You've just been hired to run security

The last four entries built a whole incident-response game: logs and a SIEM, an identity provider with MFA, phishing, poisoned vendor updates, default-deny outbound, ransomware and backups. In the campaign, all of it arrives in chapters 5 and 9, after a long time building racks and cabling networks. If security is the part you came for, that's a long wait. So there's now a third way to start: the Incident Responder fast track.

You start on day 30 at a datacenter someone else built, and it works. Fifteen servers in six racks, a firewall, a UPS and two air conditioners, eight customers all green, a crew of six, and $40,000 ($30,000 in Hacker). It draws 10.6 kW, the hottest rack is at 21 °C, and it clears about $6,700 a day. It has no security at all: no logs leave the servers, everyone shares one admin password, outbound traffic can go anywhere, there are no backups, and the ops team's jump box, ops-01, answers SSH from the whole internet with a password. All of that is set up by the same actions a player would use, so every green check in it is a real trace, like anywhere else in the game.

Building, power, cooling, networking, staff and customers are all unlocked from the start. The security systems come one chapter at a time, and each chapter ends with a scripted attack you have to handle:

Chapter 4 needed a change. The first version reused campaign Chapter 9 as it was, and the balance bot showed the problem on both seeds: the ransomware crew never got started. Their backdoor phones home to an attacker address, and in Chapter 3 you've just made outbound default-deny, so it had no way out. You never saw a ransom note, and the backups goal was a box to tick. That's a real lesson (default-deny works), but it made the last chapter an anticlimax.

So in the fast track, the crew's backdoor checks in through Nimbus's own update server, 198.51.100.40:443, the one address your default-deny rule has to allow. Real backdoors hide in a vendor's own traffic like this, and an allow rule can't tell a check-in from an update. You can still catch it: updates run once a night at 03:00, and this traffic comes every hour. The SIEM's beaconing rule now says exactly that when the address is the update server. You can block the address, but every server's updates stop with it, and the case card warns you. Rebuilding the infected servers cuts the line just as well.

I checked what happens when nobody responds. In a seeded Fun game, I jumped to Chapter 4 with Chapter 3's work done: logs, a SIEM, default-deny, a backup server (not append-only) and offsite backups. Then I let it run. At 03:00 on day 32, 13 servers installed the poisoned agent, and a 14th installed it the next night. Their check-ins went out through the update-server rule. At 08:00 the SIEM raised a high alert for each of the 13: "web-01 has called 198.51.100.40:443 every hour for 6 hours". The crew mapped the network over SSH and Postgres, then deleted the local snapshots on day 33. Coldvault's object lock refused their delete of the offsite copies. At 19:00 that day they encrypted all 14 servers, with 41 GB gone and a $66,000 note.

The bot plays near-optimally and doesn't let it get that far. In Fun on seed 7, the crew got in and took 2 GB before the bot rebuilt everything, 9 hours after the case opened. In Hacker on seed 11 they took 5 GB, and the bot finished in 11 hours. Both reports end with "Thrown out before the ransomware went off." The bot now rebuilds instead of blocking the update server, which is what I'd tell a person to do.

Hacker's Chapter 1 uptime came from a power outage at 14:01 that outlasted the UPS. It's ordinary bad luck, but this datacenter has only one UPS, and the fast track doesn't make you fix that. The bot also found a problem in itself, not the game. Hacker's offsite backups sat at 0 of 23 servers because Hacker players write their own outbound rule to the vault, and the bot never did. Now it does.

A poisoned update lands on most of the hall, and a case with one Reimage button per server meant clicking about twenty buttons, twice. A supply-chain case now has Reimage all, and a ransomware case has Restore all, each queuing one job per server for your sysadmins. The per-server buttons are still there. In the no-response test without a SIEM (where the crew encrypted at 13:00 on day 33), one Restore all click brought all 14 servers back from Coldvault within 14 hours, and every case step went green.

Finishing all four chapters earns a new achievement, First Responder. Afterward the datacenter carries on as a sandbox. The campaign is untouched: on seed 7 the bot finished chapters 1 to 9 on the same days as before (2, 4, 6, 9, 9, 32, 34, 76, 80), and seed 11 matched the previous commit exactly (2, 3, 5, 8, 12, 30, 36, 59, 65). To jump straight in, there's /?scenario=ir, or add &mode=hacker.

What I couldn't measure: nobody has played the four chapters by hand yet, so I don't know if 30 to 42 hours before detonation is a fair window for a person. The 13 beaconing alerts used to arrive as 13 separate toasts and cover the screen. Now toasts that start alike stack into one deck with a count badge, and hovering fans them out to read. One rough spot remains: the money stops mattering, and the bot ended with between $250,000 and $370,000.

↑ Contents

Restore, don't pay

The last three entries were about attackers who want your data or your CPU. This one is about the crew that wants money, and the campaign now has a ninth chapter about it: Assume Breach. Ransomware crews rarely break in themselves; they buy a way in that's already open. In the game a quarter of the footholds from the earlier entries (a guessed password, a phished admin, an unpatched web server, a poisoned vendor update) now belong to a ransomware crew, from Chapter 9 or in a sandbox.

A crew doesn't encrypt the moment it lands. For a day and a half in Fun (12 to 20 hours in Hacker), as long as it has a line out, it works. It copies data, to have something to threaten you with. It maps what the keys and database passwords it found on that box can reach, with a real SSH and Postgres trace to every other server. It goes for your backups, using the credentials every server that backs up holds. Then it encrypts everything it reached. An encrypted server fails every trace with "files are encrypted by ransomware", so its customers go red the honest way, and the note wants about eight days of what those customers pay you, in Bitcoin, within 72 hours.

Backups are the answer, and they're real too. Make a spare server the backup server and every server sends it a snapshot at 02:00, with a trace to tcp/8000. Fun's button also turns off SSH and Postgres on that box, because a backup server the crew can log in to is a backup server they encrypt. That happened in testing before I added it. Append-only means the backup credentials can add a snapshot but never delete one. Offsite, to a vault called Coldvault ($4 a server a day), keeps every copy under a 30-day object lock that nobody can lift, not the crew and not you. If outbound is default-deny, Fun adds the allow rule for you; in Hacker you write it. In one run the 02:00 backup failed because ISP A's fiber was cut from 01:00 to 02:02, so that night's copy never left the building. The restore the next day lost a day of data. I didn't plan that.

Each encrypted server gets a Recover step. Restore is a clean rebuild from the newest copy the server can reach, and the customer loses only what changed since that copy. Rebuild it empty is quick and costs the customer their data: they want about six days of what they pay you in credits, and your reputation takes a hit. Pay sends the Bitcoin, and a decryptor arrives 12 hours later and doesn't always work. In a test where the bot was given enough cash to pay, it paid $42,000; the decryptor brought back 8 of 11 servers and corrupted the other 3, which then had to be rebuilt empty anyway. The crew was still inside afterward, because paying doesn't throw anyone out. If you don't pay, the deadline passes and they publish what they took, which counts as a breach. Restoring gets you running again; it can't un-steal the data.

Here is what backups are worth, from the balance bot. I used seed 7, a sandbox with a poisoned update sold to a crew on day 22, and no SIEM, so the ransom note is how you find out. Backups are switched on at day 21 in every run, so all three play the same game up to the attack.

I haven't worked out why the append-only run had more red hours than the others; the bot made different choices after the attack, and I didn't trace it further.

The best outcome is never seeing the note, and a SIEM gets you there. A crew's mapping shows up in the logs: one server trying SSH and Postgres on every other server in an hour is a new high-severity alert, and a delete against your backups is a critical one. With a SIEM and a poisoned update forced on day 5, the alert fired 1 hour after the update landed. The bot had the case closed 6 hours later, with the crew 38 hours short of encrypting anything. The report says so: "Thrown out before the ransomware went off."

The new Incident response section offers a retainer with Bluewater IR, $150 a day. Call them on a case and they contain it first (hold the update, block the address, close the door), then restore and rebuild two servers an hour without taking your sysadmins. They also talk a ransom down by 30% if you decide to pay. What they won't do is decide for you: an encrypted server with no backup waits for you to pay or rebuild it empty. On retainer they're on site in 2 hours; without one, the call-out is $30,000 and they take a day. In the test they arrived 2 hours after the note, restored all five servers from offsite and closed the case 2 hours after that.

Chapter 9: Assume Breach asks for three things: every customer server backed up offsite, a retainer, and getting through the attack without paying a ransom. Thirty hours in, a vendor's update is poisoned and the access is sold to a crew. Pay, and word gets around: another crew arrives two days later. On two seeds the balance bot finished chapters 1 to 8 on exactly the same days as before (seed 7: 2, 4, 6, 9, 9, 32, 34, 76; seed 11 reached Chapter 8 on day 59), and then Chapter 9. Neither run had a SIEM. On seed 7 the crew encrypted 23 servers on day 79; the bot restored every one from Coldvault and finished the chapter on day 80 with two stars, without paying. Seed 11 finished on day 65. There are now 27 stars to collect, and twelve new achievements in the Trust & security group, three of them secret.

In Hacker mode, restic snapshots and restic restore latest run on any server, and rest-server --append-only on runs on the backup server. On an encrypted box, cat shows you the note.

What I couldn't measure: whether 30 to 42 hours of staging feels like a fair window to a person watching alerts rather than a bot, and Hacker balance beyond one run, in which a crew staged for 16 hours and the bot restored all three servers from offsite.

↑ Contents

Signed, sealed, and backdoored

The last two entries were about keeping attackers out. This one is about the attack you can't keep out, because you invited it in. Every server now runs a monitoring agent from a vendor called Nimbus, and every night at 03:00 each one takes its updates (the OS and the agent) from an update server on the internet. That's a real outbound trace through your firewall, like everything else. And every so often, about once every 40 days in Fun, someone gets into Nimbus's build system, and the next release carries a backdoor. It's signed, it looks like any other update, and every server that updates that night installs it.

Nothing you did let them in, so what decides the damage is what the backdoor can reach once it's inside. Fun mode's firewall comes with a rule that lets anything inside reach anywhere outside. With that rule, the backdoor calls home every hour, and data leaves a little at a time from every server it's on. On a seeded sandbox, with the poisoned release forced on day 5 and nobody responding, four servers had sent 234 GB by day 10, and the first customer called on day 5 at 14:00.

The new Outbound and updates section has one button that changes the outcome: Default-deny outbound. It removes the allow-anything rule and adds a single allow, tcp/443 to the update server. Your servers still answer the internet (the firewall is stateful) and still get their updates, but they can't start anything else. On the same seed with that one rule in place, the backdoor landed on four servers and sent nothing. Every attempt it made was refused and logged, the SIEM raised an alert in the same hour, and the bot had all four rebuilt 7 hours later. In the game from the screenshot above, pressing it turned the case's "Cut their line out" step green without a block rule. Default-deny cost no customer anything: on seed 11 the bot ended 30 days with the same cash and the same 202 red-contract hours either way.

With the rule left open, you can still catch it, and the clue is behavior. No signature for 198.51.100.142 exists until Nimbus publishes its advisory, 3 to 6 days later in Fun. But a SIEM now has a beaconing rule: a server calling the same new address every hour for six hours straight. In the test it fired 5 hours after the update landed, three days ahead of the advisory, and 12 GB had gone by the time the case closed. The playbook has a twist: a server rebuilt while the poisoned release is still being served installs it again as soon as it comes back up. So the first step is Hold nimbus-agent updates, the game's apt-mark hold.

Default-deny has its own trap, which is the other half of this entry. Block the update server too, as a typo in that one allow rule does, and your servers stop updating. More than 14 days behind, a web server has holes that scanners carry exploits for, and one hit gets them in through the web server itself: no password, no guessing. A shell spawned by nginx raises a critical alert. In the test with the typo, three web servers were broken into by day 40. Default-deny meant nothing left the building, but the case can't close until the server is patched, and it can't be patched until the rule is fixed. Each server's panel now shows how long since its last update, and why the last one failed.

Hacker mode does all of this by hand. apt update, apt policy nimbus-agent and apt-mark hold on any server. ss shows what a box is talking to, including the backdoor's connection home and whether it was ever answered. The egress rule goes in the firewall console. One consequence I want to flag: a Hacker firewall has no outbound rule until you add one, so a Hacker player who never does has servers that never update, and from Chapter 5 those web servers can be exploited. The Security panel says so, but it's new pressure.

