0091 — Site Discovery & Landscape-Driven Citadel Grid¶

Status¶

Accepted (2026-06-28, Max-approved). Design-only — no code yet. All [P] numbers are provisional pending WO calibration. The walk is complete (M1–M55 ruled); this decision reflects all seven ruling rounds including the Round-4 expedition-model simplification and the Round-5 contestation rulings. This ADR supersedes the DECISIONS.md citadel-size-cap size→level model on implementation. The companion canon lives in FEATURES/planets/planetary-survey.md (new) and the revised FEATURES/planets/citadels.md + SYSTEMS/citadel-grid.md (new). This ADR materially amends ADR-0088 (the deploy/registration gates now govern the claim race) and carries additive amendments to ADR-0056 and ADR-0084 (Amendment A and B, below).

Context¶

A planet's playable structures grid is stamped once, at founding, as a near-square lattice whose plot count is a pure function of planet size (plot_count = clamp(4 + 2·size, 6, 30)), and the maximum citadel level a planet can reach is a pure function of that same size (the citadel-size-cap table: size 1 → L3, size 2–3 → L4, size 4+ → L5). The grid is visible from the moment the planet exists, and there is exactly one grid per planet. A planet is therefore fully described, for colony purposes, by (type, size); nothing about where on the world you build matters, there is no act of discovery between "a planet exists" and "you have a colony," and there is no contest over who gets it — ownership is settled the instant a genesis device is deployed.

Several forces make this thin:

No first act. Founding is a single transaction. There is no exploration beat — the surface is known before it is settled, and the surface has no internal structure to explore.
No contest. Ownership attaches at genesis-deploy, so a freshly-formed world is never up for grabs; the multiplayer "race for a new world" the vision gestures at cannot happen.
Dead hooks already in the code. plots[].surveyed exists and is never written; _seed_terrain never emits ORE_SEAM even though MINE's terrain_bonus map references it; the grid_survey / t.exploration.survey.1 tech node is reserved for "grid fog/reveal" with nothing reading it.
Size-only sizing flattens planet-type identity. Two same-size worlds of the same type are mechanically identical colonies. There is no per-world optimization once you know (type, size).

The shipped citadel-level gate this decision must respect is derive_citadel_level (services/gameserver/src/services/structures.py), which gates every level on three conditions simultaneously:

pfa >= FLOOR_AREA[L]  AND  housed >= HOUSING[L]  AND  key_buildings_present(L)

with FLOOR_AREA = {1:2, 2:4, 3:8, 4:14, 5:24}, HOUSING = {1:0, 2:0, 3:50000, 4:100000, 5:200000}, and CITADEL_MIN_CELLS = {1:2, 2:3, 3:5, 4:7, 5:11}. CITADEL_MIN_CELLS is only the key-building packing constraint; FLOOR_AREA (footprint-cells × level over operational economy/ civic buildings) and HOUSING (powered HAB_DOME capacity, a population quantity) are separate gates. Any slot→level model that ignores the FLOOR_AREA/HOUSING headroom over-states the achievable cap.

Decision¶

Introduce site discovery and a landscape-driven citadel grid. A ground expedition explores a planet and generates a landscape result at launch; where a colony is settled sets its grid shape, usable slot count, energy baseline, resource access, habitability, and hazard load. Three rulings shape the decision:

R1 — Discovery is the mandatory first act of founding. There is no zero-effort default colony outside onboarding. To found a colony you must run a ground expedition and settle its result; the missing exploration beat is now required, not opt-in. An onboarding accommodation (§3) comps the loop for a player's first colony so a newcomer is taught, not walled.
R2 — Ownership attaches at the contestable site-settle. A freshly-formed world is not owned at genesis-deploy; it enters a contestable window during which eligible players may run expeditions and race to settle. The first valid SETTLE claims it. This makes the race for a new world a live multiplayer interaction in v1, and routes the whole deploy → contest → settle → own sequence through the ADR-0088 / ADR-0084 gates (now load-bearing, and amended — see Amendment A and B).
R3 — The realized site sets the citadel-level ceiling. Usable slots — a function of the settled site's landscape shape — cap the maximum citadel level, superseding the size→level table. R3 is reframed as the starting ceiling plus the worked-for cost-curve to raise it (T1 excavation ships in v1; T3 landscape re-template is ⚑ DEFERRED as a destructive migration).

