<!-- ============================================================ RECOVERED HISTORICAL ARTIFACT — pre-2.8.0 planning Original repo path : docs/REVIEW-living-os.md Deleted : 2026-07-01 in commit 2bd28aa ("docs: fix stale file refs, drop orphaned review doc, correct ignore rules") Last-good source : 2bd28aa^ (parent of the deletion commit) Recovered : 2026-07-18 into planning/_standing/ Class : ARCHIVE — frozen snapshot (baseline v2.0.0). Historical input only, NOT current truth. Content below is the verbatim last-good version. ============================================================ --> # RobCo U.O.S. — Product & Immersion Review: "The Living Operating System" > **Type:** Architecture / immersion / UX / systems-cohesion review > **Scope:** Concepts 1–10. No code, no tasks, no implementation plans. > **Baseline:** v2.0.0. Read alongside `ARCHITECTURE.md`. --- ## The Evaluative Lens Before scoring anything, one organizing principle decides almost every verdict below. RobCo's identity is a **diegetic operating system** — a machine that the player believes is _running their campaign_, not an app that _stores_ their campaign. The product has already won the "what features" war. The remaining win condition is making RobCo feel like it is **observing, interpreting, and reporting on** a world the player lives in. That reframes the whole concept list into two architectural classes: - **Derivative read-layers** — systems that _compute a view_ from state that already exists (login lines, status reports, summaries, reputation bars, trend arrows). They add **no new state field**, therefore near-zero save/cloud/migration risk, and they are exactly the texture that makes a tracker feel like an OS. This is RobCo's highest-leverage, lowest-risk territory. - **New stateful subsystems** — systems that introduce persisted fields, timers, or authored content (chem timers, event countdowns, location ambience banks, map world-data). Each one pays the full Protocol 4 tax and grows the save envelope. Valuable, but rationed. The strategic thesis of this review: **RobCo's next era is a read-layer era.** The biggest identity gain comes not from new data the player must maintain, but from RobCo _interpreting the data it already holds_ and speaking back to the player in its own voice. **Rating legend:** Low / Med / High. "Save Impact" and "Cloud Impact" rate _risk added to the persistence contract_, so Low is good. --- ## Concept-by-Concept Analysis ### 1. Contextual Terminal Messaging | Dimension | Rating | Note | | ------------------------- | ------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Product Value | Med | Pure flavor, but flavor _is_ the product here. | | Immersion Value | High | Boot/login is the first impression every session. "Courier recognized. Mojave network link established." instantly says _this machine knows me_. | | UX Value | Med | Risk-free if it never blocks input; harmful the moment it delays interaction. | | Mobile Impact | Low | Text only. | | Technical Complexity | Low | Derivative read-layer over existing state (faction, day, location). | | Architectural Risk | Low | No new state. A string table + selector. | | Save Impact | Low | None. | | Cloud Impact | Low | None. | | AI Integration Potential | Med | Deterministic by default; AI can _seed_ lines later, never gate them. | | Long-Term Maintainability | Med | Maintainable **only** if lines are data-driven and derived from state, not hand-authored per campaign. Hard-coded campaign-specific scripts are the failure mode. | **Verdict:** Accept. The single highest immersion-per-hour item in the set. Annoyance risk is real but fully controllable: rotate lines, keep them short, never animate so slowly they gate input, and let a setting reduce them to one line. Login messaging should be _derived_ ("PRIMARY AFFILIATION: NCR" because state says so), not authored per save. --- ### 2. Procedural Audio Expansion | Dimension | Rating | Note | | ------------------------- | --------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Product Value | Med | Diminishing returns past a small palette. | | Immersion Value | High (for a few) / Low (for many) | A modem handshake on cloud sync is magic; a chirp on every keystroke is fatigue. | | UX Value | Med | Sound must always confirm an action the user took, never narrate ambiently without consent. | | Mobile Impact | **High concern** | iOS requires a user gesture to start audio; background/locked-tab synthesis is unreliable and battery-costly. Continuous location ambience is the worst offender. | | Technical Complexity | Med | Procedural synthesis is harder to get _pleasant_ than to get _working_. | | Architectural Risk | Low–Med | Must