The campaign is unchanged where it should be. On seed 7 the balance bot finished all eight chapters on the same days with the same cash as the previous build. On seed 11 everything matched through day 70. Supply-chain attacks unlock only after the campaign ends (they'll be part of Chapter 9). Seed 11 ends the campaign on day 59, and a poisoned release then hit 23 servers and cost $4,456 before the bot closed the case. That's the only difference.

What I couldn't measure: whether 40 days between poisoned releases feels right to a person rather than a bot, and Hacker balance beyond the one run above.

↑ Contents

Voicemail from the power company (0:42)

Last time the attackers came in through the front door: a port left open to the internet, and a lot of guessing. Most real breaches don't start that way. They start with an email. So now, every so often (about one every three days in Fun), a phishing email lands on one of your admins: a password that expires today, a shared invoice, a voicemail from the power company. Untrained, three in ten click and type their password into the page it opens. Phishing training ($120 a person, good for 60 days) cuts that to about one in seventeen, and trained people often report the email instead, which tells you an attack is under way.

What the password is worth depends on your network, and the tracer decides, as it does for everything else. Out of the box your admins share one password. On its own that opens nothing from the internet, unless some server's SSH takes passwords from outside. If one does, the attacker logs in on the first try: no guessing, so nothing for a SIEM to notice until they're already in. Turn on the new Identity provider service on a server and everyone gets their own login. Now the attacker has to sign in to it from outside, which only works if you've published it. You'd want to: with the sign-in page reachable from home, your Security Analysts triage urgent alerts overnight. In one test the analyst picked up a push storm at 20:00 and the attacker's sign-in at 02:00, from their couch.

Then the MFA policy decides, and each option fails the way it does in real life. Passwords only: they're in the same hour. SMS codes ($1 a person a day) hold until a SIM swap or a relaying fake page gets through. Push approval ($3) gets an MFA push storm: the attacker keeps signing in, your admin's phone keeps buzzing, and sooner or later a tired thumb taps Approve (more likely at 2 a.m.). In the test above it took 196 pushes over 11 hours. Security keys ($5) stop it: the password is right, and the key refuses to sign in for a site that isn't yours. They tried six times and gave up.

Once in, the attacker does what real ones do. First they make an identity-provider admin called "it-support", so a password reset alone won't lock them out. Then, signed in as your admin, they "open up remote support": a real port-forward of SSH to a customer's server, made through the same code the Publish button uses. Both show up in your 📜 Audit log under your admin's name, and as SIEM alerts if the IdP's logs reach the collector. After that, last entry's machinery takes over: an account on the server, a call home through your outbound rules, data out the door.

The case playbook follows the same order. Reset the password before you delete the backdoor and they're back within the hour as "it-support"; I checked, and the console's kcadm sessions showed them signed in from the same address. In Hacker mode that's the way to run it: kcadm users, sessions, reset-password, delete-user and mfa on the IdP host. The report card spells out what would have stopped it, with the ATT&CK IDs: T1566.002 for the link, T1621 for the push storm, T1136.003 for the admin, T1562.004 for the firewall change.

Measured on a seeded sandbox, forcing a click on day 3 and playing 30 days: with no SIEM and passwords only, they took 24 GB, a $3,000 breach that I heard about from the customer 14 hours after they got in. With the SIEM, every attempt that got anywhere raised an alert, and the bot closed the case. With the identity provider unpublished, the stolen password went nowhere for 24 hours and they gave up. The campaign is unchanged: on seeds 7 and 11 the balance bot finished all eight chapters on exactly the same days, with the same cash, as the previous build. Phishing did land there, 5 and 7 clicks, but the bot never exposes SSH or runs an IdP, so the passwords opened nothing.

What I couldn't measure: whether the push storm feels as nasty to watch as it should, and Hacker-mode balance. I tested Fun's numbers.

↑ Contents

Sixteen lights nobody had switched on

The game got laggy again, so I measured before guessing. The game's own work per frame was a few milliseconds; the drawing was the cost again, but not where I expected. The building has nine room lamps and seven streetlamps, and by day they sit at zero brightness. In three.js a light at zero still counts: every lit surface's shader is built for the lights that are visible, not the ones that are bright, so every pixel of the island was working out its share of sixteen dark bulbs. Now the lights are hidden while they're off. In the test browser, which draws in software so that only ratios mean anything, a daytime frame took 1,324 to 1,451 ms instead of 2,848: about half the drawing work. Night is unchanged, because at night the lights really are on.

The second fix is about screens. On a 120 Hz display the browser asks for a new frame every 8.3 ms, and the game drew every one of them, twice the work of a 60 Hz screen for motion you can't see in a cozy tycoon. It now draws at most 60 frames a second; in a simulation of the timing it lands between 59.8 and 61.1 fps on 60, 120, 144 and 165 Hz screens. On a 120 Hz Mac, daytime play feels smoother.

Two things I tried and didn't keep: freezing the sun's shadow map instead of redrawing it every frame saved about 12%, and swapping to a cheaper material saved about 7% and changed the look. Neither was worth it. One cost of the fix: the first time the lights click on in a session, every lit material's shader is rebuilt for the extra lights, which can be a brief stutter at the first dusk. After that both versions are cached. I couldn't measure the size of that stutter on a real GPU.

↑ Contents

Someone is knocking on port 22

Until now a "breach" was a dice roll: if a contract's private service was reachable from the internet, every hour had a small chance of costing you money, in Hacker mode only. There was no attacker and nothing you could do about one except close the port. This is the first part of a real incident-response system, and it follows the rule the network already follows: nothing is faked.

Scanners. Every hour a few internet scanners try a few of your public addresses and ports, with the same tracer that checks contracts. Most hit your firewall and get dropped. Some find a website and ask it for /wp-login.php. If one actually reaches SSH or Postgres, someone starts guessing passwords from a botnet, a different address every hour, so blocking one achieves nothing. Every server you provision runs sshd, so all it takes is a port-forward, a server on a public address, or the insider's "firmware update" that 1:1 NATs a box to the internet.

What happens if they get in. They add an account so they can come back, then the server phones home: a real outbound trace from that server, through your firewall, to the attacker's address. If it gets through, data leaves (or a cryptominer pins the CPU at 100% at 4am, on your power bill and your cooling). Enough data and it's a breach: the customer is unhappy, your reputation drops, and you pay. Whether a single byte leaves is decided by your outbound rules and nothing else. Fun mode's ✨ auto-config adds an inside → outside, allow anything rule, which is exactly the rule that lets this happen. I left it in on purpose. Delete it and the same attacker gets in and gets nowhere.

Logs. Turn on Log collector on a server and point your devices at it (one button in Fun, rsyslog forward and logging host in Hacker). A device's log line reaches the collector only if a udp/514 packet from that device really gets there, so a server with no gateway, a cable that's come loose or a dead collector means a blind spot, and the 🔎 Security panel tells you which and why. SOC 2 and PCI now require it.

The SIEM ($8,000, then $3 per log source per day) reads what the collector receives and raises alerts: password guessing, a login from the internet right after it, a new account nobody made, a CPU pinned with no customers, a firewall change by someone who isn't you, a device that went quiet. With the threat-intel feed it also knows the attackers' addresses, so a server phoning home stands out. The internet's background noise makes alerts too; mute the rules you don't care about. A Security Analyst triages alerts at their desk, most severe first, or you can 🔍 Investigate yourself. The SIEM also catches the insider: their rogue firewall change is logged under their name the moment they make it.

Cases. A real alert opens a case with a playbook, and every step is checked live like a compliance control: close the way in (remove the port-forward, or switch the server to key-only SSH), cut their line out (block their address at the firewall), rebuild the server from a clean image. Order matters. Rebuild first, with the door still open and the same password still working, and they're back within the hour. Close the case and you get a report: when the scanners found you, when they got in, when you knew, what left, what it cost, what would have stopped it, and the MITRE ATT&CK techniques involved. Without a SIEM you find out when your customer's data turns up for sale, and the report says how many hours earlier the logs would have told you.

What I measured. In the seeded demo with SSH forwarded to srv-05, scanners found it within five game hours, the guessing took 17 hours, and the SIEM alerted on the first hour of it. Once the miner reached its pool, srv-05 went from 1,320 W to 2,400 W. With the inside → outside rule deleted instead, the same attacker got in and moved 0 GB, and both demo customers stayed green, since nothing they do needs to start connections out. Checking whether ten devices' logs reach the collector (one trace each) takes 1.9 ms. The balance bot finished all eight campaign chapters on four seeds; it sets up a collector for SOC 2 and works cases in order. Security rolls its own dice on a separate stream, so a game with no attacks plays out exactly as before: a 30-day sandbox run on seed 7 ended with the same $42,196 as the previous build. When the bot publishes SSH on day 2 like a careless player, with no SIEM it lost 24 GB and $3,000 and found out from the customer two days later, ending at reputation 51 and 64 on two seeds; with a SIEM it caught the attack before the password fell and ended at 64 and 67, about $2,000 poorer after 20 days. A SIEM is insurance, not free money. What the bot can't tell me is whether working a case is fun, or whether the alert queue feels like work. Those are next on the list, along with phishing and the IdP.

↑ Contents

A third fewer draw calls

Panning around the demo felt a little jagged. I timed the game's own work per frame while sweeping the camera back and forth: it averaged under a tenth of a millisecond and never passed 1.1 ms, so the code wasn't it. The drawing was. The demo asked the GPU for about a thousand draw calls a frame. The last performance pass merged the racks, the people and the cables, but the scenery never was: every wall strip, desk leg, keyboard and poster was its own draw, each office chair was eight, and nearly everything also cast a shadow, which draws it a second time.

Now the static scenery is merged into one mesh per material when the world is built, and each clickable prop (chairs, monitors, mugs, plants, shelves, the couch) merges its own parts, so it still spins, tips, topples or rustles as one piece. Anything that moves or appears on its own stays separate: monitor screens, the coffee in the mugs, the couch's cushions and pillow, Hall B, the clouds, upgrades you haven't bought. On the same demo state and camera, the default view went from 1,013 draw calls to 690, and the office close-up from 690 to 452, a third fewer, with the same triangles and identical screenshots.

The automatic resolution also had a habit: a GPU right at the edge would drop a step, wait a minute, step back up, and drop again, and every change reallocates the canvas (a hitch and a visible sharpness pop). Now each step up that doesn't hold doubles the wait before the next try, from one minute up to eight.

What I couldn't measure: how smooth it feels on your hardware. The test browser draws in software, so I counted draw calls rather than frames. If it still stutters, Low graphics turns shadows off, which removes the second pass entirely.

↑ Contents

The audit log, and panels that stay out of the way

The feed in the corner keeps the last 60 events and shows five, which is fine for "what just happened" and useless for "when did that disk die, and who fixed it?" The new 📜 Audit log (toolbar, or press G) keeps the last 3,000 entries: every event, and every action you took, marked "You:" (buying a desk, a console command, an undo). It's newest first and grouped by day; you can search it for a name, a device or an IP, filter it to problems, good news or your own actions, and download the whole thing as a CSV. Undoing something rewinds the game but not the log: the action and the undo both stay on the record, the way an audit trail should. Older saves start theirs from the feed they already had.

Also fixed: in narrower windows the side panel and the event feed ran underneath the toolbar (and underneath the Build menu when it was open), so a panel's last rows were hidden and couldn't be scrolled to. They now measure where the toolbar and the Build row actually are and stop above them. At 925 × 640 with the IP plan open, the panel ends 10 pixels above the toolbar and scrolls all the way to its last section.

↑ Contents

Nine bugs, one desk shortage

A list of things that were broken or hard to use, each reproduced in a seeded game before fixing it.

The website editor. It closed itself if the customer you were editing left, and the monitor only opened it while the developer was standing at the desk, so once they wandered off you couldn't get back in. Closing it also left keyboard focus in its hidden text box, which quietly swallowed every game hotkey. Then, on a second open, the preview came up blank and the code was scrolled sideways: a hidden preview frame loses its page, and setting the same page again doesn't reload it. Now a departing customer switches you to another site, the developer's desk always opens the editor, and every open gets a fresh preview at the top of the page.

