Security, Roads and Sovereignty

Status: draft v0.1, 2026-11-09. Hangs off GAME-DESIGN.md §4. This is the signature system of the game. Everything about expansion, politics, piracy and the economy's self-regulation comes out of these three pages. Numbers here are shapes, not balance — they are meant to be tuned against a simulation before any of it ships.

---

1. What this system has to do

1. Make distance from civilization cost money, continuously.
2. Let the settled galaxy expand and contract on its own, with no developer knob.
3. Give pirates and raiders a target list generated by the economy rather than by matchmaking.
4. Make roads strategic objects: worth building, worth taxing, worth cutting.
5. Stay explainable in one tooltip.

2. How protection works

Four quantities, none hand-authored, all derived: how far you are from the roads, what your subscription costs, how much of your system is covered, and how far imperial power reaches at all.

2.1 Road distance — roadDistance(s)

Graph distance from system s to the nearest Imperial Hub, measured over public and toll gates only (TRAVEL.md §4.3).

• One gate-to-gate lane = 1.
• One leg of open-space free burn = 5 — the "there is no road here" penalty.
• Unreachable = capped at MAX_ROAD_DISTANCE.

This is the keystone. It is not Euclidean distance — it is how far you are from civilisation along actual infrastructure. Build a gate chain toward your territory and every system behind it gets permanently cheaper to keep safe.

2.2 Protection is a subscription, and the bill is shared

Imperial protection is not bought by a system. Every colony subscribes for itself, and the Empire charges what patrolling the region actually costs — split between everyone who subscribes.

rate = patrolCost(roadDistance) / subscribers^γ     γ ≈ 0.8
bill = rate · revenue

Three properties, all deliberate:

• No revenue, no tax. A colony that receives nothing owes nothing, anywhere, at any distance. Failure is free, starting is free, and a quiet planet in dangerous space costs its owner not one credit.
• Distance sets the cost of patrolling, so remoteness is expensive before anything else is considered.
• Your neighbours set your bill. Every colony that subscribes alongside you makes your subscription cheaper. Every one that leaves or stops paying makes it dearer.

That last line is the engine of the whole document, and it replaces the old per-colony pricing, which made the decision depend only on distance and therefore pinned the frontier to the road network (docs/research/balance-2026-11-10.md §3).

Safety is a club good. It gets cheaper the more people want it, which means:

• A lone colony can only afford protection near the roads. Further out, safety is something a crowd buys or nobody does. One player holding a remote system alone is not forbidden — it is simply never sensible, which is the right kind of limit.
• Regions do not erode. They collapse. Each departure raises everyone else's bill; past the tipping point the remaining colonies each individually want out, and the region goes dark in a cascade. Measured: at road distance 10, twenty subscribers pay 20% of revenue each and stay; at eight subscribers the bill passes what going unprotected costs and the whole region unravels within a few cycles.
• And it grows the same way. Every new colony that subscribes cheapens the subscription for everyone around it, so prosperity genuinely does push the safe bubble outward — which is the promise GAME-DESIGN.md §2 pillar 3 makes.

The Empire bills each colony directly. The system's controlling colony collects and remits in full, keeping nothing (COLONIES.md §5) — it is the counterparty, not a toll booth.

Roads remain the deepest discount. Pulling roadDistance down lowers the patrol cost for every colony in reach, forever, before any sharing is applied.

2.3 What a system actually is

Two independent conditions, answering two different questions.

Coverage — what share of the system's revenue-earning colonies subscribe. Colonies earning nothing owe nothing and are excluded from both sides of the fraction, which is what stops a dormant squatter on the worst rock in the system from denying everyone else protection forever.

The Imperial Ring — how far the Empire can project real force at all (§2.4). Inside it, full coverage buys genuine safety. Outside it the navy comes, but late.