inherit the existing `AudioSettings` cache + `masterMute` + per-key guard discipline (the established audio pattern). | | Save Impact | Low | Settings are localStorage, not save state. | | Cloud Impact | Low | None. | | AI Integration Potential | Low | Audio should stay deterministic and event-triggered. | | Long-Term Maintainability | Med | Each source is another toggle, another guard, another un-mute restore entry — linear maintenance cost per sound. | **What should exist:** event-bound, one-shot, user-initiated sounds — terminal chirp on submit, data-transfer burst on save/import, modem handshake on cloud push/pull, a short notification tone for status reports. These map to discrete actions and reward them. **What should not exist (or postpone indefinitely):** continuous, code-generated **location-aware ambience**. It is the highest mobile/battery/accessibility cost in the entire document, it runs without a triggering user action, and it fights the "sound confirms intent" rule. Radio static bursts sit on the fence — acceptable only as a deliberate, user-triggered effect, never an idle loop. **How far procedural audio should go:** to the boundary of _discrete, intentional events_, and no further. Every sound should answer "what did the user just do?" The moment a sound answers "where is the user," it has crossed into ambience and should stop. **Accessibility:** master mute already exists — keep it absolute. No sound should ever be the _only_ signal for a state (pair every critical tone with text). **Verdict:** Accept a small curated palette. Reject ambient location audio. --- ### 3. World Map Evolution | Dimension | Rating | Note | | ------------------------- | -------- | -------------------------------------------------------------------------------------------- | | Product Value | High | The map is the most natural home for "world intelligence." | | Immersion Value | High | A terminal that estimates travel and summarizes a region feels _alive_. | | UX Value | Med | Information density is the whole battle on a CRT aesthetic. | | Mobile Impact | Med–High | A literal pannable graphical map is the hardest thing here to make work on a phone. | | Technical Complexity | Med–High | Depends entirely on whether it stays textual or becomes graphical. | | Architectural Risk | Med | A graphical map invites a rendering subsystem RobCo doesn't currently have. | | Save Impact | Low–Med | Current location is small; a full visited-graph is larger. | | Cloud Impact | Low | Travels with state. | | AI Integration Potential | High | Regional summaries and "what's nearby" are ideal AI-derived, deterministic-fallback content. | | Long-Term Maintainability | Med | Textual = cheap forever. Graphical = ongoing asset/layout burden. | **Ideal end-state:** the map should **stop trying to be a picture and become a _location intelligence terminal_.** RobCo's visual identity is text-on-CRT, not cartography. A pannable image fights that identity and breaks on mobile. The winning form is a **textual world-intelligence panel**: current location context, nearby settlements, travel-time estimates, a short regional summary. That is information-dense in the way a terminal _should_ be, it scales to a phone trivially, and it's the same read-layer pattern as everything else strong in this list. **Verdict:** Evolve, but redirect. Yes to world-intelligence; no to "make the picture bigger." The map's future is prose and data, not pixels. Travel-time estimates belong here and should **merge with Concept 4** (see synthesis). --- ### 4. Time Intelligence System | Dimension | Rating | Note | | ------------------------- | -------- | ----------------------------------------------------------------------------------------- | | Product Value | Med–High | Timers are genuinely useful at the table. | | Immersion Value | High | A machine that says "merchant inventory resets in 2 days" is doing OS work. | | UX Value | Med | Strong _if_ surfaced on demand; corrosive if it becomes a wall of countdowns. | | Mobile Impact | Med | Live-ticking countdowns are vertical-space hungry on a phone. | | Technical Complexity | Med | Each timer type is a small stateful subsystem. | | Architectural Risk | Med | Every timer category is a new state field → full Protocol 4 cost each. | | Save Impact | Med | Timers must persist and survive migration; this is the concept's real price. | | Cloud Impact | Low | Travels with state. | | AI Integration Potential | Med | AI can _set_ timers from narrative ("you took Med-X"); the countdown stays deterministic. | | Long-Term Maintainability | Med | Bounded if you cap the timer _types_; unbounded if you keep adding them. | **What belongs:** deterministic, world-rule