The consoles. A batch of removal commands failed: ip addr del without a prefix, ip addr flush, no ip route written with a mask, and no route on the firewall. They all work now. Worse, a router happily accepted two interfaces on the same network, which breaks routing and leaves everything behind it with "no one answers ARP" errors; that's refused with an explanation. Router suggestions are now one line each (interface ge1 ip address 10.0.20.1/24), because clicking a lone ip address suggestion used to configure whichever interface you'd last entered. And on the firewall, running the suggested port-forward made its matching allow rule vanish from the suggestions, because the check for the rule was skipped once the forward existed.

The IP plan is easier to read and does things now. It opens wider, with a summary strip (public addresses in use, networks, servers waiting for an address, problems), every device is a link, runs of free addresses collapse to one line, and each row has its fix: assign the next free address, fix a gateway, release an address, remove a port-forward. In Fun mode the buttons do it; in Hacker mode they type the command into that device's console for you.

Desks. You could hire a dozen people into an office with four chairs. Now everyone needs a desk: a new office has six, and the Build menu sells an Extra desk ($600, up to twelve). Older saves get enough desks for the staff they already have. The balance bot buys a desk when it needs one; over 20 sandbox days and 40 campaign days on two seeds each, it ended with the same headcount as before, and both campaigns got further.

Also: ISP B and Utility Feed B were never missing, just buried at the bottom of their wall fixtures' panels, so they're in the Build menu now. And badge readers now cover Hall B's doorway too; staff badge through it once the hall is built.

↑ Contents

Great Scott

The clock on the server room wall has always just told the time. Now each click sets its hands whirling a little faster, and if you click it ten times quickly, time gives up: a purple portal tears open in front of it, and a second later you're in the bad timeline. The sky burns dark red and the haze closes in, the grass is scorched brown, the flowers wilt, the trees and bushes are dead, the clouds turn to smoke, and embers drift up over the island. Inside, the work goes on (a little warmer looking than usual). Click the clock ten more times to open the portal back, or wait two minutes and the timeline heals itself. It's all for show and never saved, so a reload always puts you back in the good one.

In a seeded game: nine clicks did nothing, the tenth opened the portal, the world was two-thirds of the way gone a second later and fully gone by 4.6 seconds, and ten more clicks put every color back exactly as it was. My first pass tinted the room lights red as well, which turned every white floor pink and made the game hard to read; the light tint is now a fifth of what it was, so the end of the world stays outside.

↑ Contents

Spilled coffee, couch change, and a tennis ball

The mug on every desk is pokeable now. Click it and it tips onto its side, a coffee puddle spreads across the desk, and a few seconds later it's upright again and the desk is dry. The couch squishes its cushions and sends the yellow pillow flying, and every so often a handful of coins pops out of the cushions and clinks onto the floor. There's an achievement for finding them.

The pets can have a toy. It's a new office upgrade ($45): a tennis ball if you have the dog, a toy mouse if you have the cats. It comes on the truck like everything else and Facilities sets it out by the pet bed. Click it to throw it. The dog runs after it, carries it back in its mouth, drops it at your feet and asks for more. A cat sprints over, pounces and bats it across the floor. They also wander over and play with it on their own.

Getting the fetch right took a few tries in a seeded game. The first ball kept all its speed when it landed and rolled four meters past the spot, so the dog arrived, found nothing, and wandered off. Then a throw sailed out the front door, and the cat's pounce barely moved the mouse. Now landing soaks up most of the throw, throws stay in the office and only go somewhere the pets can run straight to, and the dog drops the ball back within half a meter of where you threw it.

Also fixed: after the office chair's rocket ride, the parachute stayed hidden on the chair, and the game still counted clicks on it, so the landed chair was clickable from a meter away. Clicks now ignore anything hidden.

↑ Contents

Facilities has a mop

Until now, pet messes and the litter box were your job alone: click them or live with them, while your Facilities tech watered plants and stepped around the problem. Now every mess becomes a Facilities job: they walk over, clean it up, and the log says who. A litter box that's getting full gets scooped the same way. If you get to it first, the job quietly disappears. Messes already on the floor in an older save get picked up within the hour.

Facilities also vacuums the server room sooner, at 30% dust instead of 50%, so the dust bunnies don't pile up first (the "getting dusty" warning still comes at 50%). I ran the balance bot for 20 days on two seeds before and after: disk failures went from 15 to 7 and hours of red contracts from 454 to 210. Cash moved both ways, up $540 on one seed and down $1,700 on the other, because the extra vacuum trips change who is free when an incident lands. The bot doesn't keep pets, so the mess jobs I checked separately in a sandbox game: a dog mess was cleaned 12 game minutes after it appeared, and a nearly full litter box 8 minutes after.

↑ Contents

Dust bunnies, by hand

When the server room gets dusty, dust bunnies gather along its walls. You could look at them, but clicking did nothing, which is a crime against anyone who has ever owned a vacuum. Now a click picks one up: it vanishes in a little gray puff, and the rest stay where they are. It isn't just for show. Each bunny is a share of the room's real dust level, so picking them up lowers it exactly like vacuuming does: fewer clogged fans and dead disks, and Facilities stops getting called to vacuum once the room is back under half. Clear the last one and the game notices. So do two new achievements.

I checked it against the real code: starting from a dusty room, each click removed the bunny that was clicked (and only that one), dust fell from 0.80 to 0.69, 0.64 and 0.58, and sweeping the rest left the floor clean at 0.10.

↑ Contents

Timber!

The shelves in receiving are pokeable now. Click one and it creaks and rocks; keep clicking and it rocks harder. The fifth click inside four seconds tips it over: it falls forward on its front edge like a real bookcase (slow at first, then all at once), lands with a crash and a little bounce, and the boxes on it slide off and tumble across the floor. A few seconds later it stands itself back up with a wobble and every box is back in its slot. Like the rest of the office toys, it's just for fun and never touches the game: your stock is fine. There's a secret achievement for it, and you can probably guess its name.

↑ Contents

Bring the hand truck

Racks, UPSes, PDUs and CRACs arrive in big wooden crates, and until now your staff hugged them across the room like a moving box. Nobody carries a CRAC. Now they wheel crates in on a red hand truck: tipped back on its wheels, both hands on the grips, leaning into the push, with the wheels turning as they walk. If they stop at a badge reader, they wait with it. When they reach the build spot, they stand it up beside them and get to work; when the job's done, the crate is gone and so is the truck.

Smaller boxes (servers, switches, spare parts) still go under an arm. The truck rides on the floor rather than with the body, so it doesn't bounce along with their stride, and it only exists while someone is moving a crate.

↑ Contents

Hitches, a frozen panel, and where the triangles went

Two reports: "from time to time it feels laggy," and "some panes don't open under certain scenarios." Both turned out to be real, and neither was where I first looked.

The panel that wouldn't open. Every panel rendered fine in every state I threw at it, with no errors. The bug was a guard. The side panel refreshes every second, and to avoid wiping out something you're typing, it skipped the refresh while focus was in one of its text boxes or dropdowns. But it skipped everything, including showing a different panel. Pick a port from a dropdown, then click a rack in the room, and the panel stayed on the old device: the 3D view can't take focus, so focus never left the dropdown. I reproduced it exactly. Now the guard only protects a refresh of the panel you're already looking at; selecting something else or opening another panel always shows it. A half-typed address still survives the refresh.

The hitch. I built a late-game save with the balance bot and timed everything that runs each frame or each tick. It was all small: contract checks about 1 ms, a panel rebuild under 1 ms, autosave 1.3 ms. Then I loaded the perf bench's 20 fully cabled racks (about 760 cables) and changed one cable. The game froze for 135 ms. The cables are merged into a few big meshes for speed, but any change to any cable (one finished, a VLAN recolor, someone tripping over one) rebuilt every tube from scratch. Worse, each cable's place in the overhead tray depended on its position in the list, so adding one cable shifted all the ones after it. Now each cable's tube is kept until its own route changes, its tray lane comes from its own ID, and cables are merged in small chunks, so a change re-merges one chunk. One cable changing went from 135 ms to about 5 ms.

Where the triangles went. I counted what the GPU draws each frame. The racks were cheap. On the bench, the network cables alone were 435,000 triangles, sampled with 48 segments each whether they were a 30 cm loop or a 15 m tray run. They now get segments by length, with five sides instead of six (they're 1.6 cm thick; you can't tell): 83,000, down 81%. Each member of staff was about 24,000 triangles, mostly from very round spheres; trimmed to what's visible at the camera's closest zoom, they're about 15,500, and they look the same.

Smaller things. An unchanged panel no longer rewrites its HTML every second (5.5 ms down to 0.5, and things you'd scrolled or expanded stop resetting). The new pod lights were rebuilding on every state change; now only when pods change. The High graphics preset kept a copy of every frame that nothing ever read; that's off. And the game now adapts its resolution: if frames run slow for a couple of seconds it renders a little softer, and once there's headroom it sharpens again, which covers GPUs a preset can't predict.

What I couldn't measure: real frame rates on your hardware. The test browser draws WebGL in software at about 3 frames per second, so I measured the pieces (JavaScript time, triangle counts, rebuild costs) rather than the whole frame.

↑ Contents

A front door

The old title screen was a logo, a row of buttons, and no explanation of what the game is. Worse, the order was wrong: clicking Fun or Hacker started the game straight away, so the Campaign/Sandbox choice and the office pet only counted if you happened to set them first.

The new one is a launcher. On the left, the pitch: three little racks with blinking lights, a tagline ("a cozy datacenter tycoon where every cable is real"), two sentences on what you'll actually do, and four tiles for the four things you'll spend your time on. On the right, a new game is three numbered picks: how you want to play (Campaign is marked as the best first game), how hands-on (Fun or Hacker), and an office pet. Then one big Start your datacenter button, with your picks summarized on it ("📖 Campaign · 😄 Fun · with an office dog"). Enter presses it. Your picks are remembered for next time.

If you have a save, a Continue card sits across the top with the chapter, mode, day, cash and rack count, and the new-game panel steps back to "Or start a new one." On a laptop screen the whole thing fits without scrolling. On a phone it reorders itself to pitch, Continue, the three picks and Start, with the feature tiles after that for anyone who wants to read more.

↑ Contents

It works on my machine

The last part of the websites work: things go wrong, and you get the tools to deal with it.

Broken builds. Every build now has a chance of being broken. For a developer it depends on their skill, how happy they are and how tired they are; yours is small. Everyone's goes up on a Friday. (The game never had weekdays; day 1 is now a Monday.) What a broken version does depends on whether the site has a readiness probe. Without one, its pods start, report ready and take traffic, then answer "500 Internal Server Error" with the reason ("a typo in the nginx config"), and the customer goes red. With one, which a developer adds in about an hour, a broken pod never passes its health check. It sits in CrashLoopBackOff, the rollout stops, and the old version keeps serving. I tested both. Without the probe, the customer went red on a 500 within minutes. With it, the same broken build gave the customer zero red minutes.

Rollback. "↶ Roll back to v3" on the contract returns to the last version that worked. Its image already exists, so there's no rebuild: the old pods just roll back in, which took 4 to 10 game minutes in testing. In Fun mode a developer on shift notices a broken deploy after half an hour and rolls it back. In Hacker mode that's on you, and the log tells you how once.

kubectl. Every server's console now has it: get pods, get deploy, get nodes, describe pod (which says why a pod is Pending or crashing), logs, rollout status / history / undo, scale, and delete pod, which the deployment immediately replaces. Each customer is a namespace. It all reads and drives the same controller as the buttons.

Also: small lights on each server's face, one per pod (green running, yellow starting, red crashing), so you can watch a rollout move across the racks. And a developer working a ticket now has the code on their monitor.

The balance bot can be trusted again. Last entry I found that two runs of identical code on the same seed disagreed. There were three causes. Starting a new game never cleared the grid's "something is standing here" map, so each run inherited the previous run's racks as invisible obstacles. Staff wandering used an unseeded random number. And a "say hi to a colleague" check used the wall clock. All fixed, and the bot now starts its own game from the seed. Four runs on seed 7 came out identical, down to the last ID. The runs with no developer even came out exactly the same before and after this whole feature (same cash, same red hours), which shows it changes nothing until you hire one.

With a trustworthy bot I could finally measure the website economy, on 3 seeds over 30 game days each. A developer left alone earns 1.05 to 1.7× their salary in fees (about 1.3× on average); ship the changes yourself and it's 2.0 to 2.6×. With no probe, broken builds cost 0, 1 and 19 customer-hours of 500 errors over 30 days, depending on the seed. A probe takes that to zero.