1. The at-launch expedition model¶

Each expedition RNG-generates its result at launch. There are no pre-stored candidate sites, no CandidateSite distribution, no site_seed / GALAXY_SALT derived keys. Every expedition is a fresh roll; there is no concept of "the same site" across two expedition runs.

The planet's profile (type, size, characteristic hazard, terrain) weights the per-launch roll (M12): a VOLCANIC planet skews toward COMPACT/IRREGULAR shapes, Geothermal energy, and sulfur/fuel deposits; a TERRAN planet skews toward SPRAWLING, balanced traits. The template library is the pool of all valid grids the roll draws from (M13) — not a set of maps pre-stored per planet.

The loop is re-roll-until-satisfied: launch → result (shape, slots, energy, resources, hazards) → ACCEPT (settle on this result's grid) or re-roll (launch another expedition; costs another round of turns + credits). Casuals take the first or second result; min-maxers re-roll for the best. Only the SETTLED result persists — as the colony's playable grid. Expedition results before settlement are ephemeral (per-expedition, not banked long-term per planet per player — M55). The term "SiteIntel" refers to an ephemeral expedition result, not a persistent per-site cache.

What this removes from earlier drafts: - CandidateSite — MOOT; never persisted, never modeled - site_seed derived from planet identity — MOOT; there is no deterministic per-planet seed - GALAXY_SALT — MOOT - num_candidate_sites formula — MOOT; replaced by the re-roll loop - Per-player-per-site intel cache — MOOT; replaced by ephemeral per-expedition result

2. The grid is materialized at SETTLE — and SETTLE is the claim¶

When a player ACCEPTs an expedition result and commits a SETTLE, structures.py (single writer) materializes the grid from that result's rolled shape, template, and trait overlay. This honors the existing seed-law (one writer, reproduce-exactly, cold-start floor); it places the grid-bake at settle rather than at founding. Per R2, settle is also the ownership-attach transaction: the first valid settle on a contestable planet claims it and ends the contest. Claim granularity is whole-planet (v1): the first settle claims the entire planet.

3. The discovery loop is mandatory (with onboarding accommodation)¶

The loop — orbital scan → ground expedition(s) → compare → SETTLE — is the required path to a colony. Settling requires at least one successful ground expedition result [P] (M36): orbital scan alone cannot settle, so discovery is genuinely mandatory rather than a skippable scan.

Orbital Scan — free, instant, repeatable. Presents the planet as a rendered continent with a handful of candidate spot markers (dots) the player selects to dispatch an expedition to. The markers carry cosmetic/suggestive differentiators (terrain labels, icons) to give a sense of which to pick — these differentiators are presentational only and do not tie to any underlying data. The expedition result is an RNG roll generated at launch regardless of which spot is chosen. Orbital scan sets the scene and provides the UI dispatch point; it yields no real site data.
Ground Expedition — turns + credits [P] (M49: no survey-kit consumable in v1), launched from a ship in orbit; an optional short EXPEDITION_DELAY_MINUTES (default 10, env-tunable) that is not a hard gate. Generates at launch: a landscape result (shape, usable slots, energy source, resources, native-life risk, hazards) on SUCCESS; banded/uncertain information on PARTIAL; nothing on FAILURE.

FAILURE (M19) burns turns and credits; returns no usable intel. The area was not successfully explored — there is no stored result from a FAILURE, because nothing is pre-stored to begin with.

Hard pity (M20): K consecutive FAILED expeditions → forced SUCCESS (K = 4–5 [P], ground-tier only, general-population). Anti-lockout mechanism; the forced SUCCESS yields only the decision-grade result, no bonus reward.

Re-roll: a player who received a SUCCESS result but is unsatisfied launches another expedition. The old result expires (ephemeral); the new expedition is a fresh roll. Each re-roll costs the same base expedition price (no escalating Kth-scout — there is no "same site" to re-scout).