timers — **merchant resets** and **chem/effect durations**. These are real Fallout mechanics, finite in number, and high-utility. **What does not belong:** open-ended **event countdowns**. "Event" is undefined and infinitely expandable — it's the seam where this system becomes feature bloat. Campaign _time summaries_ are not a timer at all; they belong with the intelligence layer (Concept 10), not here. **How much is too much:** the moment the player sees more than ~3–4 active timers at once. Cap visible timers, collapse the rest, and never auto-expand a timer panel. **Verdict:** Accept a **narrow, capped** timer set (merchants + chems). Reject generic event countdowns. This is the one concept where the save-impact tax is real, so keep its surface small. --- ### 5. Reputation Visualization | Dimension | Rating | Note | | ------------------------- | ------ | -------------------------------------------------------------------- | | Product Value | Med | Standing is already tracked; this is legibility, not new capability. | | Immersion Value | High | ASCII/segmented bars are _peak_ terminal aesthetic. | | UX Value | High | A bar reads faster than a number for at-a-glance standing. | | Mobile Impact | Low | Monospace bars are compact and responsive. | | Technical Complexity | Low | Render-only over existing reputation matrix. | | Architectural Risk | Low | No new state. | | Save Impact | Low | None. | | Cloud Impact | Low | None. | | AI Integration Potential | Low | Should stay purely derived from state. | | Long-Term Maintainability | High | Render-only, trivial. | **Does it improve usability?** Yes — bars communicate magnitude and threshold-proximity faster than raw numbers. **Does it damage the aesthetic?** Only if rendered as glossy graphical bars. The correct form is **monospace segmented bars** (`[████████░░] Idolized`) which _reinforce_ rather than fight the CRT identity. **Better alternative:** none needed — but pair the bar with the named tier so the number/word stays authoritative. **Trend indicators** ("▲ rising") are the more powerful half of this concept and naturally belong to the intelligence layer. Keep the bar here (cheap, deterministic); route the _trend_ through Concept 8/9. **Verdict:** Accept, as monospace bars. One of the best immersion-per-hour items alongside Concept 1. --- ### 6. Crossroads Modernization | Dimension | Rating | Note | | ------------------------- | -------- | ----------------------------------------------------------------------------------------------- | | Product Value | Med–High | A decision/lockout spine is a strong differentiator if it's coherent. | | Immersion Value | Med–High | "Major decisions lock out paths" is exactly the kind of consequence a campaign OS should track. | | UX Value | Med | Value depends entirely on how lockouts are surfaced (currently buried in `campaign_notes`). | | Mobile Impact | Low | Text/decision content. | | Technical Complexity | Med | It already exists in a primitive form; modernizing is refactor + surfacing, not greenfield. | | Architectural Risk | Med | Decisions touch faction/quest/reputation — coupling must be deliberate. | | Save Impact | Med | Decision records must persist and migrate cleanly. | | Cloud Impact | Low | Travels with state. | | AI Integration Potential | High | Ideal as **AI-suggested, player-confirmed** — never AI-decided. | | Long-Term Maintainability | Med | Sustainable if the deterministic record is the source of truth and AI only annotates. | **Does it still support the vision?** Yes — arguably _more_ than when it was authored. A "living OS" that tracks irreversible choices and their consequences is core to the new identity, not legacy baggage. **Deterministic vs AI-assisted:** the **record must stay deterministic and authoritative**. The Gem-era design buried lockouts inside an AI-written `campaign_notes` blob — that's fragile (recursive key transforms, silent drops). Modernization means _promoting Crossroads to a first-class, deterministic decision ledger_, then optionally layering AI _interpretation_ on top ("this decision pushes you toward NCR victory"). AI suggests and narrates; the ledger remembers. **Verdict:** Promote toward flagship, but **deterministic core, AI annotation layer**. This is the natural backbone that Concept 8 reports _on_. --- ### 7. Visual Damage States | Dimension | Rating | Note | | ------------------------- | --------------------------------------------- | ---------------------------------------------------------------------------- | | Product Value | Low–Med | Cosmetic; reinforces stakes without adding capability. | | Immersion Value | High | A terminal that _degrades_ with the Courier's