↑ Contents

Pods, rollouts, and servers that die

Customer websites now run the way websites actually run: as a deployment of pods spread over the customer's servers, managed by a small Kubernetes. Each minute a controller looks at what's running and fixes the difference from what should be running, which is all the real one does.

Rolling updates. When you deploy, the new version doesn't land everywhere at once. One new pod starts; once it's ready, one old pod retires; repeat. On Pixel Bakery with three pods, a rollout took 9 game minutes, never had fewer than two pods serving, and finished without a single red minute (there's an achievement for that). If a server is full and there's no room to start an extra pod, it swaps one in place instead; with only one pod, that's a short, honest outage.

Servers die; pods move. Each pod lives on a server. When that server's disk fails, it loses power or it overheats, its pods are lost, and the controller starts replacements on another of the customer's servers that has room. In testing, with two servers assigned and the site published on both, I failed srv-01's disk: its pod came back up on srv-02 within the minute, and the customer stayed green the whole time. Fail both and the pods wait Pending, with the reason ("0/1 nodes are ready").

No pods, no website. If the network path is fine but no pod is ready, the customer gets a 503, and their HTTPS check says so: "503 Service Unavailable: no ready pods (2 starting)". It goes green again the moment one is up. A request arriving at a server is answered by that server's own pod if it has one, otherwise by any ready pod in the cluster, the way kube-proxy does it.

Scaling. The contract card shows a square per pod (green running, yellow starting, red outline pending) and − / + buttons. On auto, there's one pod per assigned server. A 1U server holds three of one customer's pods; a shared VM host holds one.

Does this make the game harder? Possibly a little: a server that reboots now needs its pod to start again (three game minutes) before the site is back. I tried to measure it with the balance bot and learned something else instead: two runs of identical code on the same seed came out at 161 and 176 red contract-hours, with different incidents, so the bot isn't deterministic and can't settle a difference that small. What I can say is that a 503 never showed up among the top reasons a customer went red. Making the bot reproducible is now on the list.

↑ Contents

↑ ↑ ↓ ↓ ← → ← → B A

A batch of small things, mostly for fun.

The cheat menu. Type the Konami code anywhere in a game (on a phone, tap the logo in the top bar seven times) and a neon cheats window opens. The toggles are big head mode, a money printer that never lets your cash drop below a million, a "Caffeine IV" that makes every job about twenty times faster, staff who walk three times as fast, teleporting delivery trucks, arctic air (nothing overheats), a calm mode where nothing breaks, moon gravity for the confetti and packing peanuts, and disco lights. The one-shots are $100,000 found in the couch, legendary reputation, a group hug that makes every person and customer happy, and a surprise party. Cheats are saved with the game, so a big-headed office stays big-headed after a reload. The B and A that finish the code are kept from the game, so the B doesn't also pick the Build tool.

Balloons pop. During an office party, click a balloon and it pops with a bang and a burst of confetti that flutters down and settles on the floor. Popped balloons stay popped for the rest of that party; the next party brings a fresh set. Pop all twenty for an achievement.

The chair goes to space. Spinning a desk chair has always been allowed. Keep it spinning for thirty clicks in a row and it rattles, beeps a countdown, lights an engine and blasts off through the ceiling on a trail of smoke. A few seconds later it drifts back down onto its spot under a pink parachute. Let it stop spinning and the count starts over.

Racks have headroom. A device in the top slot, U42, was hard to click. I measured it: scanning down the front of a rack one pixel row at a time, U42 got zero clickable pixels from the usual camera angles, while U41 got nine. The rack's top trim sticks out about ten centimeters past the device faces, and since the camera looks down on the room, its front edge covered the top slot completely. Racks are now 15 cm taller, which leaves real space above U42. Measured again the same way, U42 is the easiest slot on the rack to click.

↑ Contents

Websites, and the people who write them

Customers with a public web service now have an actual website: a real HTML page, generated for each of them when they move in. There's a new hire to look after it, the Software Developer.

Once you have one, customers start sending change requests: "Can you change our headline to Now open Sundays?", "Please add a link to /status", "A screen-reader user told us our logo has no alt text." Click the developer's monitor while they're at their desk (or ✏️ Edit site on the contract) and an editor opens. It has the HTML with syntax highlighting, a live preview, and the customer's request with a checklist that ticks as you type. Fun mode adds snippet buttons for headings, links, list items and images; Hacker mode is just you and the markup. Then 🚀 Deploy: a build runs for a few game minutes and the new version goes out to the customer's servers.

The check is real, the same way the network checks are. The game follows the public trace to whichever server answers, reads the version of the page that server is actually holding, and runs the request's checks against it with a real HTML parser. Deploy a perfect page while the port-forward is broken and the request stays open, with the reason ("the site isn't reachable from the internet"). Fix the forward and it closes on the next check. I tested exactly that.

You don't have to do any of it. Leave a request alone and the developer picks it up, works it at their desk for a few hours and ships it: in testing, a request filed at 10:20 went live at 13:40 and paid $250. Ship it yourself and it pays 1.5× ($375 for that customer) and makes them happier. A request nobody closes within two days costs a little goodwill.

It unlocks in Chapter 6 of the campaign, alongside virtual servers (there's a reason for that, coming next), and from the start in a sandbox. Next up: Kubernetes-style deployments, with replicas spread across your racks, rolling updates, and pods that move when a rack goes dark.

↑ Contents

Sandbox means sandbox

A player picked 🏖️ Sandbox on the title screen, pressed ▶ Continue, and was still locked out of features "until Chapter 3." The sandbox choice worked fine for a new game. Continue, though, loads your existing save, and that save was a campaign. Nothing on the screen said so: the picker sat right above the Continue button, and the button showed only the mode, day and cash.

Three changes. The picker now has a New game label over it. Continue (and every slot in 💾 Save) says what kind of game the save is: "📖 Campaign, chapter 1" or "🏖️ Sandbox." And a campaign save now has a way out: 💾 Save → Switch this save to sandbox, with a confirm step. Everything unlocks, the chapter goals go away, and your achievements stay. In testing, a chapter-1 save went from 42 locked features to none, and it stayed a sandbox after saving and reloading.

↑ Contents

The NOC screen has a second page

The big screen on the break room wall has always shown business ops: cash, green customers, servers, staff. Click it now and it flips to your achievements: the total, a tile and a bar for each of the eight categories, your latest unlock, and how many secrets you've found. Click again to flip back. The page updates the moment something unlocks, so you can watch the numbers climb.

Flipping it the first time earns an achievement of its own, Make Work Fun Again, which brings the list to 100. The 99th was added earlier today: Number Two in Command, for cleaning up after the pet 50 times.

↑ Contents

A router in the middle

A player wired ISP → firewall → router → switch → servers, which is a perfectly good network, and the game told their servers there was "no firewall or router on this network." Some people got stuck there.

The tracer was fine: it routes through a router correctly. The helpers around it had only ever seen a firewall talking straight to a switch. Auto-address skipped routers entirely, so the router never got an address, and the servers landed on the firewall's own network on the far side of it. The console hints couldn't see a router whose ports had no address. Publish looked for a firewall whose inside network contained the server, so it would have failed next.

Now one press of ✨ Auto-address sets up the whole chain. The router's port toward the firewall joins the firewall's inside network (10.0.10.2) and sends everything else there. Each port toward servers gets a network of its own (10.0.20.0/24, then 10.0.30.0/24), and the firewall learns the route back. Two routers in a row work too; the one nearest the firewall learns the way to the far one's network. Servers that were stuck on the wrong network move over, and any port-forwards made for their old addresses move with them. Publish now finds the firewall in front of a server even when a router sits between them.

In Hacker mode, the server's hint now points at the router ("its ge1 port has no address yet") instead of saying there's no router, and the router's console offers the exact commands for each port. I tested all six orders of opening the three consoles, following only the hints: each one got a customer green in 14 commands. If you set up the router before the firewall, it now tells you to do the firewall first rather than guessing the wrong network for that port. And the 🌐 IP plan now flags two gateways that share a cable but not a network.

↑ Contents

Goofing off at work

There are now 98 achievements, under a 🏆 button in the toolbar. They cover the whole game: your first rack and your first green customer, a full 42U rack, 200 cables of spaghetti, running your own AS number, riding out a utility outage without a single rack going dark, catching an insider, paying off a loan, three renewals from one customer, three customers on one VM host, all three certifications, every campaign star.

A quarter of them live around the office, for the things you poke when you should be working: DOOM on a monitor, blue-screening one instead, spinning a chair, ringing the front desk bell ("Ding Ding Ding, We Have a Winner!"), sending the sticky notes flying, jabbing a badge reader until it refuses you, spilling the water cooler, the goldfish, the dog walker, and cleaning up after the pet ten times ("Pooper Scooper").

Some are secret and show as ??? until you find them. Most of those are things that go wrong: a breach, a failed audit, someone stepping in it, firing a person who turned out to be innocent.

Achievements belong to you, not to a save, so they carry across every game on the same device. That creates one problem: load a game you have been playing for a while and everything it already earned unlocks at once. A burst like that now arrives as one card ("4 achievements unlocked" when loading the demo save) instead of a stack running down the screen.

↑ Contents

Walkies

The cats got a litter box a while ago. The dog kept going wherever it pleased. Now you can hire a dog walker ($40 a day; it's in the Build catalog when your office pet is the dog). It's a service rather than something delivered, so there's no truck and nothing to install: they start the same day.

At 08:30 and 16:30 the walker comes in the front door calling "Walkies!", finds the dog wherever it's napping, clips on a leash and heads out along the front of the building. The dog does its business outside ("*bag* 🛍️ Good dog."), and they walk back in so the walker can drop the dog off at its bed. With a walker booked, the dog holds it in between, so the floor stays clean. In testing, a full walk took about an hour of game time and left no mess behind.

↑ Contents

The market doesn't run dry

There were twenty customers in the game, each written by hand, and each could sign exactly once. In the balance bot's runs, every small customer was taken by the middle of the campaign. After that the offers list stalled on a handful of big, picky ones, and a sandbox save quietly ran out of things to do. Hall B has room for a lot of servers, and nobody to put on them.

Now new businesses keep calling. Once the named customers start getting signed, the market fills in with generated ones, built from parts:

• What they do: shops, cafés, game studios, mail providers, podcast networks, analytics firms, clinics, fintechs, AI labs, and systems that can't go dark.
• What they need follows from the business: a clinic wants a locked-down database, a fintech wants SSH closed, and anything critical wants two power feeds.
• How big they are follows your reputation tier, and the price follows from the requirements, using the same yardstick as the named customers. Pixel Bakery's formula price is $500 against a list price of $520.

The twenty named customers are still the familiar faces early on. The generated ones fill in behind them, and a batch of offers won't hand you two radio stations in a row.

Contracts have terms now. A customer signs for 7 to 17 days (bigger customers sign longer), and the card tells you when they're up for renewal and how it's looking. When the term is up, a happy customer renews, and a very happy one bumps its rate by 5%. A so-so customer might renew. An unhappy one leaves, and your reputation takes a small knock. Uptime used to be about today's pay; now it's also about keeping the customer.

Happy customers grow. Once a customer has been happy for a few days, they sometimes ask for another server, for more money. Accept it on their card and you get a day to assign one. That's what fills Hall B.

What testing turned up

The balance bot played it for weeks of game time and, by signing everything in sight, found three real problems:

• Publishing could lie. If an address and port were already forwarded to a different server, Publish skipped the rule but still said "published". And if one ISP was out of addresses, it gave up entirely, including the firewall rule for the ISP that did have room. Now it finds an address that's actually free, publishes wherever there's room, and tells you which ISP needs more addresses.
• You could only rent address blocks from ISP A. With two ISPs you'd run out on ISP B with no way to get more. Now either ISP will rent you a block.
• Checking every customer got slow. Each customer re-traced every public address from scratch, so the check grew with customers × addresses, and it runs after every change. With 22 customers it took 13 ms, most of a frame. Now each address is traced once per pass and shared: about 3 ms, with identical verdicts for every customer.

In a 40-day sandbox run, the bot ended with $135k and daily revenue over $10k, after 30 renewals, no departures and 14 growth requests. It also still finishes the whole campaign.