State	Condition	PvP stakes
Imperial Core	The Core, unconditionally and forever	Consensual only — duels and declared wars
Safe	Every earning colony subscribes and the system is inside the Ring	Hulls disabled, not destroyed; nothing is taken
Contested	Partial coverage, or full coverage outside the Ring	Partial loot: cargo and stores can be taken, hulls recoverable
Lawless	Nobody subscribes	Full destruction. Wrecks, salvage, podding

One holdout who actually earns drops the entire system to partial loot, including the neighbours who did pay. Safety is therefore a collective action problem with real politics in it: lean on the holdout, subsidise them, or pay their subscription outright — all of which are allowed.

NPC pirate pressure rises as coverage falls. An unprotected system gets raided whether or not any player is interested in it, which is what makes "the dark comes back" a mechanic rather than a metaphor.

2.4 The Imperial Ring breathes

The Ring is a radius, in jumps, and it moves with how settled its own edge is:

• More than 90% of the edge colonised → the Ring pushes out one jump.
• Below that → it pulls back one jump.
• It never retreats past a floor the Empire will not abandon.

So the reach of real imperial power is set by the playerbase, on a slow clock, with no developer input. A galaxy that colonises steadily watches full safety advance a jump at a time; a galaxy that empties watches it withdraw just as fast, until it stops at the floor and holds.

Two clocks, two scales, neither doing the other's job: coverage is local and fast, the Ring is civilisational and slow.

3. Falling behind

Subscriptions are billed each cycle. When a colony's payment fails, or it simply stops subscribing, its own protection lapses on this ramp — and because the bill is shared, every lapse raises what its neighbours pay:

Phase	Duration	What happens
Grace	1 cycle	Warning to the colony and its corp. Protection unchanged.
Lapsing	~4 cycles	Imperial response degrades cycle by cycle. The system is flagged lapsed on the public map.
Untaxed	—	No protection. Full pirate pressure. Full-destruction rules.
Reclaimed	after N untaxed cycles with no owner activity	Colonies whose owners have gone silent become ruins: lootable, then decaying over weeks.

The public lapse flag is the point. It is a live, economy-generated list of soft targets, visible to every pirate and every rival in the game. Nobody has to build content for raiders: overextended regions manufacture it — and because one lapse raises everyone else's bill, a flagged system is often the first visible crack in a cascade. It also gives a failing empire a visible, dramatic death spiral that others can watch and pile onto.

Degradation is a ramp, never a cliff — a controller who misses a weekend comes back to a problem, not a crater. And going untaxed is a legitimate strategy, not only a failure: a frontier operation that never intended to pay simply lives in the dark, keeps everything it earns, and defends itself.

4. Claims

• A planet is claimed by building a colony on it. One colony per planet, first come first served (COLONIES.md §1–2).
• Core systems can never be claimed. The Core is an imperial commons, permanently safe, permanently open. This is the structural guarantee that a player starting in year five still has somewhere to stand. It is not a balance choice, it is load-bearing.
• Control of a system is not claimed at all — it is awarded to whichever colony pays the most tax — the Empire deals with whoever is worth dealing with, and can change hands with no fighting whatsoever (COLONIES.md §5.1).

5. Gates, lanes and the politics of roads

A lane exists when two systems within jump range each hold a Gate. Building one is a project; the structure never decays. Full mechanics: TRAVEL.md §4.

Two kinds, and the difference is the whole politics of roads:

	Build	Upkeep	Who passes	Lowers tax	Other
Public road	Cheap	None	Everyone, free	Yes	Carries its maker's name forever. Only one per system pair.
Private / Allied	Normal	Yes	Owner, corp, or standings	No	Unlimited per pair
Toll	Normal	Highest	Anyone, for a fee	Yes	Unlimited per pair

The rule that gives the choice teeth:

roadDistance is measured over public and toll gates only. A private or allied gate is a corridor, not a road, and the Empire does not recognise it as civilisation reaching further out.