health is deeply Fallout. | | UX Value | Med (handled well) / Negative (handled badly) | Done wrong, it harms readability exactly when the player most needs to read. | | Mobile Impact | Med | Heavy shader-like CSS effects cost battery/perf on phones. | | Technical Complexity | Low–Med | CSS-only if disciplined. | | Architectural Risk | Low | Cosmetic layer keyed off existing HP. | | Save Impact | Low | None. | | Cloud Impact | Low | None. | | AI Integration Potential | Low | Should stay a deterministic reflection of HP. | | Long-Term Maintainability | Med | Effects are notorious for becoming "tweak forever" surfaces. | **Implementation philosophy (the safe one):** _subtractive, not additive, and never strobing._ Degradation should mean **more scanline noise, slight desaturation, a heavier vignette** as HP drops — atmosphere the player can ignore. It must **never** flash, never reduce text contrast below legibility, and must honor `prefers-reduced-motion` by collapsing to a single static "CRITICAL" text indicator. Critical-state warning is best expressed as _text first, effect second_. Default the intensity low; make it a setting; cap it hard on mobile. **Verdict:** Accept as an **opt-in, motion-safe, text-backed** cosmetic layer. Postpone until after the read-layer wave — it's polish, not identity-defining, and it carries the highest accessibility-footgun risk in the set. --- ### 8. Courier Intelligence System | Dimension | Rating | Note | | ------------------------- | -------------------- | -------------------------------------------------------------------------------------------------- | | Product Value | High | This is the answer to "how does RobCo feel like a living OS." | | Immersion Value | Very High | A status report that _understands the campaign_ is the single most identity-defining concept here. | | UX Value | High | On-demand briefing = signal without noise. | | Mobile Impact | Low | Text report; scales perfectly. | | Technical Complexity | Med | The work is _derivation logic_, not new storage. | | Architectural Risk | Low–Med | Read-only over existing state → no migration cost if kept derivative. | | Save Impact | Low | None, if it computes rather than stores. | | Cloud Impact | Low | None. | | AI Integration Potential | Very High | The ideal hybrid: deterministic skeleton, AI-narrated flavor. | | Long-Term Maintainability | High (if derivative) | Stays cheap as long as it never persists its own conclusions. | **Should it exist? Should it be flagship?** Yes and yes. This is **the flagship.** Everything else in the document is texture; this is the system that changes what RobCo _is_ — from a thing that stores a campaign to a thing that _reads_ one. The example report ("CURRENT CAMPAIGN TRAJECTORY: NCR VICTORY PATH / ACTIVE CONFLICTS: 2 / UNRESOLVED MAJOR DECISIONS: 4") is RobCo's mission statement rendered as a feature. **Deterministic vs AI-assisted — the critical design rule:** it must be **both, layered.** The skeleton (day count, primary affiliation, conflict count, unresolved-decision count, last event) is **deterministic and always correct**, computed from state, faction registry, quest log, and the Crossroads ledger (Concept 6). AI is an **optional narration layer** that turns the skeleton into prose — and must _never_ be the source of the numbers. This protects against the project's documented failure modes (AI JSON drift, silent drops) while still delivering the "the machine is thinking" feel. **Data sources:** reputation matrix, faction registry, quest/campaign log, Crossroads decisions, inventory (for the "equipment concerns" line), time system (day count). Notably, every input already exists — this concept invents no new state. **Verdict:** **Flagship. Build the deterministic core first; add AI narration after v2.0.0 stabilization.** --- ### 9. Strategic Notifications | Dimension | Rating | Note | | ------------------------- | -------- | ----------------------------------------------------------------------------------------- | | Product Value | Med | Useful nudges, but the riskiest UX pattern in the document. | | Immersion Value | Med–High | "NOTICE: reputation trajectory suggests NCR alignment" is great _once_; annoying _daily_. | | UX Value | Low–Med | Proactive interruption is the single biggest fatigue risk here. | | Mobile Impact | Med | Intrusive banners are worse on small screens. | | Technical Complexity | Med | Same derivation engine as Concept 8 — these _are_ Concept 8's findings. | | Architectural Risk | Low | Read-only. | | Save Impact | Low–Med | Only if you persist "already shown" flags to avoid repeat-spam. | | Cloud Impact | Low | None. | | AI Integration Potential | Med | Same engine as 8. | | Long-Term Maintainability | Med | Fatigue tuning is perpetual if surfaced proactively. | **The defining question — proactive or on-demand?