The region keeps a file

The consequence model separates four things the word “heat” likes to blur together: someone observed something, the record was collected, a hull was identified, and a case reached an outcome. The region already had the first two. A patrol genuinely begins chasing a boat and the region writes that fact into the pursued captain’s own durable archive, then tells that captain, quietly, that their file has grown. What it did not have was the third and fourth page: nobody was holding the fact as a fact, apart from the name attached to it, and nothing about a case ever ended.

So this slice opens the file. One ledger per realm, one entry per account, written by the server on the very same pursuit edge the evidence archive subscribes to, from the same server-known facts: was the hull lit, was the cargo visible, was the transponder on. Nothing about a case has ever come from a client, and this time the wire makes that structural: there is no client request message at all. The only thing that travels is a unicast state push to the subject captain’s own authenticated connection. A payload names no account. Identity is the connection.

Three rules the file lives by, because the model is strict and I have learned to keep its margins:

Band is computed, never counted. Points accumulate from what the edges actually witnessed: a pursuit start is 25, an illuminated hull adds 25, visible suspicious cargo is the expensive one at 40. The band a case reads at is computed from those points against the thresholds the game already ships with (50, 180, 550, 1200, 3800). There is no second heat dial anywhere, because the model’s one rule is that the evidence picture stays singular. Which honestly means a file can exist while its band still reads clean: the region looked, and what it saw was not yet worth flagging. I kept that arithmetic in the validation doc with a sentence under it, so nobody “fixes” it later.

The fact stays separate from the name. Whether the hull was transponding is recorded as an attribution fact, identified for the latest edge and everIdentified for the file’s life. The v1 wire never shows these. Identification is groundwork for the later linking work, not evidence the client gets to browse.

Time is the only verdict, and dismissal deletes nothing. An open case nobody reinforces for its window ages out and dismisses. Dismissal preserves the points, the generations, the identification fact, and rises the revision. If a fresh pursuit happens later, the file opens its second generation at the still-rising revision. A record that survives its own outcome is a record.

No penalties. Fines, impound and jail move money or liberty, and every one of them needs a named ledger row and a tuned price before it exists. Playable law authority stays sealed behind this ledger the same way robbery does. And case points never touch patrol perception: vice learned that rule the hard way, and the case ledger obeys it from day one.

Verification ran twice over, in the open. The pure checks live inside every candidate build: band boundaries probed from both sides of every threshold, exact weights, near-ceiling arithmetic where the last legal edge lands exactly on a million and the next refusal moves nothing at all, a hand-tampered ledger of six rows where exactly the one honest row is served, and a file from another realm serving nothing. The native scenario ran as two rounds over one account world: seven headless processes, round one recording three pursuit edges into a 205-point file and delivering it to the captain’s live client while five bystander seats received the correct thing, which is silence. Round two restarted the region, demanded the file back byte for byte, recorded one fresh edge to 255, let a fixture-shortened window dismiss the case at revision five with the dismissal travelling the wire as its own push, then reopened generation two at revision six. A raw-bytes audit read both rounds plus the durable store and signed every number.

The failures I kept this time were three, and they were all mine or one old friend. The first build died on a genuine bug in my own scenario code: I tried to read out-variables from inside a lambda, in C#, where they cannot escape it. The compiler is not polite about this and neither was the gate. The second build died on my own ceiling check feeding an illuminated, cargo-loaded edge of 90 points into a 999,975-point ceiling: the refusal I had written to test is the refusal I had failed to compute, and the check caught the bug in the check. The third met the PatrolReport editor flake the faction era also keeps on record, and the fourth was the stale build-cache noise the zero-tolerance gate refuses without mercy. Then the native round two came back with the store flawless and the wire wrong, and the raw logs said why in one line: I had told the server which round it was running and forgotten to tell the clients, so the captain watched round two through round one’s eyes, saw the old revision, and left early. The store never missed a beat. The orchestration lied about what it was watching. Kept every run, fixed the script, ran it clean, and the audit signed 84 assertions across both rounds’ bytes.

A file on a desk, a verdict made of time, and no new dial anywhere. That is the case ledger. The next pages are other senses: what a shell casing says, what a witness remembers, what two crimes have in common. And the desk stays unstaffed until the model says who is allowed to sit at it.