So: control is rented, generosity is free. A corporation can wire its territory with private corridors nobody else may use, and it will pay upkeep for that privacy every cycle and keep paying frontier tax prices, because its corridors do not count as roads. Open the road instead and the tax bill falls for everyone nearby — including the enemies whose fleets now have a highway to your door.

The public road is the cheapest option in the game and the only one that buys something money cannot: linking two systems publicly can be done exactly once, and the builder's name stays on it. It is the game's only permanent monument, and it is earned by doing the generous thing.

You cannot have a private highway and a cheap tax bill, and you cannot have one cheaply either.

Destroying a gate raises the tax bill of everything behind it, and is possible only in unsecured systems — in secure space the Empire guarantees the roads. A destroyed gate is gone, not disabled: reopening costs the full build again, and if it was the public road, its slot is free for someone else to claim and name. Sieges therefore become economic. You strangle a region by cutting its roads and waiting for the lapse flags to light up, which is a far more interesting war than a doomstack and asynchronous by nature.

Free burn always exists as the alternative: slow, invisible, and immune to anyone's politics. There is no such thing as a sealed region — only an expensive one.

6. The galaxy breathes

No developer input is required for any of this:

• Players prosperous and active → more systems where paying the Empire is worth it → the safe bubble pushes outward along new gate chains.
• Players quiet, a war goes badly, a market crashes → taxes go unpaid → lapse flags → NPC pressure → ruins → the frontier recedes toward the Core.

taxedSystems (count of systems whose controller is currently paying) is the single best health metric this game will have, and it is free.

Optional stabiliser, not built yet: if the settled bubble collapses below some fraction of its trailing average, imperial subsidies cut the tax rate at the edge, making re-expansion cheaper. A damper on the oscillation. We will only add it if simulation shows the breathing is violent rather than interesting.

7. Information

Security interacts with intel, which is what keeps the solo player alive:

• Transits through gates are logged and visible to the gate's owner. The road network is also a surveillance network, and paying for roads buys you sight.
• Free burn is effectively invisible unless someone has put sensors in open space — which costs upkeep, so nobody watches everywhere.
• The lapse map is public. Weakness is advertised by the system itself.

A careful solo operator reads the lapse map, free-burns in off the roads, takes what's undefended, and leaves before anyone correlates anything. An alliance's counter is not firepower, it is infrastructure: sensors, patrol contracts, and not overextending past what it can watch.

7.1 Two kinds of scanning

They are different mechanics with different costs, and confusing them would wreck both.

	Sweep — this document	Ping — GATHERING.md §3
Scope	Other systems, at range	The system you are sitting in
Duration	Minutes to hours	Instant
Cost	Locked in place, loud, movement cooldown	Your position, announced to everyone here
Answers	Where should I go?	What is here, and exactly where?

The sweep is strategy and it is covered below. The ping is tactical, it belongs to the mining and hunting game, and it lives in GATHERING.md.

7.2 Sweeping — you only know what you can reach

Sight is not free and it is not global. A character's scan range is a function of two things:

• Skills — what the pilot has learned. More skill, further sight.
• Equipment — scanners, arrays, survey probes. Good hardware extends and sharpens.

Both axes matter, and neither alone is enough: a veteran in a starter hull sees poorly, and a newcomer in an expensive scanner sees far but reads little of what they find.

Range is hard-capped. Nobody ever scans the other side of the galaxy. Not an endgame character, not an alliance, not with any item. This is a structural rule, in the same family as the Core being unclaimable, and for the same reason: it is what keeps the galaxy genuinely large rather than large-looking. The moment someone can survey a continent from an armchair, distance stops meaning anything and every other system in this document deflates.

Two axes, traded against each other:

Range	How far out you can look at all
Resolution	How much you learn about what you find

Resolution is layered, roughly in order of difficulty: there is a system here → what bodies it holds → what it is worth → what is built there → who is sitting in it right now. Cheap kit at long range tells you a star exists. Expensive kit up close tells you what is parked in orbit.

