you, and you start caring which of the four states you're sitting in.

Act IV — Sovereign (open-ended) Claimed systems, gates you built, taxes you pay, alliances, wars, trade empires, frontier pushes. The endgame is other people.

Progression is horizontal: skills, blueprints, licences, reputations, access, knowledge. Vertical power curves hard-cap early. A veteran wins by having the right hull, the right intel and the right friends — not by having bigger numbers.

Skills train in real time, offline, on infinite levels whose benefit converges: minutes for the first, a fortnight to be genuinely specialised, six months to master a domain, and diminishing returns forever after. Breadth therefore becomes the rational play for a veteran without any rule forbidding depth. Full system: SKILLS.md.

6. Core loops

Loop	Cadence	What the player does
Check-in	2–5 min, several times a day	Read reports, re-queue production, dispatch a run, answer alliance chat
Operation	30–60 min, a few times a week	Scout, haul a profitable route, run a raid, set up a new site, work the market
Campaign	Weekly	Alliance ops, frontier push, war, a big construction project, a trade corner
Era	Monthly+	Galaxy events, menaces, shifting borders, the slow rise and fall of regions

The check-in loop is the product. If it isn't satisfying on a phone in a lift, nothing else matters.

7. Conflict

Combat is asynchronous, deterministic and watchable. You commit a fleet, a doctrine and standing orders; the server resolves the engagement with a seeded simulation; both sides get a replay they can watch and pick apart. No one needs to be awake. Skill lives in composition, counters, logistics, intel and timing.

If both commanders happen to be online, the engagement opens for live orders between rounds — a real-time layer that is never required.

Losses are set by the state of the system you chose to be in (§4.2). Full loss exists, but only where you knowingly went looking for it.

Detail: COMBAT.md.

8. Economy

Small, legible, and shaped by distance.

• Four raw materials — Ore, Ice, Crystal, Exotics — each refining into one intermediate. Exotics refine to Antimatter, they only exist far out, and every endgame object needs them. That is what drags players toward danger.
• Credits are the imperial currency: earned from NPCs, burned by taxes. Taxes are the master sink and they scale with how much territory the playerbase is holding, so the economy self-regulates against inflation.
• Markets are regional. Orders live at a station. Goods move on ships, through space, at risk. Price differences are a map, and hauling is a career.
• Sinks: tax, gate construction, ship loss, module wear, insurance. Faucets: mining, salvage, bounties, contracts.

Detail: ECONOMY.md.

9. Society

• Corporations (alliances) — shared chat, shared hangars with roles, shared objectives, shared tax bill. The retention engine.
• Diplomacy — standings, war declarations, non-aggression, mutual protection of the roads you both depend on. Gates are the real currency of diplomacy, because they are the roads, and cutting one in unsecured space means rebuilding it from nothing.
• Market — player to player, regional, with contracts for hauling and mercenary work.
• Solo path — fully viable, with a different shape: you will never hold territory, but you can go where they can't watch, know things they don't, and take what isn't defended. Smuggler, scout-for-hire, salvager, raider, spy. The design promise is that a meticulous, discreet solo player can embarrass an alliance — never out-muscle one.

10. Identity and accounts

No tracking means no social logins. Account = device passkey, with an optional recovery email the player never has to give.

One account, one character. Settled. The character is the identity, the reputation and the track record, and that only means something if it cannot be discarded and re-rolled. It also removes the cheapest forms of espionage and market manipulation before they start.

Acting at scale is therefore done through things that are visible and accountable, never through a second self:

• Drones — your own hands, extended. Launched from your ship, never inhabited as a second self.
• Contracts — pay another player to haul, scout, escort or kill. Their reputation is on the line, which is the whole point.
• Protection agreements — standing arrangements with compensation. A corp or a mercenary underwrites your space and pays out when it fails.

Every one of these makes other players more useful to you rather than less, which is exactly what alts destroy. Details come later; the one-character rule is fixed.

11. Open questions

Tracked here until resolved, then moved into the relevant doc.

• [x] One character per account forever, or alts? Settled: one. See §10.
• [ ] Is there a soft cap on how much territory one alliance can afford, beyond the tax curve? Or is the tax curve sufficient?
• [x] What happens to abandoned player structures when the frontier recedes? Settled: both. They become lootable ruins, and then they decay to nothing. The vultures get a window, the map cleans itself up, and nothing stays standing as a monument to an empire that stopped paying.
• [x] Offline protection: does an offline player's base defend at full strength? Settled: yes, and bases are very tough besides. Being online grants advantage — boosts, active fire control, emergency repair, fighting in person — never survival. Mechanism open: COMBAT.md §7.
• [ ] How does a brand-new player in 2029 find a Core system that isn't a parking lot? Is Core space instanced per cohort, or is it genuinely infinite because the core is huge?
• [ ] Do we want NPC factions with their own politics, or is the Imperial authority a faceless utility?

---

Changelog

• 2026-11-09 — v0.1. Spine written from Jonathan's answers on world model (eternal, Milky Way scale, tax-bought security, breathing frontier), stakes (security-band-dependent, full loss in deep space), fantasy (layered pilot → empire, drones early), society (all four social systems, Rust-style solo viability).
• 2026-11-09 — v0.2. One account, one character: settled. Scale is reached through drones, contracts and protection agreements, never a second self (§10). Fourth material renamed Isotopes → Exotics, refining to Antimatter, because the old name explained nothing.
• 2026-11-09 — v0.3. Two more settled: abandoned structures are looted and then decay; offline bases defend at full strength, with presence granting advantage only.
• 2026-11-09 — v0.4. §4.2 collapsed from four security bands to three states (Imperial Core / Taxed / Untaxed), reflecting the new binary tax switch held by each system's controlling colony.
• 2026-11-09 — v0.5. Act II drones are launched from the ship and work the deposit beside you, never dispatched away on their own. Act III is a planetary colony in the ring of systems just outside the Core — the Core stays unclaimable and holds no colonies — and §7 losses are the three states rather than a scale.
• 2026-11-10 — v0.6. §4.2 rebuilt on shared insurance. The three states become four — Imperial Core, Safe, Contested, Lawless — and a system's state is set by coverage (every revenue-earning colony subscribed) and the Imperial Ring, so full coverage outside the Ring buys partial loot only. The claim that one player flips the switch for everyone is replaced by the collective-action framing: each colony subscribes for itself, the patrol bill is split between subscribers, and a holdout drops its neighbours to partial loot. Act III now counts four states.