↑ Contents

Letting a robot play first

After a run of big features (dust, a second power feed, a second ISP, fiber cuts, VM hosting, Hall B, the campaign), nobody had checked how they all play together. So I let the balance bot loose on it first. It's a script that plays a real game through the same actions you use: building racks, cabling, signing customers, hiring, borrowing when it's broke. It records everything that happens. It plays 20 game days in a few seconds, so it can play the same game on several random seeds and show where things hurt.

The sandbox economy

Over 21 game days on three seeds, the economy held up well. The bot turned a daily profit on day 3 or 4, and tier 2 customers started calling on day 5, earlier than before. It finished with $65–75k in the bank.

Fiber cuts were the one thing that hurt. On the unluckiest seed they caused half of all the hours customers spent offline. With one ISP, a cut takes everyone down, and a second ISP is hard to afford in your first two weeks. Cuts used to last two to six hours; now it's one to three. That's still long enough to make a second ISP worth buying, and short enough that you won't lose half a day to a backhoe.

Dust turned out milder than planned. Without the sticky mat, the server room never got dusty enough to need vacuuming in three weeks, though disks still failed a third to a half more often. That's about right for a $350 fix.

The campaign

Next, the bot learned to play the campaign: click through the chapter cards and chase each chapter's goals the way a sensible player would. The first run got stuck in chapter 5 for fifty days. That was a real bug: SOC 1 needs a Finance Manager, and the Finance Manager didn't unlock until chapter 6. That chapter couldn't be won.

It found two more problems:

• Chapter 6 asked for $250,000 net worth. The bot reached chapter 6 with $14k, having spent it on staff and audits, and earned about $6k a day, so that's forty days. A flat target also punishes whoever spent the most on chapter 5. Now the goal is to grow your net worth by $40,000 during the chapter.
• Chapter 8 was mostly waiting. The bot spent about 18 days saving up for Hall B before a single wall went up. Now MegaMart, who wants in anyway, pays a $60,000 deposit when the chapter starts. The server goal dropped from 60 to 48.

After the fixes, the bot finishes all eight chapters on both seeds I tried:

The bot plays a lot faster than a person does. It never hesitates, never misreads a tooltip, and knows exactly which controls an audit checks, so I left the early chapters' time targets alone. The one star it rarely earned is the uptime star. 99.5% is hard with a room full of customers, and it's supposed to be.

What the bot can't tell me

Whether it's fun. It can't say whether chapters 2 to 4 feel too short, whether the heatwave is scary or just annoying, or whether catching the insider is satisfying. That takes people playing it, so if you do, I'd love to hear where it drags or where it's over too fast.

Also in this batch: Hall B has its own lights at night now, and the Build catalog and toolbar scroll sideways with arrows when they don't fit the screen.

↑ Contents

A campaign, eight chapters long

The game had grown a lot of systems (compliance, loans, on-call, BGP, dust, VMs, two power feeds, a second hall) and no story. The "Getting started" list ended at 9/9 with "Grow it", and after that you were on your own, with every system switched on at once. Now there's a campaign.

Eight chapters, from an empty room to a two-hall regional provider: The Garage, Word of Mouth, People Problems, Hot in Here, Trust Issues, The Money, Storm Season and Room to Grow. Each one opens with a card that sets the scene and lists the goals.

One system at a time. Each chapter unlocks something: hiring and shipping in chapter 2, HR and team events in 3, dust and the sticky mat in 4, compliance in 5, sales and VM hosting in 6, the second feed and second ISP in 7, and Hall B in 8. Higher-tier customers, harder incidents and the insider arrive on the same schedule. Locked things aren't hidden: they show a 🔒 with the chapter that opens them, so you can see what's coming.

Every chapter has a twist. A power flicker in chapter 2, a 3am page in chapter 3, and a two-day heatwave in chapter 4, when the CRACs lose up to 30% of their cooling. In chapter 5 one of your own staff turns out to be an insider. Chapter 7 is a forecast storm: an outage on Feed A, then a cut on ISP A's fiber. If a heatwave cooks a rack or the storm takes you down, another one comes along a couple of days later. You don't fail the campaign, but you do have to be ready.

Three stars per chapter: one for finishing, one for finishing inside the day target, and one for 99.5% customer uptime. When the last chapter's done, the save carries on as a sandbox with everything unlocked. Sandbox mode is still on the title screen for anyone who wants to skip the story.

Tested by a robot. Before shipping this, a balance bot played the whole campaign through the game's own actions, on two different random seeds. It found a chapter you couldn't win (SOC 1 needs a Finance Manager, who didn't unlock until the chapter after), a net-worth goal that took forty days, and a Hall B chapter that was mostly waiting for money. All three are fixed: the Finance Manager arrives in chapter 5, chapter 6 asks you to grow your net worth by $40k, and MegaMart now puts down a $60,000 deposit to get Hall B started. The bot now finishes all eight chapters in about 60 game days.

↑ Contents

Hall B

This is the last step of the expansion plan: more building. Past Receiving there's now an empty lot with survey stakes and a sign that says Future Hall B. Click it (or find Hall B at the end of the Build catalog) and you can sign with the builders for $120,000 ($180,000 in Hacker mode). If that's more than you have, the bank will lend against your credit score.

It takes about four days, in four stages: permits and a survey, pouring the slab, the steel frame, then the raised floor and walls. A three-person contractor crew in hard hats works the site from 07:00 to 19:00 (nothing gets built overnight), with a progress bar over the sign. They're not your staff, so your people keep working the whole time. The Hall B panel shows which stage they're on and how long is left.

When it opens, a doorway appears in Receiving's wall, and Hall B is 17 × 14 cells of server-room floor, nearly as big as Hall A. You fill it the same way: racks, a UPS and PDUs, CRACs, cabling. Both utility feeds are on Hall A's back wall, so the power runs are long (and cost more per meter). That's a decent reason to put a UPS in Hall B itself.

Under the hood, the map is now 54 cells wide instead of 36, but Hall B's cells stay empty lot until the builders finish. Old saves load with the lot empty and nothing moved. The shadow box widens once the hall exists, and the empty lot costs about 9 extra draw calls. Last entry's performance pass is what makes a second hall full of racks affordable.

↑ Contents

Five thousand draw calls, then eight hundred

Step three of the expansion plan doesn't change anything you'll see. It's a performance pass, done before a second data hall doubles everything.

The problem was draw calls, not memory. Every little piece of a rack was its own mesh: the rails, and a body, a front and two to six LEDs for every device. Each mesh costs a draw call, and every patch cable was one more. A full rack cost about 180.

The fix: bake each rack into one mesh per material. Almost everything shares a small set of cached materials, so a rack collapses to about 13 draw calls. LEDs still blink, because they animate their shared materials rather than individual meshes. You can still click a single server: each device leaves behind an invisible pick box that the mouse can hit but the camera never draws. Staff avatars got the same treatment inside each joint (hips, elbows, head), so they still walk and wave. All the cables are merged too, rebuilt whenever the cabling changes.

*Measured in a software-rendered headless browser, so only the ratio means anything. The "before" column is the previous release, run on the same benchmark.

And a leak I didn't know about. Every time the cabling changed, the old cable meshes were thrown away without freeing their GPU memory. In the benchmark, twenty cable changes grew the geometry count from 1,753 to 10,102 on the old code. On the new code it stays at 581. If a long session used to get sluggish after a lot of cabling, that's probably why.

↑ Contents

A backhoe, a second ISP, and BGP

This is step two of the expansion plan. Until now your uplink never failed, so a second one would have been pointless. Now it can: after your first week, a construction crew will occasionally dig through an ISP's fiber, and that link is dark for one to three hours. With one ISP, every customer goes offline until it's spliced.

You can order ISP B. Click the ISP A demarc on the back wall. ISP B's crew takes about two days to put a second demarc on the wall. It comes with its own handoff block (198.51.100.16/28, gateway .17), its own AS number, and its own daily bill. Firewalls have a new second WAN port, outside2, for it, and any rule you wrote for outside covers both.

Failover is the simple way to use two ISPs. Publish now gives each service one address from each ISP's block. The firewall gets two default routes: ISP A at metric 10 and ISP B at metric 20. When one fiber is cut, the route through it is skipped, outbound traffic takes the backup, and customers reach you on the other address (their DNS lists both). In testing, cutting ISP A moved outbound traffic straight to outside2, and a service published on both stayed green.

BGP-lite is the proper way. In the IP plan, register your own provider-independent block (203.0.113.64/27) and AS number (AS64512). Then peer with both ISPs and announce the block. Each ISP only routes your block to you while its session is up. A session only comes up if the neighbor really is that ISP's router, the remote AS is right, and you're using your registered AS. The ISPs also refuse to carry anything that isn't your block. Once it's up, one address per service works through either ISP, with no DNS tricks. In Fun mode, ✨ Set up BGP configures it for you. In Hacker mode it's console work:

bgp as 64512
bgp neighbor 203.0.113.1 remote-as 64500 local-pref 200
bgp neighbor 198.51.100.17 remote-as 64501
bgp network 203.0.113.64/27
show bgp

Get one wrong and show bgp tells you exactly what: Idle: wrong remote-as 65000: ISP B is AS64501, or Rejected by the ISPs (not your block): 10.0.0.0/8.

Some customers insist. Parcel Pilot (tier 2) and Tidewater Trading need every public service reachable through ISP A and ISP B. Each ISP is checked on its own.

↑ Contents

Feed B

This is the first step of the expansion plan: power, then a second ISP, then a performance pass, then a whole second data hall.

You can order a second utility feed. Click Utility Feed A and there's a new Redundant power box. Feed B comes in from a different substation. The power company takes about a day to run it, and it sits on the wall under construction until it's live. It costs $25,000 up front plus a $40/day standby charge ($40,000 and $90/day in Hacker mode).

Each feed has its own bad days. Outages and flickers now roll separately for each feed. That's more incidents overall, but each one only takes out half your power. Cable a UPS or PDU from both feeds and it just keeps going. In testing, an outage on Feed A didn't even put the UPS on battery: it switched straight over to Feed B. Racks, PDUs and UPSes now show whether they're dual-fed A+B or on one feed only.

Some customers insist. Two new customers, Beacon Dispatch (911 software, tier 2) and Tidewater Trading (a trading desk, tier 3), require every one of their servers to sit in a rack fed from both feeds.

↑ Contents

Wipe your feet

The server room gets dusty now. Every trip through the door tracks a little dirt in on someone's shoes. As it builds up, dust bunnies gather along the walls, disks start failing more often (up to three times as often in a filthy room), and once it's bad Facilities spends 45 minutes vacuuming. The CRAC filters pull a little out of the air on their own.

The fix is an ESD sticky mat ($350, an office upgrade) right outside the server room door. A fresh sheet catches about 90% of the dirt. As the sheet fills with shoe prints it catches less, so click the mat to rip off the top sheet (it makes a satisfying noise), or Facilities will peel it for you when it's half dirty. In a test run with six staff, the room collected 0.25 dust over two days without a mat and 0.01 with one.

↑ Contents

Ding! And shared servers

The front desk is pokeable now. Click the bell and it dings and rattles on the counter. Click the pink sticky-note pad and a couple dozen notes burst into the air, flutter down all over the lobby, then tidy themselves away. Click a badge reader and it beeps with green rings pulsing out. Jab it three times fast and it blinks red and buzzes at you: access denied.

Dedicated or virtual. Until now every customer got whole servers to themselves. That's still the default: a server is dedicated to one customer. But a sysadmin can now install a hypervisor (server panel → Hosting, 40 minutes) and turn it into a VM host. A VM host takes several customers, one VM each: three on a 1U, six on the 2U storage box, two on a GPU server. Their websites share the box and its public IP, the same way real shared hosting serves lots of HTTPS sites from one address.

It's a real trade-off. Sharing means fewer servers to buy, power and cool. But a busy VM host runs flat out, and when it goes down (a power flicker, an overheat, a hardware fault) every customer on it goes red at once. The big and regulated customers (MegaMart, the banks, Harbor Health, the GPU crowd) are tagged 🧱 Dedicated servers only and won't count a VM host toward their servers. Everyone else says ☁️ VMs OK.