Governors: a per-player global concurrency cap of 3 expeditions [P]; a concurrency cap on active contested races (M31: 2 [P]).

Onboarding accommodation (M35–M44). A player's first colony runs through the same loop, but comped (colony #1 only — M35):

The comped first expedition is a guaranteed-GOOD roll (M38): ≥12 slots, decent ceiling, sev-0 hazards, native energy present, ≥1 T1–T2 deposit — structurally good, not faucet-multiplying.
Expedition cost is waived; risk roll forced to SUCCESS.
2–3 free demo expeditions at zero stakes (M39) teach the re-roll/compare mechanic.
The starter planet's contestable window is suppressed (M40: sovereign reserved planet via reserved_for_player_id, non-snipeable) — a newcomer cannot be claimed out.
The Survey Officer is scripted in v1 (M43 ⚑; ARIA-voiced only post-v1 behind AI-safety sign-off).
~5-min TTFC target (M44) + optional one-click assisted-settle (onboarding-only, offered-never-auto; still runs a real expedition honoring R1).
Returning-player / Charter re-issue: lean on ADR-0056; default returning-player to a self-declared toggle (M45 ⚑ auth carve-out).
Onboarding telemetry: aggregate-only; no per-account PII storage (M46 ⚑ privacy-first).

After onboarding completes, the full loop runs at full cost, risk, and contestability.

Three-tier no-dead-end floor (M37): 1. Soft floor: credits refunded on FAILURE. 2. Hard pity: K consecutive FAILUREs → forced SUCCESS (§ above). 3. Rescue charge: stranded-detection one-time emergency comp for new players. "No new-player lockout while a rescue charge remains."

Colony #2: optional §6.3 guaranteed-uncontested first real settle if Max wants any protection; the matchmaking variants are CUT (M41).

4. Landscape drives grid shape → shape drives usable slots → usable slots cap citadel level (R3)¶

Five natural shape classes + one engineered, each a multiplier on the size envelope B = 4 + 2·size:

Class	Mult on `B` `[P]`	Notes
COMPACT	0.85×	dense near-square; lowest ceiling, most efficient
TERRACED	1.00×	the current-model baseline shape (anchor)
LINEAR	1.10×	1–2-wide strip; 2×1 max footprint, no 2×2 (caps citadel at L4 regardless of slot count)
IRREGULAR	1.15×	disjoint clusters; clearing cost
SPRAWLING	1.30×	highest ceiling, but carries a live sprawl tax (per-slot upkeep + baseline power scale with footprint)
ENGINEERED	1.00×	ARTIFICIAL + the onboarding/floor-guarantee fallback shape

usable_slots = clamp(round(mult · B), 6, 32) [P] (slot cap raised 30 → 32).

Three-channel ceiling (the authoritative resolution of the H[L] baseline correction):

C_site    = min( C_slots , C_footprint , C_practical )
C_hard    = min( C_slots , C_footprint )        # permanent, site-bound (R3)

C_slots (hard): max L: usable_slots ≥ CITADEL_MIN_CELLS[L] — verified against structures.py. TERRACED 1.0× reproduces the current size→level cap exactly.
C_footprint (hard, NEW): topology gates. Footprint ladder (code-verified): L1–L3 need 1×1; L4 needs 2×1 (SPACEPORT); L5 needs 2×2 (ADMIN_SPIRE). LINEAR (2×1 max, no 2×2) structurally tops out at L4 despite its higher slot count — the canonical "more slots ≠ higher ceiling" case. Must be validated per template in the build-time harness.
C_practical (honest floor, resolves Q5): max L: usable_slots ≥ CITADEL_MIN_CELLS[L] + H[L], with H[L] the spare cells a standard build needs to clear FLOOR_AREA[L]/HOUSING[L] at achievable building levels. Provisional H = {1:0,2:1,3:2,4:3,5:4} [P], calibrated by a build-time harness — not asserted. H[L] is an input to the inverse function, never an addend to a level.

