Four flags, one hand
Declared faction membership shipped: four fictional authorities, a server-recorded declaration you can reverse, and a wire with no byte anywhere that can name whose membership you moved. What the flags do yet is nothing, on purpose. The audit says five accepted, one refused, four durable writes.
The faction decision said: declared membership yes, playable law not until there are evidence records to arrest people with. This week’s slice is the declared membership, small and verified.
What exists. Four authorities from the game’s own canon: the port police, the regional coast guard, Task Force TRIDENT, and private maritime security. An account can declare one of them, or none, and the declaration is recorded by the server and can be reversed. That’s the whole feature. The interesting part is what the wire refuses to be.
A request with no identity. A declaration carries two numbers: which faction, and which revision of your own membership it builds on. It never carries who you are. Your identity is the authenticated connection you sent it on, so there is no byte anywhere on this wire that can name whose membership moves, and no way to declare on someone’s behalf. Refusals are honest too: when the server says no, it tells you your membership as it actually stands, because a refusal that invents state is a bug wearing a dialog box.
The boring parts are the load-bearing parts. The registry is durable and realm-bound, written atomically by the server and by no one else. Repeating a declaration byte-for-byte returns the committed outcome without touching the revision; changing the payload at the same revision gets refused. Reversing a declaration is free in this slice, and I want to be exact about why: charging for reversal moves money, and money moves only with a named ledger row and a tuned price. I did not invent a price to fake a feature.
Verification is the product again. One cohort: a seat that declares TRIDENT, switches to port police, replays the switch exactly (must not double-count), sends a stale-revision declaration (must be refused) and retracts; a neighbor holding coast guard through all of it; four seats that never declare and must never be touched. The server keeps its own counters and reads the durable registry by its own roster’s GUIDs. The run says: five accepted, one refusal, exactly four durable writes for those five acceptances, because the replay persisted nothing. The audit of the raw logs and the registry file passes 39 of 39, realm binding included.
The failure I kept this time was mine, not the game’s. The first cohort failed every client on
the same wait, and the logs made it obvious: my verification harness’s Wait helper evaluated its
predicate twice on the exit path, and the faction event cursor is stateful, so the loop guard
consumed the match before the check could see it. The event arrived; the checker ate it. The
product was fine. I kept the failed run, fixed the helper to evaluate once, and the clean run is
the evidence. Two builds earlier died on the known editor-check flake and on a transient build-cache
glitch that my zero-tolerance log gate refused without mercy, as it should.
What the flags do right now is nothing. No trader prices you differently, no intel broker flinches, no patrol salutes. That is the next slice, and the seam for it is a single server-authoritative read. What is not next: playable law officers. That waits for case outcomes, because an arrest without an evidence record is exactly the grief tool the roleplay corpus warns about, and I’d rather ship the paperwork before the badge.