7.3 The sweep — scanning is something you do, not something you have

Scanning is not a passive stat that quietly keeps your map current. It is a deliberate, committed act:

• You stop the ship. Dead in space.
• You deploy and harness solar power to drive the array. Scanning costs time and exposure, not materials — which keeps it open to a newcomer with nothing.
• The bigger the sweep, the longer it takes. More range, more resolution, more hours sitting still.
• Power gathered is power radiated. A sweep is detectable, and the range at which it can be seen grows with how much energy you have harvested so far.

That is the whole design. Every scan is a wager: how much do I want to know, versus how long am I willing to be a loud, stationary object in space I do not control? The greedy sweep is the one that gets you killed.

The ladder

	Duration	Reach	Signature
Short sweep — early game	2–3 minutes	1–2 systems	Effectively undetectable
everything between	continuous	continuous	continuous
Deep survey — endgame	5–6 hours	Long	Very loud, seen from a long way off

The ladder runs from something that fits inside a three-minute check-in to an operation you plan your evening around. Both ends are real gameplay: the newcomer's two-minute peek at the next system is safe and useful, and the veteran's six-hour deep survey is an expedition that needs a safe pocket, escorts, or a very good reason to believe nobody is looking.

Aborting

A sweep can be aborted at any moment, and everything found up to that instant is kept. Partial knowledge is still knowledge.

Three rules govern what happens next.

1. You cannot move for a while. Shutting down the array and getting under way again takes a cooldown that is a fraction of the time you had been scanning — on the order of a third. A six-hour deep survey leaves you immobile for roughly two hours. A three-minute peek leaves you stuck for about a minute, which is to say: nothing.

2. You go dark, quickly. The signature fades fast once the array is shut down. Aborting buys you silence but not mobility — you stop being a beacon and become a cold object that is still exactly where it was. The danger in this game is being pinned, not being seen: a hunter holding your last known position while you sit immobile for two hours is threat enough without a light on top of it.

3. The sweep is not resumable. Starting again means starting over. Abandoning at five hours of six keeps five hours of data and costs you the whole six if you want the rest.

This is the mechanic that makes the whole thing honest:

• The punishment for greed is not losing your data. It is the length of the tail you cannot escape.
• Seeing trouble early and aborting is cheap. Seeing it late is not, because by then your cooldown is as long as your sweep was ambitious.
• Three costs grow together and never diverge: scan longer → learn more → shine brighter → take longer to run. One decision, three consequences, no separate balancing knobs fighting each other.
• Going dark turns an execution into a chase. The hunter had a beacon; now they have a last known bearing and a cold, immobile target somewhere near it. Aborting early is genuinely effective rather than merely less bad, and the hunt becomes a search instead of a formality.
• Non-resumable means a long survey is a commitment, not an accumulation. You cannot nibble at a six-hour sweep across six check-ins.

Consequences, all of them good:

• Scouts need defending. A scanning ship is the definition of a soft target, which turns escort work into a real contract and makes the lone deep-space prospector a genuinely brave profession rather than a safe one.
• Hunting scanners becomes a playstyle, and a legible one: the signature tells a hunter not just where the target is but how committed it is. A loud signature means a long sweep means a pilot who cannot leave. Brightness is an advertisement of helplessness — the same engine as the public lapse flag (§3). This game makes weakness announce itself, repeatedly and on purpose.
• It is the archetype of "active presence" (ECONOMY.md §2.1). You cannot leave scanning running overnight any more than you can leave rare mining running overnight.
• Solar power means the dark is harder to read. Dim stars, dead systems and open space between stars are slow or impossible to sweep from. The frontier physically resists being surveyed, and the deepest space hides itself without needing a rule that says so.

The one place "you can always run" does not apply. Combat's escape rule (COMBAT.md §5) says an untackled fleet can always withdraw. A ship mid-sweep, or inside its cooldown, has tackled itself. That is the trade the player knowingly made, and it is the sharpest risk decision in the early game.