The headline at-settle display is C_practical (M5: the guaranteed achievable floor, never optimistic packing). C_hard appears only as a clearly-labeled "potential ceiling — requires densification investment" secondary, never the advertised number.

T1 excavation ships in v1 (M7): players can push a site's ceiling upward with effort. R3 is reframed: site sets the starting ceiling + the cost-curve to raise it, not an immovable cap. T2 orbital annex: design-only/v1-optional. T3 landscape/structural re-template: ⚑ DEFERRED (M8) — destructive migration of a populated colony's planet.structures; needs a non-destructive re-bake design before it could ship.

Cap basis (M3): largest_connected_component + a visible bridged_potential_level, not total usable_slots, because total-slots could strand floor cells in a severed cluster.

Population stays a separate gate (HOUSING satisfied by the existing population→phase ladder; the slot model governs only the spatial ceiling).

5. Hidden grid + atomic progressive reveal¶

The full grid exists server-side from settle; the client fogs cells (visibility, not absence). The L1 founding tranche reveals instantly; each subsequent tranche unfogs atomically when the L(N-1)→LN upgrade completes (reuses the existing upgrade_hours build timer; no new timer, no fog↔timer rollback edge case). Reveal fractions 35/55/70/85/100 [P], soft-locked so revealed(L) is always ≥ the cells level L genuinely needs to build per the calibrated H[L].

Frontier reveal (M14): radiate outward from the citadel core along the connectivity graph; severed clusters stay dark until reached or bridged. Player-directed reveal is DEFERRED.

Reclaimable/CLEARABLE cells shown separately, not folded into the headline usable-slot count (M16).

6. Floor guarantee via a validated template library¶

Grids are generated from a constrained shape-template library: each (shape class, size-bucket) maps to a small set of pre-validated silhouette templates whose packing and per-level reveal tranches are validated offline, once, to guarantee the key buildings + the FLOOR_AREA/HOUSING economy fit at the shape's allowed max level. The template library is the pool from which the at-launch expedition roll draws (M13) — not a per-planet pre-stored map. Planet profile weights which templates are more likely to be drawn (M12). Traits overlay terrain/hazard/deposit onto cells without altering the validated topology. The floor guarantee is a build-time test over a finite library, not a runtime 2D bin-packing solver. ENGINEERED is the always-valid fallback. A bad roll is bland, never bricked.

Library breadth per (class, size-bucket): enough to avoid repeated maps (M13) — drives the offline validation harness size.

7. The site-trait system, phased¶

A site's intel is a roll of traits drawn against a per-site point budget (benefits spend, drawbacks refund), each resolving onto a mechanic the code already has. v1 ships: Grid Form (A), Energy (B — 4 common sources, a flat early-only native power baseline that is outgrown by a built-out colony's draw), Resource Deposits (C — terrain_bonus, capped at the existing live 0.30 ceiling, no new faucet), Habitability (F), and Hazards (G — one-time/chronic/stochastic, the primary live drawback; hazard risk is weighted by planet-type radiation_level, temperature extremes, and the NEW native_life column — M54 additive). Deferred: Logistics soft-modifiers (D), the full live Defensibility-as-PvP-axis (E — informational only in v1), and legendary Wonders (H).

A SUCCESS expedition names every hazard on the connected core / anchors / veins (M11); only cosmetic peripheral hazards may be reveal-time discoveries.

Energy (M6): native stays flat early-only; ABUNDANT capped flat — native energy is NOT a late-game scaling source.

Deposit depletion ships v1 (M47): the anti-monopoly long tail. Recharge is terraform-only/deferred (M50). Deposit cap 0.30 (existing) — never raised (M47).

exotic_technology production (M48): add a production source via ADVANCED CITADEL POPULATION SPECIALISTS — a high-tier citadel feature where population specialists PRODUCE exotic_technology, consuming an input resource [input TBD, P]. This is the gap-fix (the citadel/site-discovery path, NOT the Bang-enum/translator path). Touches CITADEL + ECONOMY canon — reconcile there at finalization. ⚠ reconcile with CITADEL and ECONOMY canon before WOs.

