0005 — Security as a tax on revenue, priced by road distance

Date: 2026-11-09 · Status: accepted

Context

Five requirements: distance from civilisation costs money continuously; the settled galaxy expands and contracts with no developer knob; raiders get a target list generated by the economy rather than by matchmaking; roads are strategic objects; it stays explainable in one tooltip (SECURITY-AND-SOVEREIGNTY.md §1). "Civilization is paid for" is pillar 3, and the three states of GAME-DESIGN.md §4.2 follow from it.

This supersedes the purchased-security-gradient decision recorded under this number earlier the same day — a continuous security(s) score bought in proportion to distance, priced by tax = BASE · purchased^α · (1 + roadDistance)^β · value. That model was dropped for two reasons: it gave the game two knobs where one would do, and it produced a gradient nobody could explain in a tooltip.

Decision

Three derived quantities per system, none hand-authored (SECURITY-AND-SOVEREIGNTY.md §2):

• roadDistance(s) — graph distance to the nearest Imperial Hub over public and toll gates only. One gate-to-gate lane = 1; one leg of open-space free burn = 5; unreachable capped at MAX_ROAD_DISTANCE.
• tax(s) = rate(roadDistance(s)) · revenue(s) — a percentage of the credits a colony actually receives, from any source, charged per cycle (one day). Road distance sets the rate, never the bill; no revenue, no tax. The Empire bills every colony directly, and the controlling colony collects its neighbours' shares and remits them in full, keeping nothing.
• Security is subscribed to, per colony, and the patrol bill is split between the subscribers in a region — so your neighbours set your price. A system is fully safe only with full coverage of its revenue-earning colonies and only inside the Imperial Ring, a radius that advances as its edge is colonised and retreats as it empties. Four states exist — Imperial Core, Safe, Contested, Lawless — and nothing between them.

Failure runs a ramp, never a cliff: grace (1 cycle, protection unchanged) → lapsing (~4 cycles, imperial response degrading, system lapsed on the public map) → untaxed (no protection, full pirate pressure) → reclaimed after N untaxed cycles, structures left as lootable ruins (§3). A planet is claimed by building a colony on it, one planet one colony; Core systems can never be claimed — an imperial commons, load-bearing rather than a balance choice (§4).

Consequences

• The public lapse flag is the raider target list: overextended empires manufacture their own content, and a failing alliance dies visibly (§3).
• Roads are a tax cut and a strategic object: pulling roadDistance down drops the percentage every colony behind a gate pays, so cutting a gate raises the tax of everything behind it and sieges become economic (§2.2, §5).
• Rich and remote systems cost more to keep: no cheap deep-space monopolies, and full safety far out is never worth buying (§2.2).
• The controller collects and remits but keeps nothing, so no share of its neighbours' tax can inflate its own revenue — incumbency has to be earned from its own trade (COLONIES.md §5.1).
• The map breathes with the playerbase, no developer input; taxedSystems is the free health metric (§6).
• Nothing ticks: computed on read, roadDistance cached over a small gate graph, billing sweeping claimed systems only (§8, ADR 0002).
• The shape of rate(roadDistance) is balance, not design — simulate before coding a value (§9).

Alternatives rejected

• Static safe/unsafe zones. GAME-DESIGN.md §4.2: there are no hardcoded safe/unsafe boxes; a system's state comes from whether its controller is currently paying, and it moves daily.
• Purchased security as a gradient. The decision this ADR replaces: two knobs where one would do, and a gradient nobody could explain in a tooltip.
• A local rate chosen by the controller. Either the Empire's take becomes undefined, or the controller keeps a margin that counts as its own revenue and buys its own re-appointment forever. Dropped: the Empire bills each colony, and the controller only collects.
• Developer-tuned frontier boundaries. The galaxy must expand and contract on its own with no developer knob (SECURITY-AND-SOVEREIGNTY.md §1, requirement 2, and §6). The imperial-subsidy damper is explicitly not built, and only enters if simulation shows the breathing is violent rather than interesting (§6).
• Seasonal resets. Contradicts the eternal-universe premise the whole model rests on (GAME-DESIGN.md §1, §2, pillars 1 and 6). [INFERENCE: the source docs never discuss seasons; the rejection follows from the eternal premise.]

Amendment, 2026-11-10

The binary per-colony switch was simulated and failed: tax and unprotected loss were both shares of revenue, so revenue cancelled and the frontier could not respond to prosperity (docs/research/balance-2026-11-10.md §2). Replaced by shared subscription, coverage and the Ring, which put the decision on a quantity players move. The rest of this ADR stands.