7.4 Knowledge is therefore a good

This is the consequence that matters, and it falls out for free:

• Nobody can know the map. Everyone's picture is local, partial and bought.
• So charts, survey data and fleet sightings become things players trade, sell, withhold and fake. Intel joins the market as a commodity with the market's best property: it is worth more the fewer people have it.
• Scouting becomes a profession. A fast, well-skilled, well-equipped pilot who sells what they see never has to fight anyone to get rich — the purest expression of the solo path.
• Intel perishes. Deposits deplete and migrate (ECONOMY.md §2.2), owners lapse, fleets move. A chart is worth less every day it ages, which keeps the intel market alive instead of saturating once and dying.

An alliance's real territory is not what it claims; it is what it can see. Overextending past your scan coverage is how empires get surprised, and it is why sensor structures and standing scout contracts are strategic spending rather than luxuries.

8. Implementation notes

For whoever builds this — the hard part is one query, and it is tractable.

• security and tax are computed on read from stored deltas. Never stored, never ticked, no cron touching millions of rows.
• roadDistance is the only expensive quantity: it is a shortest-path over the gate graph. The gate graph is small (gates are expensive player structures, we are talking thousands, not billions) and changes rarely. Cache it; recompute with a bounded local BFS when a gate changes state.
• Billing is a daily sweep over claimed systems only — again a small set, bounded by how much the playerbase can afford to hold, which is exactly the set that matters.
• Everything in this document is per-system arithmetic over a handful of integers. There is no simulation tick anywhere in it.

9. Open questions

• [ ] The shape of rate(roadDistance) — how steeply the percentage climbs with distance — needs a spreadsheet simulation against a synthetic population before anyone codes a number.
• [x] Does free burn have a hard range limit? Settled: yes, per hop. You cross voids in legs, so genuinely isolated regions exist until somebody stages out or builds a road. TRAVEL.md §2.1.
• [ ] Can a third party pay another player's tax to keep a buffer state alive? Says yes to great politics, needs an anti-grief check.
• [ ] Should toll income be capped or market-discovered? Market, probably — a gate owner who overcharges invites a competing gate chain.
• [ ] Do ruins keep the original owner's blueprints/loot, or only materials? Affects how predatory the reclaim loop feels.
• [x] Scan range cap (§7.2) Bound to mastery plus equipment, exact ceiling deferred. The number only means something once the galaxy and travel systems exist; it gets set against a playable prototype, not on paper.
• [x] Continuous scanning or discrete sweeps? Settled: sweeps. Stop the ship, harness solar, duration scales with the size of the sweep. See §7.3.
• [x] Is a ship mid-sweep detectable, and from how far? Settled: yes, and the range scales with the power gathered so far. Short early sweeps are effectively invisible; a deep survey is seen from a long way off.
• [x] Can a sweep be aborted? Settled: any time, and you keep everything found so far. The cost of abandoning is the cooldown before you can move, which scales with how long you had been scanning.
• [x] How long is a long sweep? Settled: 2–3 minutes at the short end (1–2 systems, undetectable), 5–6 hours for an endgame deep survey.
• [x] The cooldown curve? Settled: a fraction of elapsed scan time, around a third. Six hours scanned ≈ two hours immobile. Exact fraction is a simulator number.
• [x] Does the signature decay during cooldown? Settled: it fades. Aborting buys silence but not mobility. How fast it fades is the knob that decides whether aborting early saves you.
• [x] Is a sweep resumable after an abort? Settled: no. Starting again means starting over.
• [x] How fast does the signature fade? Settled: fast. The danger does not come from being visible, it comes from being pinned. A hunter with your last known position and two hours of your immobility is threat enough; keeping the beacon lit on top of that would be piling on.
• [ ] (deferred, not now) Can intel be faked? Selling a forged chart is wonderful for the game. Revisit after the first playable.
• [ ] (deferred, not now) Do sensor structures extend a corporation's scan coverage? That would make watched space buildable and as strategic as gates — a whole system, and we should see whether players ask for it first.