Energy (M51): non-tradable v1. BROWNOUT = throttle-not-halt (clamp, never hard stop). Energy Buffer building deferred.

Site value surfaces as tags + role filter (M53); SVI weights internal. Contest heat gated behind a ground expedition (not free orbital).

No survey-kit consumable in v1 (M49): expeditions cost turns + credits only.

8. Ownership timing & contestation (R2, Round 5/5b)¶

Ownership attaches at the first valid SETTLE, not at genesis-deploy or formation-complete. A freshly-formed world enters a contestable window: eligible players may run orbital scans and ground expeditions and race to settle. The window is the multiplayer "race for a new world."

Eligibility (M24 CANON): REAL-PLAYER GATES ONLY. Eligibility is determined by ADR-0056 (MultiAccountDetectionService — the anti-sybil/anti-alt substrate) + ADR-0088 (rep-tier / distance / ≤25% region budget). No payment gate on contesting (M27 CANON). The M24 ruling explicitly re-grounds eligibility on ADR-0056, not on ADR-0084's subscription/tier — paying to contest would breach the ratified pay-to-win firewall. ADR-0084's registration tier is set by the claimer at settle and governs visibility (see Amendment B and M26 below).

Retroactive scope (M28 CANON): R2 applies to existing unclaimed worlds, not only newly-formed ones. The CAS resolver replaces today's first-come /claim uniformly. Migration is additive only (nullable columns + resolver rollout). There is no live game and no players, so the migration applies cleanly to an empty galaxy — no player communications or live-disruption mitigation required.

Deployer head-start (M23 REVISED + CANON): During the priority window only the deployer can SETTLE, but rivals may still run expeditions. After the window, open race. - Default priority window: 3h (free players / naturally-formed / colonization-path worlds). - Paid-subscriber deployer window: 24h [P]. ⚑ This is a conscious, narrow pay-to-win firewall exception (post-creation, pre-settlement protective perk; not a power/income gate) explicitly accepted by Max. Noted in Amendment B (ADR-0084 reconciliation). - The CONTEST_PRIORITY → CONTEST_OPEN transition is fixed-wall-clock (no sliding deadline).

Contest visibility (M26 CANON — option b): Registration tier is chosen by the deployer at genesis-deploy — not deferred to settle. Visibility is fixed from the moment the planet forms (Amendment B): - Clandestine world (deployer chose Clandestine at genesis-deploy): HIDDEN from formation. Rivals cannot find it to contest; discovering a Clandestine world requires the paid black-market registry-lookup (ADR-0084). The paid lookup is the "charge rivals to find/enter" mechanic, reusing existing canon. - Registered / Chartered world: visible + free-to-contest for all eligible real players, immediately from genesis-deploy.

The final owner is still whoever settles first (R2 unchanged). Tier and visibility are set at deploy by the deployer; ownership attaches at the first valid settle.

Why deploy-time tier closes an exploit: if tier were deferred to settle, the world's pre-settle visibility would be ambiguous — a fast rival could retrieve the public registry list, travel to the sector, and race an expedition the instant the deployer's priority window expires. Setting the tier at deploy means the deployer controls visibility from formation onward.

Lore: a planet's genesis is detected by a mysterious alien force that tracks planetary registrations across the galaxy — the in-world mechanism behind the registry and its discovery lists. Registered and Chartered worlds appear on those lists at formation; Clandestine ones evade detection entirely and require the paid black-market registry-lookup to find.

Contestable-window lifecycle (M22 — RESOLVED): A planet stays in the UNSETTLED (contestable) state indefinitely until the first valid settle claims it. There is no LAPSED_DORMANT state, no decay timer, and no destructive transition out of the contestable state. The "dormant" label is cosmetic only: a world that has been unsettled for >24h may be labeled "dormant" in the UI for flavor, but this carries no state-machine effect — the planet remains fully contestable. State machine: FORMING → CONTEST_PRIORITY (deployer-only, 3h/24h) → CONTEST_OPEN (UNSETTLED — any eligible) → SETTLE_LOCKED (atomic) → CLAIMED; SUPPRESSED for onboarding starters.