** **On-demand, almost always.** Strategic notifications are _the same intelligence as Concept 8, sliced into one-liners._ Surfacing them proactively turns RobCo into a nagging assistant, which actively damages the "calm, competent OS" identity. The right model: notifications accumulate quietly into a **digest the player opens** (or appear as a single unobtrusive count, never a modal, never a sound by default). The "no log entries for 3 days" nudge is the only one with a real case for gentle proactivity — and even that should be a quiet line on the status screen, not an interrupt. **Verdict:** Accept — but **fold into Concept 8 as its notification facet, and default to on-demand.** Do not build a separate proactive notification system. --- ### 10. Campaign Intelligence Summaries | Dimension | Rating | Note | | ------------------------- | -------- | ----------------------------------------------------------------------- | | Product Value | Med–High | Strong recap value, especially for tables that meet irregularly. | | Immersion Value | High | "=== CAMPAIGN SUMMARY: DAYS 10–20 ===" reads like a real system report. | | UX Value | High | On-demand recap is high-signal. | | Mobile Impact | Low | Text. | | Technical Complexity | Med | Time-windowed aggregation over the campaign log. | | Architectural Risk | Low | Derivative. | | Save Impact | Low | None if computed on demand. | | Cloud Impact | Low | None. | | AI Integration Potential | High | Deterministic event extraction + AI prose summarization. | | Long-Term Maintainability | High | Cheap as a pure read-layer. | **Does it duplicate the Campaign Log?** No — it **consumes** it. The log is the raw ledger (every entry); the summary is the _interpretation_ (a windowed, ranked digest: "Major Events / Campaign Direction / Primary Activity"). That's the same log→summary relationship as a bank statement vs. a spending report. The distinction is healthy and worth preserving explicitly so the two never blur. **Should it derive from existing systems?** Entirely — it should add _zero_ new state and read the log, reputation deltas, and quest completions. Build it as a view, never as a stored artifact. **Verdict:** Accept as a **time-windowed facet of Concept 8.** It's "Courier Intelligence, scoped to a day-range" rather than a separate feature. --- ## Synthesis ### A. Concepts to Reject (or hard-bound) - **Procedural location-aware ambience (part of #2)** — highest mobile/battery/accessibility cost, runs without user intent, violates the "sound confirms action" rule. Reject outright. - **Generic event countdowns (part of #4)** — undefined, infinitely expandable, the seam where the timer system becomes bloat. Reject; keep only merchant + chem timers. - **Graphical/pannable World Map (part of #3)** — fights the text-CRT identity and breaks on mobile. Reject the _picture_; keep the intelligence. - **A standalone proactive notification system (#9 as drawn)** — reject the _standalone, push_ framing; keep the content as an on-demand facet of #8. ### B. Concepts to Merge The dominant structural finding: **#8, #9, and #10 are one system, not three.** They share inputs, share derivation logic, and differ only in presentation slice: > **Courier Intelligence Layer** = #8 (full status report) + #9 (one-line notices, on-demand) + #10 (time-windowed summaries). One deterministic engine, three views. Two further merges: - **#3 travel-time + #4 timers → one "World/Time Intelligence" surface.** Travel estimates are time math about places; they belong with the time system, and the redirected map becomes their display. - **#1 contextual login + #8 status skeleton** share the same derived facts. The login line is the Courier Intelligence Layer's "boot summary." Build them off the same derivation. - **#5 reputation _bars_ stay standalone (cheap render); #5 reputation _trend arrows_ → Courier Intelligence Layer.** ### C. Concepts That Should Become Flagship Systems 1. **Courier Intelligence Layer (#8+#9+#10)** — the defining system of RobCo's next era. 2. **Crossroads as a deterministic Decision Ledger (#6)** — the backbone the Intelligence Layer reports _on_. Flagship-adjacent: it makes #8's "unresolved major decisions" line real. ### D. Concepts That Best Reinforce RobCo's Identity In order: **#8 (Courier Intelligence)** — it _is_ the identity statement; **#1 (contextual messaging)** — first impression every session; **#5 (reputation bars)** and **#7 (damage states)** — the visual CRT texture; **#6 (Crossroads ledger)** — consequence and memory. Every one of these is the machine _knowing and reflecting_ the player. ### E. Highest Immersion-per-Development-Hour 1. **#1 Contextual login messaging** — string table + state selector, instant payoff. 