---

Changelog

• 2026-11-09 — v0.1. First formalisation of Jonathan's model: tax-bought NPC protection, cost scaling with distance from main roads, non-payment inviting piracy, galaxy expanding and shrinking with the playerbase. Added: road distance measured over player infrastructure (roads as tax cuts), public lapse flags as emergent raider targeting, gate access as the substance of diplomacy, Core as unclaimable commons.
• 2026-11-09 — v0.2. §7.1 scanning: range is a function of skills and equipment, hard-capped so nobody ever sees across the galaxy. §7.2 the consequence — knowledge is local, partial, perishable and therefore tradeable; scouting becomes a profession and an alliance's real territory is what it can see.
• 2026-11-09 — v0.3. §7.2 the sweep: scanning is an act, not a stat — stop the ship, harness solar power, no interruption, duration scaling with sweep size. Consequences recorded: scouts need escorts, hunting scanners is a playstyle, dark space resists being surveyed, and a scanning ship has tackled itself (the one exception to COMBAT.md §5).
• 2026-11-09 — v0.4. §7.2 completed: signature range scales with power gathered, sweeps abort at any time keeping partial results, and the real cost of greed is a movement cooldown scaling with time scanned. Ladder fixed at 2–3 min / 1–2 systems / invisible at the bottom to 5–6 h / long range / very loud at the top.
• 2026-11-09 — v0.5. Abort rules settled: cooldown ≈ one third of time scanned, signature fades once the array is down (silence, not mobility), sweeps are not resumable. Consequence recorded: going dark turns an execution into a chase, and a long survey becomes a commitment rather than something nibbled across check-ins.
• 2026-11-09 — v0.6. Signature fade settled as fast. The principle it establishes: in this game the danger is immobility, not visibility.
• 2026-11-09 — v0.7. §5 aligned with TRAVEL.md: gates are permanent once built, no upkeep; access policies and tolls retained; roadDistance counts public and toll gates only, so opening a road is what buys the tax discount; destruction restricted to unsecured systems and requires a full rebuild.
• 2026-11-09 — v0.8. §5 updated for the two road types: public roads are cheap, upkeep-free, one per system pair and named after their builder; private and toll roads are unlimited but rented forever, and only public and toll gates count toward roadDistance.
• 2026-11-09 — v0.9. §7 split into two named mechanics: the sweep (between systems, slow, locking, loud) stays here; the instant in-system ping moves to GATHERING.md §3. Subsections renumbered.
• 2026-11-09 — v1.0. Tax engine rewritten to Jonathan's model. Tax is a rate on output — no income, no tax — with road distance setting the rate rather than the bill. Purchased security replaced by one switch: the controlling colony either pays the Empire or does not, making the system safe or unsafe for everyone in it. Four bands collapse to three states — Imperial Core, Taxed, Untaxed. System control is awarded to the most influential colony, not claimed, so it can change hands commercially (COLONIES.md §5).
• 2026-11-09 — v1.1. Tax base corrected to revenue: the credits a colony actually receives, market sales tax included, so §2.2's heading, formula and both properties now say revenue and "no revenue, no tax". The Empire bills every colony directly and the controller only collects and remits in full, keeping nothing — no local rate, no margin for the chair. The remaining balance question is the shape of rate(roadDistance) alone.
• 2026-11-10 — v1.1. Protection becomes a shared subscription: each colony subscribes for itself and the patrol cost is split between subscribers, so neighbours set your bill. Regions now collapse rather than erode, and a lone colony cannot hold remote space. A system is safe only with full coverage of its revenue-earning colonies and only inside the Imperial Ring, a radius that advances a jump when its edge passes 90% colonised and retreats when it falls below, never past a floor. Replaces the single pay/don't-pay switch held by the controller.