ZERO loser relief (M25 CANON): A player who ran expeditions on a planet then lost the claim race eats the cost (turns + credits spent on expeditions). No relief. The expedition cost is the competitive stake in the race.

Resolution — atomic CAS (M29 CANON): First-valid-settle wins. The race is decided by intel speed and turn/credit readiness. No combat interdiction in v1 (M7 N7 = race-only).

UPDATE planets SET owner_id=:pid, status='COLONIZED', contest_state='CLAIMED',
                   settled_at=now()
 WHERE id=:planet AND owner_id IS NULL
   AND contest_state IN ('PRIORITY','OPEN','SUPPRESSED')
   AND (contest_state<>'PRIORITY'   OR :pid=deployer_id)
   AND (contest_state<>'SUPPRESSED' OR :pid=reserved_for_player_id);
-- rowcount=1 → WON; rowcount=0 → lost/ineligible

Grid materialization happens only after the CAS wins, inside one transaction (a loser never half-bakes a grid).

Settle validity predicate (R1/R2-enforcing, evaluated under the row): state ∈ {OPEN, or PRIORITY∧deployer, or SUPPRESSED∧reserved}; ADR-0056/ADR-0088 eligibility; ≥1 successful current-epoch ground expedition on this planet held by the settling account (M36 — no stored "epoch report" framing; the expedition record itself is the proof); ship in orbit now; settle cost debited in the same transaction; planet not already CLAIMED.

Settle-griefing self-limits under whole-planet v1: a spite-settler becomes the real owner (full cost + registration, irreversible, counts against their ≤25% region cap) — denial = held, defendable ownership, not a cheap veto.

Deployer ADR-0088 re-check at settle: grandfathered (M32) — they passed at deploy, not re-checked.

Combat seam (N7 = race-only v1): Cat-E defensibility stays informational-only until S1/S2 combat seam ships. The CAS resolver is unchanged when combat ships; combat becomes a modifier on readiness.

Amendment A — Additive amendment to Accepted ADR-0056 (M34 SIGNED OFF)¶

Status: Approved by Max (2026-06-27). Included in ADR-0091 (Accepted 2026-06-28). Additive change to ADR-0056's accepted status; the amendment is also appended directly to ADR-0056.

Change: Extend MultiAccountDetectionService with a new settle_contest surface — a gated participation-weight query analogous to the existing discount model:

eligible_for_contest(player_id, planet_id) → bool — returns True iff the player's account/ registration/reputation scores clear the anti-sybil thresholds for contesting the specified planet.
Soft-flag (eligible but loses ties + forfeits loser relief [P]) / hard-flag (blocked) semantics.
No new account-linking logic — leverage existing detection surfaces. The once-per-account-lifetime comp flag remains ordinary player state (not an auth/MFA surface).
No relief between ADR-0056 linked accounts (would make alt-feeding the loser-relief fund trivial).

ADR-0056's accepted status and CI-enforcement are preserved; this is an additive method surface, not a change to existing detection logic.

Amendment B — Additive amendment to Accepted ADR-0084 (M34 SIGNED OFF)¶

Status: Approved by Max (2026-06-27). Included in ADR-0091 (Accepted 2026-06-28). Additive changes to ADR-0084's accepted status; the amendment is also appended directly to ADR-0084.

Changes:

Registration-tier ↔ genesis-deploy linkage. The deployer chooses their registration tier at genesis-deploy — not deferred to settle (Clandestine 60k / Registered 10k / Chartered — existing tiers, existing pricing). Visibility is fixed from the moment of formation (M26b):
Clandestine → HIDDEN from formation; rivals cannot find the world to contest it without purchasing the paid black-market registry-lookup (ADR-0084).
Registered / Chartered → visible + free-to-contest for all eligible real players, immediately from genesis-deploy.

The final owner remains whoever commits the first valid SETTLE (R2 unchanged). Tier and visibility are set at deploy by the deployer; ownership attaches at settle.