2. **#5 Reputation monospace bars** — render-only over existing data. 3. **#10/#8 deterministic status report** — moderate logic, zero new state, identity-defining output. 4. **#2 curated event sounds** (save/cloud/submit only) — a handful of one-shots, high reward. These four are the "do these first" cluster precisely because none of them touch the save envelope. ### F. Priority First (the read-layer wave) Sequence, lowest-risk-highest-identity first: 1. **#1 contextual messaging** (warm-up win, proves the derivation pattern). 2. **#5 reputation bars** (legibility + aesthetic, render-only). 3. **#8 Courier Intelligence — deterministic core** (the flagship skeleton), pulling in **#10** (windowed view) and **#9** (on-demand notices) as facets. 4. **#2 curated one-shot sounds** for the actions those systems introduce. All four add **no new state field** → no Protocol 4 tax, no migration risk, no save-envelope growth. That is the deliberate point: ship the identity-defining wave entirely as read-layers before touching the persistence contract. ### G. Wait Until After v2.0.0 Stabilization - **#6 Crossroads modernization** — touches faction/quest/reputation coupling and persisted decision records; do it once the read-layer above proves what the ledger must feed. - **#4 timers (merchant + chem)** — the one accepted concept with real save-impact; sequence it deliberately, not opportunistically. - **#8 AI-narration layer** — add _after_ the deterministic core is trusted, so AI never becomes the source of truth. - **#3 world-intelligence expansion** — valuable but larger; build on the established intelligence engine. - **#7 visual damage states** — pure polish with the highest accessibility-footgun risk; last, gated behind reduced-motion handling and a mobile cap. ### H. Ideal Long-Term Vision **RobCo U.O.S. becomes an operating system that _reads_ its world.** Today RobCo is an excellent campaign _recorder_. Its end-state is a campaign _interpreter_: a machine that boots with recognition ("Courier recognized — Mojave network link established"), maintains a deterministic ledger of who you are, what you've decided, and what you carry, and — on demand — _speaks back_ with a status report that understands your trajectory. Reputation reads as bars that shift, decisions read as a ledger that remembers, the terminal subtly degrades as you bleed, and a small palette of sounds confirms that the machine is alive and working. The architecture that gets there is deliberately conservative: a **single deterministic Intelligence engine** computing views over state that already exists, with AI as a _narration skin_ that never owns a number, and **new persisted state rationed to only what genuinely models the world** (timers, the decision ledger). Immersion grows; the save envelope barely does. RobCo stops feeling like an app you update and starts feeling like a system you _log into_ — which is, and always was, the point. --- --- # Addendum: AI Architecture & Versioning (target release v2.0.1) > This addendum supersedes the "v2.0.0" framing above. The current release target is **v2.0.1**. Read the synthesis sections (A–H) as still valid; sections I–O below add the AI-tier and version verdicts. ## The Offline Constraint (why deterministic wins by default) One fact governs every AI verdict here that the concept list doesn't mention: **RobCo is an offline-capable PWA with a cache-first service worker.** Every deterministic read-layer works on a plane, at a table with no signal, instantly, free. Every AI call requires network, adds latency (seconds, not frames), costs tokens per invocation, and can return malformed JSON — a failure mode this project has already been bitten by and has explicit rules against. Therefore the governing rule: **AI is never load-bearing.** It may _decorate_ or _suggest_, but the deterministic layer must always render a complete, correct experience with the network unplugged. Any feature whose core _requires_ AI to function is, for a PWA, a regression in reliability dressed as a feature. **The four tiers, defined for RobCo:** - **Deterministic** — pure code. Authoritative, offline, instant, free. The default. - **AI-Assisted** — AI _proposes an action_; the player confirms; a deterministic record is the source of truth. AI touches _intent_, never _state directly_. - **AI-Enhanced** — a deterministic core produces the facts; AI _re-narrates them as prose_. Remove the AI and the feature still works, just plainer. AI touches _presentation_, never _facts_. - **Fully AI-Driven** — AI owns the logic and output. Appropriate **nowhere** in this document — every concept either is numeric/stateful (must be deterministic) or is decoration over numbers (AI-Enhanced at most). ## I. Deterministic vs AI Architecture Recommendations | # | Concept | Ideal Tier | Justification — where AI helps / where it would only add cost | | --- | ----------------------- | ---------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 1 | Contextual Messaging | **Deterministic** (AI-Enhanced optional, post) | Login lines are a selector over state (faction, day, location). AI here buys nothing but latency on the _first_ thing the user sees, and breaks offline. A later AI-Enhanced layer could vary phrasing — but only as garnish with a deterministic fallback. | | 2 | Procedural Audio | **Deterministic** (fully) | Sound is event-bound synthesis. AI adds zero value and catastrophic unpredictability (you cannot have an AI deciding _whether to make noise_). No AI, ever. | | 3 | World Map Intelligence | **AI-Enhanced** | The data (nearby settlements, travel times) is deterministic lookup/math and must stay so. The _regional summary prose_ is genuine AI comparative advantage — turning structured facts into a readable paragraph. Core renders offline; prose is the online upgrade. | | 4 | Time / Timers | **Deterministic** core, **AI-Assisted** trigger | A countdown is arithmetic — AI must never own a clock (drift, cost-per-tick is absurd). The one useful AI touch: _detecting from narrative_ that a timer should start ("you took Med-X") and proposing it for confirmation. The tick itself stays deterministic and offline. | | 5 | Reputation Bars | **Deterministic** | Bars are a render over the reputation matrix. Trend arrows are a render over stored snapshots. Both are pure math; AI would add unpredictability to a glanceable, must-be-trustworthy indicator. | | 6 | Crossroads | **Deterministic** ledger + **AI-Assisted** layer | The decision record must be deterministic and authoritative (the Gem-era bug was burying it in AI-written notes). AI's legitimate role: _suggesting_ that a narrative moment is a Crossroads, and annotating consequences — player confirms, ledger remembers. AI proposes; it never locks a path. | | 7 | Visual Damage States | **Deterministic** | A CSS reflection of HP. AI involvement would be pure liability — nondeterministic visual state is a UX and accessibility hazard. | | 8 | Courier Intelligence | **Deterministic** core + **AI-Enhanced** narration | The marquee case for the layered model. Every _number_ (day, conflicts, unresolved decisions, affiliation) is deterministic and offline-correct. AI's real value is turning that skeleton into a briefing that _reads_ like an analyst wrote it — high immersion, but strictly optional, strictly online, never the source of a figure. | | 9 | Strategic Notifications | **Deterministic** | These are threshold checks over derived metrics ("carry load +17%"). Determinism is _required_ — a nudge the user can't trust is worse than none. AI adds cost and doubt to a one-line fact. | | 10 | Campaign Summaries | **Deterministic** extraction + **AI-Enhanced** prose | Event selection/windowing is deterministic over the campaign log. Summarizing a day-range into prose is, again, AI's actual strength. Skeleton offline; narrative online. | **Where AI genuinely improves UX:** exactly two places — **narrating already-derived facts into prose** (#3, #8, #10) and **proposing an action for player confirmation** (#4 trigger, #6 suggestion). Both are AI's true comparative advantage (language, inference) and both keep a deterministic fallback. **Where AI would only add complexity, unpredictability, cost, latency, or confusion:** anything numeric or stateful (#4 countdowns, #5 bars, #8/#9 figures), anything real-time or event-bound (#2 audio), anything visual-state (#7), and anything on the critical first-paint path (#1 login). For all of these, deterministic is not merely acceptable — it is the _superior_ experience. ## J. Recommended v2.0.1 Candidates Selected on the stated priority order — architectural safety first, then user value, immersion, low regression risk, reuse of existing systems. Every item below is **deterministic, adds no new state field, and reuses existing systems**, so it carries effectively zero persistence/migration risk: 1. **#1 Contextual Messaging** — deterministic login/status lines derived from existing state. Lowest risk, highest first-impression payoff. 