↑ Contents

Pizza, parties and a day off

Mood matters, so now you can do something about it. Happy people work faster, but until now your levers were raises and office perks. The Staff panel has a new Team events section:

• 🍕 Pizza lunch ($25 a head, every 3 days): +8 mood for everyone. Pizza boxes show up on the coffee table and people wander over to eat.
• 🎳 Team outing ($100 a head, weekly): +15 mood and a rest that knocks down fatigue. The catch: everyone leaves for the rest of the day, so work stops.
• 🎉 Office party ($80 a head, every two weeks): +20 mood, with balloons around the office for the rest of the day.

You can see what's wrong. Open a worker and a new Why they feel this way list shows what's pushing their mood up or down each hour (tiredness, overtime, perks, HR), plus recent things that happened to them: a night page, a raise, a pizza lunch, stepping in something the cat left behind. Anyone below about 45% mood gets a thought bubble now and then with their biggest gripe, so you can spot trouble without clicking everyone.

A day off. Somebody worn out from night pages can get a day off tomorrow (once a week each). They stay home, the on-call rotation skips them, and they come back with no fatigue and a mood boost.

↑ Contents

Somebody feed the fish (well, clean it)

The fish tank gets dirty. Over about two and a half days the water turns cloudy and green, algae appears on the inside of the glass, and the goldfish slows to a sulky drift. Click it and instead of a cheerful "Blub!" you'll get "…can someone clean this? 🫧". Once it's half dirty, Facilities adds "Clean the fish tank" to their queue on their own and sorts it out between other jobs.

The plants need water. Each office plant dries out over about a day, drooping and going olive-brown as it does, and Facilities waters it before it gets bad. Nothing breaks if they're late. It's just nice to have a building that someone visibly looks after. (The trees outside get rain.)

Both are ordinary jobs in the queue, so they happen during working hours and after anything more urgent. It's one more reason to keep a Facilities Tech on staff after the racks are built.

↑ Contents

The pager goes off at 3am

Three connected ideas: the power can blink, somebody has to answer the phone at night, and that somebody pays for it the next day.

Power flickers

A new incident: a split-second dip on the grid. Every server not fed through a UPS loses power for an instant and reboots: 10 to 20 minutes down, and its customers go red while it boots ("srv-01 is rebooting"). About one in eight doesn't come back at all and sits there stuck mid-boot until a sysadmin power-cycles it. If every rack is behind a UPS, the log just says "The lights flickered. Everything behind a UPS rode straight through." Servers also take a few minutes to boot after any power loss now, including when the grid comes back after a full outage.

On-call

From day 4 you can set up an on-call rotation in the Staff panel: choose who's in it (sysadmins, network engineers, facilities, security) and one of them carries the pager each night, round-robin. Before, anything that broke after hours just waited until 07:00 with "after hours" on the job. Now an after-hours incident pages tonight's on-call person. You'll see them walk in through the front door in the dark, fix it, and go home. It costs $40 a night on the rotation and $60 per page.

Tired people

Every page costs sleep, and a page between midnight and 5am costs more. A tired person works up to 30% slower and gets grumpier. Badly tired, they show up late the next morning ("came in late after a rough night"). A quiet night lets them recover. So the rotation matters: page the same person three nights running and your best sysadmin is a zombie by Thursday.

Performance ratings

Everyone now has a 1–5 star rating built from the week so far: how much work they got through compared with the rest of the team, skill, mood, night pages answered, late arrivals, and how tired they've been. Once a week the reviews are written up (with a shout-out to the top performer), and a good or bad review nudges mood. There's a 💸 Give a raise button too: +10% pay, a big morale boost.

↑ Contents

Where does this IP go?

A player put it plainly: in Hacker mode they'd open a server's console and have no idea what to type. In real life you'd have your IP space written down: the block the ISP gave you, maybe extra blocks you bought, which address the firewall holds, what's port-forwarded where, and which internal network each server lives on. The game knew all of that. It just never showed you.

The IP plan

• How traffic flows, drawn with your real addresses: in from the internet through the ISP's router to your firewall's outside address, through a port-forward (DNAT) to a server; and back out through the firewall, where the server's private address is swapped for the firewall's public one (SNAT).
• Every public address and what it's doing: the ISP's router, your firewall, which port goes to which server, or free.
• Your private networks: each one is owned by a firewall or router interface (10.0.10.1/24 makes 10.0.10.0/24), with its hosts, whether their gateway is right, and the next free address.
• Problems, in plain words: duplicate addresses, a server on the wrong network for its switch, a gateway outside its own network, a port-forward to an address nobody has, a firewall with no default route.
• A short glossary for /24, gateway, DNAT, SNAT and routed blocks.

Buy more IPv4

You start with a /28 from the ISP. Now you can rent more: a /29 (6 addresses) or a /28 (14), billed daily with your ISP bill. The ISP routes the block to your firewall's outside address, the way a real ISP does, so none of those addresses sit on an interface: your port-forwards decide where each one goes. The traffic simulation traces it properly ("ISP routes 192.0.2.0/29 → 203.0.113.2", then the NAT), and an address that arrives with no forward says exactly which nat add it's missing.

💡 What to type

In Hacker mode, every server, firewall and router now shows its exact next commands, with your real values filled in: the next free address on its network, the right gateway, the services its customer needs, and the port-forwards and rules the firewall is missing (each picking a free public address). The same list sits at the top of the console's command panel and updates after every command. I checked it end to end: starting from racked-and-cabled but unconfigured hardware and running only the suggested commands, the customer went green with no addressing problems left.

↑ Contents

It hums now

Until today the whole game was silent. Now it has sound, and not one audio file: every sound is synthesized live in the browser with the Web Audio API, a couple of oscillators or a burst of filtered noise shaped by an envelope. Nothing to license or download, and it works offline like the rest of the game.

• The server room hums. A soft mains hum and a slowly drifting fan whir that get louder with every rack and CRAC you have running, and when the camera is close. Pan over to the office and it drops back.
• Things you do make a noise: a soft tick on buttons, a click-clack when a cable goes in, a cash chime when a contract signs, the truck's horn when a delivery lands on the dock, and a two-tone beep at the badge readers.
• Things you poke: the water cooler glugs and splashes, plants rustle, the cat toy boings, office chairs creak, monitors buzz into a blue screen (or play a little riff and then go boom once E1M1 boots), the parcel bursts into a patter of packing peanuts, and the litter box gets a scoop.
• The pets: a woof, meows (a purr if you wake a sleeping cat), a goldfish blub, a whoosh when the 1am zoomies start, and a sparkle when you clean up after them.
• Trouble: a gentle two-tone alert for incidents (never more than one every few seconds) and a low falling tone for the bad stuff, like a missed loan payment or a revoked certificate.

World sounds fade with distance from the camera. There's a 🔊 mute button in the top bar and Master / Server room / Effects sliders in Help, all remembered. Browsers only allow sound after you've interacted with the page, so it starts on your first click.

↑ Contents

A bot that plays the game, and what it found

Instead of guessing at the balance, I wrote a bot that plays real games through the game's own actions. It builds the racks and power, cables everything, signs the contracts it can satisfy, grows when there's cash, dispatches incidents, and borrows if it's nearly broke. It keeps a daily ledger. Then I ran it for two weeks of game time on three openings: a careful start, an over-hiring start, and a certificate chase (HR, security, reception, badges, front desk, SOC 2 as early as possible), plus Hacker mode.

What was actually wrong

• The early money was fine. The careful opening breaks even on day 3 and never drops below $14,000. The "losing $800 a day" demo company was just overstaffed.
• Reputation maxed out in ten days, which made the reputation tiers meaningless. Now each green contract adds half as much, tapering off toward the top: tier 2 arrives around day 7 and tier 3 around day 11.
• Going viral was a punishment. The incident said "they pay 1.5× while you keep up", but the code turned the whole contract red if you didn't have a spare server. That was the single biggest cause of red contract-hours. Now you stay green on your normal servers, and the extra server earns the bonus.
• A real networking bug: publishing the same service on a second server (a second web customer, say) picked the same public IP as the first one, silently skipped the port-forward, and still said "published". Each server now gets its own public IP.
• SOC 2 couldn't be kept. The uptime control wanted 99% over a single day, so one bad afternoon kept it red long enough to lose the certificate. It's now 97% over three days.
• Hacker mode starts with $40,000 instead of $30,000, so the core build leaves a real buffer. Everything else about Hacker stays hard: incidents still wait for you to dispatch them, and the SLA penalties still bite.

↑ Contents

A credit score, two loans, and a payment every week

The old bank handed out $25,000 lumps with interest dripping out every hour and no plan to pay it back. Now it works like a bank:

• A credit score from 300 to 850, recalculated live with every factor shown: on-time payments and loans paid off push it up; missed payments, defaults, owing a lot against what you own, cash going negative, and losing money pull it down. Time in business helps a little.
• The score sets the terms. Under 500 the bank says no. From there it lends up to $10,000, $25,000, $50,000 or $80,000 in total, at 3% down to 0.8% a week (more in Hacker mode, and a touch more for longer terms). You can hold at most two loans.
• Weekly repayments. Pick an amount and a 4, 8 or 12 week term and you get a fixed installment, debited automatically every 7 game days. The interest shows up in the P&L; the principal doesn't, because repaying a loan isn't a cost.
• Miss a payment (not enough cash on the day) and a 5% late fee plus the unpaid interest roll onto the balance and your score drops. Miss three in a row and the loan defaults: a big hit to your score and no more borrowing until it's back on track. Paying a loan off early is rewarded.
• When you're running out of money, the game now says so once a day and tells you what the bank will offer. Any "not enough cash" error points you to Finance → Bank.

Older saves carry their debt over as an 8-week loan.

↑ Contents

Badges, a front desk, and three kinds of auditor

The last big piece of the original plan: physical security and compliance. Banks, hospitals and payment companies won't host with you until someone independent has checked your homework.

Three frameworks, checked live

The new 🛡️ Compliance panel (O) lists SOC 1 (financial controls), SOC 2 (security and availability) and PCI DSS (card payments). Each is a set of controls, and every one is checked against the real sim, not a checkbox you tick:

• Background checks on every employee: an HR Manager has to have checked everyone, and nobody on staff can have an open red flag. Existing staff can now be checked too.
• Badge access, and a visitor log at a staffed front desk: see below.
• Logs reviewed (a Security Analyst) and financial reconciliation (a Finance Manager).
• No SSH and no databases reachable from the internet, proven with the same tracer the contracts use; and a firewall that denies inbound by default (no "allow any from outside" rules).
• Every loaded rack behind a UPS, found by walking the power graph upstream, and 99% uptime over the last day, from the dashboard's history.

The audit

When every control is green you can book an audit ($2,000 to $6,000). An auditor walks in, signs in at the front desk if you have one, then spends a few hours wandering between your racks. At the end they check everything again. Pass and you're certified, get a reputation bump, and the first regulated customer calls right away. Fail and you get a list of findings and lose the fee.

Certificates are monitored after that. Let a control go red and you get a warning, another with six hours left, and after 24 game hours the certificate is revoked. The customers who required it immediately start failing their contract requirements.

Four regulated customers need certificates: Ledgerly Payroll (SOC 1), Harbor Health (SOC 2), and PayPenguin and a reworked FinTrust Bank (PCI), paying $2,600 to $6,200 a day. A certificate is the credential they care about, so they'll call even if your reputation is still low.

Front desk and badge readers

• 🛎️ Front desk ($3,000) by the entrance, plus a new Receptionist role who works from it. Together they're the visitor-log control, and auditors get signed in and finish in three hours instead of four.
• 🪪 Badge readers ($2,500) on the server room and front doors. Everyone stops for a moment to badge through, and the little light blinks green. It's a real cost in walking time, but every door is logged: it's a compliance control, and security audits catch insiders noticeably more often with badge logs to go on.

↑ Contents

Bedtime, zoomies, and a litter box

The pets keep pet hours now. From 21:00 they head to bed (the dog and one cat in the bed, the other cat up the cat tree) and sleep, with the odd 💤. At 1am they get the zoomies: an hour of sprinting from one end of the building to the other at three times their normal speed, legs going like mad. At 2am they flop back into bed until 6am, then wake with a stretch or a yawn and carry on with their day. The dog finally has a proper lying-down sleep pose instead of sitting up all night.

🐾 Litter box ($250, cats only) is a new office upgrade in the Build menu. Once it's installed, the cats use it instead of the floor, one at a time. Each visit leaves a clump. At four it starts to smell (it counts against morale like a mess on the floor), and at six it's full: the log warns you, and the cats go back to using the floor. Click the box to scoop it out.