Deployer subscriber priority window. The 24h-vs-3h priority window (M23 REVISED) is tied to the deployer's subscription tier at deploy time. This is a narrow, explicitly-accepted firewall exception (post-creation, pre-settlement; not a power or income gate). ⚑ Noted as a conscious monetization call — reconcile with the pay-to-win firewall documentation before public staging.
No subscription gate on contesting itself (M27 CANON): contesting remains free for all eligible real players. The subscriber advantage is the deployer head-start only.

ADR-0084's accepted status is preserved; these are additive changes to the registration-tier model. The F2 concern (registration-tier read = payments-adjacent ⚑): read access confirmed OK (Max M54-F2); charge/refund must be double-spend-safe per M54-F3 (idempotency + row-lock required).

Consequences¶

Time-to-first-colony now includes a mandatory discovery beat. Deliberate accepted cost; onboarding comps and the K-failure pity floor guarantee the mandatory loop can always eventually settle.
The race for a new world is a live multiplayer interaction in v1. Contestable settle (R2) supplies the depth the optional-additive framing lacked.
ADR-0088 / ADR-0084 gates become load-bearing. They govern who may enter the contest, the deployer's priority window, and the eligibility stack. Their reconciliation (Amendments A and B) is a required part of this decision, not a deferred interaction.
The citadel cap becomes shape-driven and arithmetically correct (R3). Site choice moves the max citadel level via the three-channel ceiling + T1 excavation.
Retroactive scope (M28). Existing unclaimed worlds become contestable. Migration is additive (nullable columns + CAS-resolver rollout); the galaxy is empty pre-launch, so no player communications are required and no live-disruption mitigation is needed.
The at-launch expedition model eliminates the pre-seeded site complexity. No CandidateSite, no per-planet seed storage, no per-player-per-site intel cache. The data model is simpler; the expedition record is the ephemeral result.
ZERO loser relief (M25). The expedition cost is the competitive stake; losing the race is a genuine loss.
Additive data model only. New expeditions table (expedition records + ephemeral results); additive nullable planet columns for contest state; at-settle JSONB bake on planet.structures. No destructive operation proposed. structures.py stays single writer.
Dead hooks wired. plots[].surveyed, the reserved grid_survey fog/reveal node (the §5 reveal system IS its consumer), _seed_terrain's missing deposit terrains, and the new additive native_life column (M54) all gain consumers.
Cost. A non-trivial content + UI outlay: orbital-scan / dispatch-expedition / expedition-status / settle-site endpoints; contest-window + claim-resolution endpoints; the at-settle compare UI; the fogged-grid GET; the build-time template-library validation harness.

Canon reconciliation¶

DECISIONS.md citadel-size-cap — superseded. The size→level cap is replaced by the three-channel slots/footprint/practical model (§4, R3). The size envelope B = 4 + 2·size survives as the shape-multiplier input.
ADR-0088 / ADR-0084 — load-bearing, materially amended (see Amendment A and B). These gates govern the full claim race. ADR-0084 is further amended by M26b (registration tier set at settle).
ADR-0013 (Advanced Genesis consumption) — resolved under R1+R2. The old framing (free full survey of all N sites) is MOOT under the at-launch model. Advanced-genesis tiers buy a probabilistically better outcome scaling by tier — better planet location (more likely in the star's habitable zone), larger planet size (supporting a larger citadel grid), better expedition rolls (weighted toward high-slot/high-habitability outcomes), more resources in the expedition result, and higher habitability. Higher tier = higher probability of positive outcomes across all axes; no outcome is guaranteed. See GAP-2 resolution in Open decisions.
ADR-0014 (Genesis planet-type taxonomy) — extended. Type rolls at genesis remain cross-planet variance; the planet profile now weights the at-launch expedition roll, adding intra-planet variance.
colonization.md / first-login.md (founding flow) — materially amended by R1. Founding is now "formation/find → mandatory discovery (expedition → settle)" with no zero-effort default except the onboarding accommodation.
ADR-0002 (terraforming formula) — The expedition result pre-empts the survey-de-fog beat; re-scope that beat as "the expedition returns the prospectus." T1 excavation (M7) and CLEAR (M15) are now part of the v1 grid-terraforming scope; T3 landscape re-template remains ⚑ DEFERRED.
ADR-0059 (citadel-defense fixes) — Cat-E defensibility stays informational-only until the combat seam.
M55 — ADR-0073 (naming) — Three distinct first-actor events that never collapse: first sighting (discovered_by / discovered_at) ≠ first valid settle (owner_id) ≠ genesis deploy (deployer_id). The namer keeps the name after a lost contest; reclaim-only identity (M55).
Production — per-plot terrain_bonus deposits read at point-of-use, additive to the formula, bounded to the existing 0.30 ceiling (no new faucet). Deposit depletion (M47) ships v1.