2. **#5 Reputation Bars** — monospace render over the existing reputation matrix. Render-only. 3. **#8 Courier Intelligence — deterministic skeleton** — the status report, computed from existing state/faction/quest/time. Ships _without_ AI. This is the flagship's safe first half. 4. **#10 Campaign Summary — deterministic skeleton** and **#9 Notices — on-demand** — both as _views of #8_, not separate systems. 5. **#2 Procedural Audio — curated one-shots only** (save, cloud sync, submit, status-report tone), each gated through the existing `AudioSettings`/`masterMute` discipline. Rationale: this is the entire "read-layer wave," and it is admissible in a point release precisely because none of it touches the save envelope, the AI contract, or the migration path. It is additive, deterministic, and offline-correct. ## K. Recommended Post-v2.0.1 (Stabilization) Candidates Deferred because they introduce persisted state, touch system coupling, or add an AI dependency — none belong in a point release: - **#6 Crossroads → deterministic Decision Ledger** — persisted records + faction/quest/reputation coupling. Promote it once #8's skeleton proves what the ledger must feed. - **#4 Timers (merchant + chem)** — the one accepted concept with real save-impact; sequence it deliberately. The AI-Assisted _trigger_ is a separate, later increment. - **#8 AI-Enhanced narration** — add only after the deterministic core is trusted in the wild, with a guaranteed deterministic fallback for offline/failed calls. - **#10 AI-Enhanced prose** and **#5 trend snapshots** — same pattern: deterministic feature first, AI/extra-state second. ## L. Long-Term Vision Candidates Larger or higher-risk; build on the stabilized engine, not before it: - **#3 World-Intelligence expansion** (travel intelligence, regional summaries) — the map's full evolution into a location-intelligence terminal with AI-Enhanced prose. - **#7 Visual Damage States** — opt-in, motion-safe, mobile-capped CRT degradation. Pure polish; highest accessibility-footgun risk, so last. - **#2 expanded soundscape** beyond the curated one-shots — only if user demand appears; ambient location audio remains rejected. - **The unified Intelligence engine as a platform** — once #8/#9/#10/#6 share one derivation core, future "the machine understands X" features become cheap. ## M. Concepts Most Likely To Become _Defining_ RobCo Features 1. **#8 Courier Intelligence Layer** (absorbing #9 + #10) — the system that changes what RobCo _is_. This is the identity. 2. **#6 Crossroads Decision Ledger** — consequence and memory; the spine #8 reports on. 3. **#1 Contextual Messaging** — the cheapest, most-repeated signal that "this machine knows me." 4. **#5 Reputation Bars** — the signature CRT-legible visual. These four are defining because each one is RobCo _reflecting the player's world back at them_ — the precise feeling the product is reaching for. ## N. Concepts Most Likely To Become _Feature Bloat_ 1. **Ambient location-aware audio (#2)** — runs without intent, worst mobile/battery/accessibility cost. The clearest bloat risk in the document. 2. **Generic event countdowns (#4)** — an undefined, infinitely-expandable timer category; the seam where a useful system metastasizes. 3. **Proactive push notifications (#9 as originally drawn)** — interruption fatigue that actively erodes the "calm, competent OS" identity. 4. **A graphical/pannable map (#3 misread)** — ongoing layout/asset burden that fights the text-CRT identity for little gain. 5. **Any AI-Driven feature without a deterministic fallback** — the meta-bloat: it adds cost, latency, and an offline failure mode while looking like progress. The common thread: bloat here is anything that **runs without the user asking, adds state without modeling the world, or makes the machine louder rather than smarter.** ## O. Final Product Identity Recommendation **RobCo U.O.S. should commit to being a deterministic operating system that _interprets_ its world, with AI as an optional, online narration skin — never its engine.** Concretely: the next release (**v2.0.1**) is a deterministic read-layer wave — contextual messaging, reputation bars, and the Courier Intelligence skeleton — that adds no new state and works perfectly offline. The flagship is the Courier Intelligence Layer; its deterministic skeleton is the v2.0.1 milestone, and AI narration is a _post-stabilization enhancement that always degrades gracefully to the deterministic report_. New persisted state is rationed to the two things that genuinely model the world: the Crossroads decision ledger and a small, capped set of timers — both post-2.0.1. The identity to protect, in one line: **a calm, trustworthy, offline-first terminal that knows who you are, remembers what you decided, and tells you the truth when you ask — fast, free, and the same every time.** AI makes it eloquent; determinism makes it RobCo.