↑ Contents

A dashboard, and servers that work for a living

The HUD tells you the power draw, hottest spot and net income right now. It couldn't tell you whether things were getting better or worse. Now there's a dashboard.

What's on it

Open it with 📊 Dashboard in the dock, M, or by clicking the Power / Hottest / Net stats in the top bar. Pick 6h, 24h or 3d.

• KPIs: uptime (share of contract-time spent green), revenue and profit per day with margin, PUE (facility power ÷ IT power, the number real datacenters obsess over), energy in kWh and what it cost, peak temperature against the limit, peak traffic, average latency, reputation, and contracts green now. Tiles go green, amber or red.
• Charts: power (facility, IT, capacity), temperature (hottest vs room average, with the "too hot" line), traffic served, latency, revenue vs costs per hour, cash, contracts green, UPS battery, reputation (with the Tier 2 and 3 lines) and staff mood. Nights are shaded. Hover a chart for a crosshair and exact readings at that moment.

Behind it, the sim takes a sample of the whole business every 10 game minutes and keeps three days of history in the save, so the charts survive a reload. The charts are drawn directly on canvas; no chart library.

Servers now work harder in the afternoon

The first version had dead-flat power and temperature lines, because a server always drew its full nameplate wattage whether anyone was using it or not. Now it idles at 55% and ramps to 100% with its customer's traffic, which follows the day: quiet at 4am, busiest mid-afternoon, doubled while a customer's gone viral. Servers nobody has assigned just idle. So power, heat and the power bill all breathe with the day now, and an idle rack of spare servers is cheaper to keep around than it was.

↑ Contents

Personal space, a goldfish, and a proper network plug

A grab bag from playtesting: people standing inside each other, a crew that all looked like the same person, and a Network button with a mains plug on it.

Nobody shares a square any more

Two people could happily stand in exactly the same spot, most visibly at the office desks, where two of them would type on one keyboard from inside each other. Now everyone claims a cell: the one they're standing in, or the one they're walking to. Destinations (desk chairs, hangout spots, the spot in front of a rack, a shelf) are chosen from unclaimed cells, so a second person at a busy rack stands beside the first. On the way, people pause for whoever is in the next cell and route around anyone standing still. If someone takes your spot first, you find another.

A crew that looks like a crew

The names were already a good mix, but every avatar had the same short-hair silhouette. Candidates now roll a look (feminine, androgynous or masculine, weighted toward the first two) that picks from its own set of hairstyles and extras, with a slightly different build. There's a new pool of unisex names (Alex, River, Rowan, Sage, Tenzin…) used for most androgynous looks and a good share of everyone else. Beards and mustaches only show up on masculine looks. None of the game's text uses pronouns, so nobody gets misgendered by the log.

The goldfish

Pick 🐠 Goldfish on the title screen, next to the dog and the Maine Coons. It swims laps of its bowl with a wagging tail and the occasional bubble. Click it for a "Blub!", a happy wiggle and a burst of bubbles. It does not have accidents.

Packing peanuts

The half-packed box in receiving now pops open when you click it: the flaps swing up, it hops, and a spray of packing peanuts bounces off the table and floor, then disappears. After a few seconds it tapes itself shut again, ready for next time.

RJ-45, not a mains plug

The same icon is on the Network view hint and every "Cable to sw-01" button in Next steps. 🔌 stays where it means power: PDUs and breakers.

↑ Contents

Somebody clean that up, and somebody balance the books

Two very different kinds of mess: one the pets leave on the floor, one that shows up in the accounts.

Pets have accidents

Every few game hours the dog (or each cat) wanders off to a quiet spot, squats with a little 😳, and trots away like nothing happened. What's left is a swirl (dog) or two little logs (cat), with buzzing flies and a green wisp of stink. Unlike the pets themselves, a mess is real game state: it's saved, a messy floor slowly wears down everyone's mood, and anyone walking through one might step in it, which is a proper mood hit and a "Somebody clean that up!" in the log. Click it to clean it up, with a sparkle puff.

Finance

The books close every midnight into a daily P&L. The panel (F) shows cash, what your gear would sell for, loans and net worth, a week of bars (revenue up, costs down) and today's numbers by category. It also works out a runway: "averaging −$778/day, cash runs out in 45 days". Money that moves outside the normal categories (refunds, breach losses, incident costs) is shown as "other", so every day adds up to the real change in cash.

• Finance Manager (new role): renegotiates power and ISP bills (10% off), chases the invoices that otherwise slip (about 5% of revenue without one), and reconciles the books at a desk each afternoon.
• The bank lends in $25,000 chunks up to $50,000, with interest charged hourly (0.4% a day in Fun, 0.8% in Hacker). Borrowing and repaying don't count as income or costs.

Sales

• ⭐ Reputation (0–100) rises every hour a contract stays green and drops on downtime, cancellations (−8) and breaches (−10). In Fun mode it decides who will talk to you: Tier 2 customers at 35, Tier 3 at 65. In both modes it scales pay from 0.85× to 1.2× list.
• Sales Rep (new role): works the phones at a desk and lands extra leads, sometimes a tier above your reputation. Once your own tier is tapped out, they always reach one tier further. They'll also 💬 Negotiate an offer: usually +10–25%, sometimes the customer holds firm, and now and then they walk off to a competitor.
• Offers last two days and show where they came from (📨 walk-in or 📞 from sales), their tier and time left. A couple of walk-ins still arrive every morning, so you can play without Sales; you just see fewer, smaller customers.
• Eight new customers so Sales has someone to call: Goat Yoga Co, Tiny Tacos, Pocket Radio, Owl Analytics, Sock Club, Retro Arcade, MegaMart and Orbital Weather.

↑ Contents

Don't touch my computer

More things to poke in the office.

• Chairs spin. Give one a shove and it whirls round, wobbling a little, and slowly coasts to a stop. Poke it again while it's going to spin it faster.
• Monitors blue-screen. A sad face, "Your PC ran into a problem", and a stop code of CABLE_NOT_PLUGGED_IN (what failed: coffee.sys). About five seconds later it's back to the status graph.
• Poke it three times quickly and it boots E1M1: The Server Room, a tiny first-person shooter that plays itself on the monitor for half a minute. Poke it while it's running to fire.

Under the hood it's a Wolfenstein-style raycaster in about 200 lines, drawing into a 256×160 canvas that becomes the monitor's texture, at around 20 frames a second. There's a 12×12 map, horned imps that walk toward you (drawn as flat sprites that hide behind walls properly), and an autopilot. The first autopilot walked straight into walls and stared at them. The fix was to have it check thirteen directions every step and head for whichever is most open, with a gently drifting preference so it wanders. Now it looks down corridors like a person would, and turns to shoot any imp that gets close.

↑ Contents

In your pocket, and always a next step

Two things this time: the game now plays properly on a phone, and every selected thing tells you what to do next.

Next steps

Players liked the depth but kept losing the thread between steps: "I've racked a server… now what?" Now every rack, PDU, UPS, firewall, switch, server and the ISP demarc gets a short checklist at the top of its panel. Done steps are ticked, and the current one has a button. Most buttons just do the obvious thing:

• ⚡ Run power from the PDU, or Power 3 racks, which feeds every unpowered rack the PDU has outlets for.
• 🔌 Cable to sw-01, which finds a free switch port. On a switch, Cable 4 to sw-01 cables every loose server in one go.
• ✨ Auto-address in Fun mode, or 💻 Open the console in Hacker mode, where you still have to type it.
• Everything else is a jump: to the gear list, the heat map, the contracts panel or the Build catalog.

Every one-click action goes through undo like anything else. The tutorial also got a 👉 Show me button that opens the right tool or selects the right thing for the current step. The dock can now be collapsed with Hide or the ` key, and it stays that way next visit.

Phones

The desktop build already worked in a phone browser, in the sense that it loaded. Now it's actually playable:

• Touch controls. One finger pans, two fingers pinch-zoom and twist. Tap to select. Placing something works as tap a spot, then confirm: a bar appears with ⟳ Rotate, ✓ Place ($1,200) and ✕, and it tells you why when a spot doesn't work. Long-press cancels a tool.
• Layout. In portrait the side panel is a bottom sheet and the stats bar wraps to two rows. In landscape the panel is a slim column on the right. Everything respects the notch and the home indicator.
• Console. The terminal goes full screen, and a 📖 button slides out the command list, since there's no room to keep it docked.
• Graphics. A Low / High / Auto setting in Help. Low means fewer shadows, less grass, fewer night lights and a capped pixel ratio. Auto picks Low on phones.

Install it, play it offline

The site is now a proper web app, so Add to Home Screen gives you an icon and a full-screen game with no browser bars. A service worker caches the game on first visit, so it opens and plays with no connection at all. Saves were always in the browser anyway. Each deploy gets a fresh cache: content-hashed files are served straight from the cache, and everything else asks the network first, so an update never mixes new code with an old stylesheet.

↑ Contents

Not everyone is who they say they are

HR arrived, and so did the people it exists to catch.

HR Manager

A new role in a pink hoodie. Having one on staff means more candidates each morning (six instead of four, slightly more skilled), a slow boost to morale, and a 📋 Check button on every candidate. For $150 the HR Manager sits at a desk for 45 minutes and comes back with ✓ Clear or a red flag: a falsified certification, an undisclosed firing, a fraud conviction. People with a red flag work 15% slower and are grumpier. You can still hire them.

Insiders

About one candidate in seventeen is quietly malicious, and a background check only sees through them about a third of the time. They never do anything suspicious in front of you. Now and then an insider picks up a job with a perfectly boring label ("Firmware update on fw-01", "Log rotation on srv-03", "Inventory count in receiving"), walks over, fiddles for a bit, and leaves. Afterwards, one of these has happened:

• 🦶 A cable "comes loose". It looks like the ordinary trip-over incident.
• 🕵️ A firewall rule nobody added. An allow-any rule plus a 1:1 NAT that exposes a server's every port, which the tracer then flags on any contract that says "SSH must not be public".
• 📦 Stock vanishes from the receiving shelves.
• 💾 Customer data walks out, which costs a breach notification and customer trust once it's found.

Security audits

Every few hours each Security Analyst sits down to review the access and change logs. Hidden sabotage gets found (not always on the first pass), turns into an incident, and adds to the culprit's suspicion, with a little noise so the list isn't a giveaway. Each person's panel has a security file listing the evidence in plain sentences. Let go of an insider and you get a 🎯 and the full list of everything they did. Fire an innocent person the team suspected and everyone's mood takes a real hit.

Morale

Everyone now has a mood, shown as an emoji. It drifts back toward "fine" by default, goes up a little with coffee, the kitchen and an HR Manager, and goes down with overtime and firings. It scales work speed from 80% to 110%, and someone at rock bottom will eventually quit.

↑ Contents

Lights on, everyone home

Day and night. The game clock now drives the sky: warm peach at dusk, deep navy by 20:30, stars overhead. The sun fades to a cool moonlight and the island falls into shadow. At dusk the building's lights click on with a little warm-up flicker: cool white over the racks and in receiving, warm in the office, sconces on the back wall, and a row of streetlamps down the road. The monitors, the NOC screen and every blinking LED suddenly matter visually.

Working hours. Staff now work 07:00–19:00. After that they finish whatever job is in their hands (overtime is fine), walk out the front door, and come back in the morning with a wave. Nothing new starts after hours: a cable someone trips over at 21:00 shows 🌙 after hours and gets fixed at 07:00. That changes the tension. A UPS battery or a spare-parts shelf matters a lot more when nobody's around at 2am.

🍎 Micro-kitchen, the second office upgrade ($4,000): a counter with a mint fridge, a microwave, a fruit bowl, snack jars and a shelf of colorful boxes. People take snack breaks (with a new nibbling animation), so work runs 8% slower, but they're happy to stay until 23:00. That's four more working hours a day, which easily pays for the snacks.

On the roadmap

A few ideas from the same conversation went into the plan as M6 — Security & compliance: a front desk with a receptionist or guard, badged doors that slow everyone down a little, badge logs that help catch insiders, and SOC 1 / SOC 2 / PCI certification. Each control gets checked against the live sim, auditors walk the floor, and certificates unlock the big contracts.