Open decisions¶

All M1–M55 are ruled. The following items require Max confirmation or sign-off before WOs are written:

Remaining [P] numbers (tune before WOs)¶

Ground expedition base cost [P] (turns + credits); hard pity K [P] (4–5); shape multipliers [P]; slot cap 6–32 [P]; H[L] headroom [P]; reveal fractions [P]; sprawl tax magnitude [P]; native energy baselines T1–T4 [P]; deployer priority window 3h/24h [P]; concurrency caps [P].

Gaps flagged for confirmation (not in MAX-RULINGS)¶

GAP-1: Orbital scan — RESOLVED (UI affordance, not real data). There is no real orbital-scan data layer. The UI presents the appearance of one: a rendered continent with a handful of candidate spot markers (dots) the player selects to dispatch an expedition to, with cosmetic/suggestive differentiators between spots. The differentiators are presentational only — they do not tie to any underlying data. The expedition result is an RNG roll at launch regardless of which spot is chosen. See §3 for the canonical orbital-scan spec.
GAP-2: Advanced genesis tier — RESOLVED. Advanced-genesis tiers buy a probabilistically better outcome across all expedition dimensions, scaling by tier: a more favorable planet LOCATION (more likely in the star's habitable zone), a larger planet SIZE (supporting a larger citadel grid), better expedition ROLLS (weighted toward high-slot/high-habitability outcomes), more RESOURCES available in the expedition result, and higher HABITABILITY. Higher tier = higher probability of positive outcomes across all these axes. No outcome is guaranteed.
GAP-3: M22 contestable-window timeout — RESOLVED. Planets stay UNSETTLED (fully contestable) indefinitely — no LAPSED_DORMANT state, no decay timer, no destructive transition. A world unsettled for >24h may receive a cosmetic "dormant" UI label for flavor; this carries no state-machine effect. The 72h-to-LAPSED figure and all dormant-lifecycle design are dropped.
GAP-4: M28 retroactive migration — CLEAN APPLY (empty galaxy). There is no live game and no players; retroactive contestability of existing unclaimed worlds applies cleanly to an empty galaxy. The migration remains additive (nullable columns, no destructive operation). No player-facing communications or live-disruption mitigation is required pre-launch. Standard additive Alembic migration + CAS-resolver rollout; no special sign-off needed before WOs.

Exploit confirmations (updated for at-launch model)¶

Re-roll is the intended mechanic; the anti-exploit is M19 (FAILURE = no intel, costs both turns AND credits) making blind grinding net-negative.
No per-planet reroll prevention needed (replaced by pity floor M20 as the only anti-lockout guard).
Expeditions grant no standalone reward (no RP/XP/medals/loot). Remove the CRT +50 RP survey grant — it is exactly the expedition-as-reward-farming anti-pattern.
Settle-griefing bounded by ADR-0056/0088 eligibility gates + deployer priority window (N6/M23).
No relief between ADR-0056 linked accounts (§8 + Amendment A).

Safety carve-outs (⚑ — never auto-built)¶

Monetization/pay-to-win firewall · payments-adjacent tier reads · ARIA-LLM dialogue · multi-account / auth guards · M8 T3 destructive grid re-template · PII telemetry · new external dependencies · M30 settle-bond (deferred) · M52 faction prospecting-rep (deferred).