↑ Contents

Coffee is earned

New offices get a water cooler and nothing else. The ☕ coffee machine is now the first office upgrade, in a new section at the end of the Build menu. It costs $1,500 and goes through the same pipeline as everything else. It's ordered, arrives on a RocketBox truck, waits in receiving, and then a Facilities Tech carries it to its spot by the cooler and plugs it in.

Once it's installed, every job goes 10% faster. The Build menu card follows it along: price → 🚚 on its way → ✓ installed. Upgrades live in the save file and work with undo like any other purchase. This is the hook for the rest of the office upgrades still to come: better chairs, a snack wall, a proper espresso machine.

↑ Contents

An island in the sky

The diorama used to sit on an endless flat blue plane. Now it's a proper island: a thick slab of turf with rounded edges and layers of soil (with the odd pebble) stepping in underneath, floating in the blue. About 900 little grass tufts stick up, each a cluster of four thin blades leaning different ways, all drawn in a single instanced draw call along with a sprinkle of tiny flowers. The trees moved onto the grass. You can zoom out a little further now to see the island float.

Also

• RackShip is now RocketBox, rocket logo and all.
• Bat the red ball on the cat tree and it swings on its string: a damped pendulum on two axes, about one swing a second, dying away over a few seconds. It has a generous invisible hit area, because a 3.5 cm ball is hard to click.
• Clicks now ignore anything hidden. With the dog chosen, the cat tree is invisible, and its toy used to be clickable anyway.

↑ Contents

Poke the scenery

Toys don't need a reason. Two new ones:

• The water cooler: droplets arc out of the tap, bubbles rise in the bottle, the cooler wobbles, and a puddle spreads across the floor. Every puddle has its own wobbly outline, and it's gone after exactly 5 seconds. That's timed on the wall clock, not frame time, so a slow machine doesn't make it hang around.
• Plants and trees: the potted plants and the trees outside shake when you touch them and drop a few leaves that flutter down and fade.

The cursor turns into a pointer over anything pokeable. None of it touches the game state, so it never ends up in a save or the undo history.

↑ Contents

The cats have entered the datacenter

This one was a feature request with no economic value at all, so it went straight to the top of the list. The title screen now asks the important question: 🐶 Office dog or 🐱 Maine Coon cats?

They're built from the same rounded primitives as everyone else, with a few Maine Coon signatures: lynx tufts on the ears, a big white chest ruff, cheek fluff, white socks, tabby stripes along the back, and a six-segment tail that gets fluffier toward the tip. It swishes as they walk and curls round them when they sit or sleep.

They behave like cats, which is to say they mostly sleep. They nap in the bed, perch on top of the cat tree, follow whoever's working, and sometimes they go looking for the warmest spot in the building. In a datacenter, that's the hot aisle behind your busiest rack.

Click one and you get a Meow!, a Mrrrp? or a sleepy Mrrrp… 💤, which also wakes it up. Your choice is remembered per browser and saved with the game. Old saves keep their dog.

↑ Contents

"I don't know how to install a server"

This was the best kind of playtest feedback: blunt, and it points straight at the core loop. Both answers existed, but you had to know where to look:

• Installing gear meant clicking one of 42 thin, dark, unlabelled bars in the rack's elevation view before any choices appeared.
• The Hacker-mode CLI was a button at the bottom of a device panel, and it didn't tell you what to type.

Also new:

• 💻 Open console sits at the top of every device panel, and T opens it for whatever is selected.
• A ❓ Help panel (press ?) covers installing, power, cabling and configuring, plus the full command reference for servers, switches, routers and firewalls.

↑ Contents

Trucks, boxes, and things that break

Two systems this time, and they lean on each other. Shipping & Receiving means nothing appears out of thin air any more. Incidents means the datacenter keeps you busy after everything goes green. Repairs need parts, and parts come on the truck.

Shipping & Receiving

Clicking "install a server" used to spawn a server. Now it places an order:

1. A truck arrives after the lead time: 45 game-minutes in Fun, 3 hours in Hacker. Orders placed close together share a truck.
2. Boxes land on the dock. The new Shipping Clerk carries each one in, gives it an asset tag (RPC-1000, RPC-1001…) and shelves it. Small gear goes on the racking; crates and 4U boxes go to floor staging.
3. If the box was ordered for something, like a rack slot, a placed UPS or a repair, a job appears. Someone walks to the shelf, picks the box up, carries it across the building and installs it.

Spares change the pace. Anything on the shelf is used first and costs nothing extra, so installs from stock start right away. The rack panel now shows 📦 in stock ×2 or ships ~45 min for each item. Cancel something still in transit and you get a full refund. If it has already arrived, it just goes back into stock.

Incidents

Nothing breaks until your first customer is green, so the tutorial stays calm. Fun mode orders parts and dispatches people automatically. Hacker mode leaves it to you: a Dispatch button, a parts bill, and a dock that might be three hours from a delivery. A 🚨 badge on the dock counts what's open.

Verified this session

• Full chain, stepped through the real sim: place a rack and a UPS → one truck → both crates received and tagged → fetched → built. Then order a server → delivered → the sysadmin carries it → installed.
• Stock path: a spare switch on the shelf is used immediately. Cancel path: a server ordered then removed before delivery refunds the full $4,200.
• Each incident forced and resolved end to end: a disk swapped from a shelf spare, a compressor ordered and fitted, a cable re-seated, the outage survived on battery, and a viral surge flips the contract red until capacity is added.
• Undo of an order returns the money and removes the order. Saves from before this update migrate the wider heat grid.

↑ Contents

Save, load, undo — and a floor that finally lines up

This was the first round of playtest feedback. Two things came back: "I need to be able to save", and "I wish the units lined up with the floor panels". Both are fixed.

The half-tile bug

The game grid and the floor texture were both one meter per cell, just offset from each other by half a meter. Cell (x, z) covers x … x+1, but the floor plane was centered on the room's middle cell, so it started at x = 0.5. Every tile seam ran straight through the middle of a game cell, and every rack looked like it was straddling two tiles. The fix was one line per floor: center the plane on whole-cell bounds.

Save and load

The simulation already kept everything in plain, serializable objects, and that decision paid off here: a save is basically JSON.stringify(state). Three wrinkles:

• The heat grid is a Float32Array, so it gets tagged and revived.
• Contract traces are derived data (hop lists, link paths). They're dropped from the save and recomputed on load, which also keeps a mid-game save around 20 KB.
• Walkability lives outside the state, in the pathfinding grid, so it gets rebuilt from the loaded entities. Skip that and workers happily walk through a rack that was just loaded in.

The game autosaves every 30 seconds of play and whenever you leave the page. Browser storage can be missing or full, so every access is guarded, and the fallback advice is "export a file".

Undo that can't lie

Undo is snapshot-based: every player action records the state from just before it. That covers building, cabling, firewall rules, console commands, hiring and contracts. Undo swaps that snapshot back in. The clock rewinds too, and the toast says by how much ("Undid: Console: rule del 1 · rewound 6 min").

The alternative was writing an inverse for every action: refund the rack, cancel its job, unblock its cell, drop its power cables, and so on. There are dozens of those, and every one is a chance to leave the sim half-reverted. A snapshot can't get that wrong. It costs two serialisations per click, a few milliseconds each. Read-only actions, like show rules in the console, don't create an undo step at all.

One open question: in Hacker mode, undo can rewind you out of a breach. That's fine for now, but it probably wants a "no take-backs" rule later.

Verified this session

• Place two racks by clicking → undo twice → money and walkability restored → redo re-places one.
• Console rule del 1 → ⌘Z restores the rule; show rules creates no undo step.
• Save to a slot → sell a rack and zero the cash → load: money, racks, workers and heat all back, and both contracts re-evaluate to green.
• The title screen shows Continue with the newest save; importing a file works, and a junk file is rejected with a clear message.

↑ Contents

From an empty folder to a server room that actually routes packets

• The look
• People do the work
• Power
• Cooling
• The network
• Hacker mode
• Staff & customers
• Under the hood
• What's next

The brief was simple and huge: a datacenter tycoon that feels like a toy but plays like a job. You build the server room, install racks, run power and cooling, cable routers, switches and firewalls into servers, then configure them properly. And it has to be fun.

This first session was about the core loop, with nothing faked. Everything below runs in the browser from a folder of ES modules. There's no build step.

The look: chunky, soft, a bit silly

The art target was the Wolt illustration style: big round heads, big noses, puffy hoodies, chunky white sneakers, and a sky-blue world. Every character is built in code from spheres, capsules and rounded boxes, with a small joint rig (hips, shoulders, elbows, neck). Faces get eyebrows, a smile, and optional glasses, mustaches, beards, caps, beanies, hard hats and headsets. Hoodie color tells you the role.

Animation blends toward pose targets instead of using keyframes, so switching from walking to waving to working never snaps. Colleagues who pass each other sometimes stop and wave. There's also an office dog. It wanders, follows people around, naps in its bed, and says "Woof!" if you click it. It does nothing for the economy. It stays.

Nothing happens without people

Clicking "build" doesn't build anything. It places an order and queues a job, and a worker with the right role walks over and does it. Facilities Techs build racks, run power and reset breakers. Sysadmins rack and provision servers. Network Engineers install network gear and run cable. If nobody has the right role, someone else pitches in at half speed. If nobody at all is free, the job waits, and its bubble says who you need to hire.

Under construction, things render as a translucent blue ghost with a progress bubble. When the job finishes, the worker does a little cheer.

Power: Utility → UPS → PDU → Rack

The power tool is click-source, click-target. Loads add up from the bottom: a rack's load is the sum of its gear, a PDU's is the sum of its racks, and so on. Go over a rating and the breaker trips. Everything downstream goes dark, alerts fire, and a Facilities Tech has to walk over and reset it once you've shed the load. Each rack circuit is 6 kW, which a single 4U GPU server (2.4 kW) eats a big chunk of.

Cooling: the heat map

Heat lives on a per-cell grid. Racks breathe in at the front and exhaust out the back, so rotation matters and hot-aisle/cold-aisle layouts pay off. CRACs pull heat within a radius toward an 18°C setpoint.

Tuning took three tries. First the CRAC chilled the whole room to its floor temperature and the map was a sea of blue. Then it was 77°C in the hot aisle. The fix was to cap how fast a CRAC can pull down any one cell, falling off with distance. Air handling is local, and once that was in the model, hot aisles showed up where they should.

The network, honestly

This is where the game stops being point-and-click. Each device has ports, and you patch port to port from the rack panel. Cables render as drooping patch loops inside a rack and as overhead tray runs between racks. Little packets zip along any path that's currently serving a customer.

Under that sits a small, real network model:

• L2: switches with access and trunk ports and VLAN tags. Broadcast domains come from walking the cabling.
• L3: interfaces and VLAN sub-interfaces (ge1.20), connected and static routes, longest-prefix match, ARP on the egress segment.
• Firewall: DNAT port-forwards (with proxy-ARP for public IPs), ordered stateful rules with default deny, and inside→outside masquerade.
• Return path: a trace has to make the round trip. "Server has no default gateway" is a failure you'll meet.

One tracer drives the Fun-mode "Trace it" button, the CLI's traceroute, and every contract check. When a trace fails, it names the hop that failed and why.

Hacker mode: do it the real way

Fun and Hacker share one simulation. In Hacker mode the forms become read-only and you configure devices from a console: Linux commands on servers, Cisco-ish commands on switches and routers, and a small purpose-built shell on the firewall. Servers arrive with no OS, so a Sysadmin has to provision them first. Thermals are stricter, SLAs cost money when you miss them, and exposed services can get breached.

fw-01# nat add 203.0.113.9 -> 10.0.10.13
warning: 1:1 NAT forwards EVERY port (ssh included). Firewall rules still apply.
fw-01# rule add allow tcp from outside to inside port 22 dst 10.0.10.13
added rule #4

Do that and any contract with "SSH must NOT be reachable from the internet" goes red. In Hacker mode, attackers will eventually find it. Security Analysts lower the odds.

Staff and customers

Customers pay per day while every requirement is green. Requirement types so far: a public service is reachable, N healthy servers, an internal flow (web → db:5432), and a service that must not be public. There's a hidden stat for later, too: each candidate already carries a background-check result, and a small chance of being a malicious insider. The HR department will make use of that.

Under the hood

What's next

The full plan lives in docs/PLAN.md.

↑ Contents