The sky is not something an account grants you

`liveData` was one flag meaning two unrelated things, and it was set to
`tier !== "anon"`. That reasoning does not survive asking what the data actually
is. Cloud cover over San Francisco is a reading from a government sensor. The
aircraft are broadcasting their positions, unencrypted, to anyone within range
who owns a forty-dollar receiver. Neither is withheld from anybody by anybody,
so neither is a thing an account can grant access to — and putting them behind a
sign-in cost the only moment that makes this project land: real fog rolling off
the Pacific onto a city you recognise, at the real time of day, on a first
visit. On an SSO-gated deployment it cost that moment for every visitor there
currently is.

So `liveData` splits. `liveEnvironment` is public and unconditional.
`liveMarkers` is asked for by everyone and granted by the server, because the
marker set is the one feed here that can carry something private — a company's
pipeline, a person's job search — and whether it is public is a property of the
deployment, not of a file in this repo.

`TERA_MARKERS_ACCESS` is therefore a server switch and its default is `members`,
which is the safe answer rather than the common one. The failure mode of getting
this wrong is silent: nothing throws, nothing looks broken, the data is simply
readable by the internet. An operator who wires real markers up gets the shut
door without having chosen it and has to say `public` out loud — and saying it
appends a line to `degraded[]`, so `/api/v1/health` reports that this box is
publishing its map without anyone having to go and read the env file. Same
reasoning as `TERA_ADMIN_SUBJECTS=*`.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/access.ts

@@ -80,8 +80,37 @@ export interface Capabilities {
   officeDepth: "public" | "full";
   /** Scrub the clock and the date. God only — see the note about why this is honest. */
   timeControl: boolean;
-  /** Live markers and live flights rather than the fabricated sample set. */
-  liveData: boolean;
+  /**
+   * The real sky — observed weather and observed aircraft — rather than the
+   * synthetic one.
+   *
+   * **Public, including to a visitor who has not signed in.** It was briefly
+   * `tier !== "anon"`, on the reasoning that live feeds are what an account
+   * buys you. That reasoning does not survive contact with what the data
+   * actually is: the cloud cover over San Francisco is a public observation
+   * from a government sensor, and the aircraft are broadcasting their positions
+   * unencrypted to anyone with a forty-dollar receiver. Neither is a thing an
+   * account can grant you access to, because neither is withheld from anyone.
+   *
+   * What it cost was the only moment that makes this project land — fog rolling
+   * off the Pacific onto a city you recognise, at the real time of day, on a
+   * first visit. Gating that behind a sign-in traded the whole first impression
+   * for a rule with nothing behind it.
+   */
+  liveEnvironment: boolean;
+  /**
+   * Markers: whatever this deployment has decided its map is *about*.
+   *
+   * Separate from `liveEnvironment` because it is the one feed that can carry
+   * something private. The sky is the same for everybody; a marker set is a
+   * company's pipeline, or a person's job search, and whether it is public is a
+   * property of the deployment rather than of this file. The **server** decides
+   * — `TERA_MARKERS_ACCESS`, which defaults to `members` so that a self-hoster
+   * who wires real data up gets the safe answer without having chosen it — and
+   * this flag only reports what the server already said. Setting it true here
+   * against a server set to `members` earns a 401 and nothing else.
+   */
+  liveMarkers: boolean;
   /** Debug overlays: frame time, draw calls, chapter poses, the solar readout. */
   debug: boolean;
 }
@@ -143,7 +172,12 @@ export function capabilitiesFor(tier: Tier): Capabilities {
     enterOffice: true,
     officeDepth: tier === "anon" ? "public" : "full",
     timeControl: tier === "god",
-    liveData: tier !== "anon",
+    liveEnvironment: true,
+    // Asked for by everyone; granted by the server or not. See the field's own
+    // note — the client requesting a marker set it may not have is a 401, which
+    // is the correct place for that decision to be enforced and the only place
+    // it can be enforced at all.
+    liveMarkers: true,
     debug: tier === "god",
   };
 }

src/main.ts

@@ -289,13 +289,18 @@ async function mountCity(id: string) {
    * The sky and the traffic are per-city and are chosen here, before the build,
    * because `flights` is fixed at scene construction.
    *
-   * Two gates, and both are needed. `can.liveData` is the tier — an anonymous
-   * visitor must not be firing requests the server is going to refuse — and
-   * `feeds` is the deployment, which is what stops a member on the ordinary
-   * box, where every source is `none`, from polling two endpoints forever for
-   * a 404. The old code gated the flights on `liveData`, the markers flag,
-   * which is a different feed entirely: a deployment with a real ADS-B receiver
-   * and no marker file flew the simulator.
+   * Still two gates, but only one of them is about the visitor now.
+   *
+   * `can.liveEnvironment` is true for everybody — the reasoning is in
+   * `access.ts`, and it comes down to the sky not being a thing an account can
+   * grant you. What remains load-bearing is `feeds`, the *deployment*: it is
+   * what stops the ordinary box, where every source is `none`, from polling two
+   * endpoints forever for a 404 on every tab that is open.
+   *
+   * The other half of the old comment is still worth keeping, because it was a
+   * real bug: the flights used to be gated on the *markers* flag, which is a
+   * different feed entirely, so a deployment with a real ADS-B receiver and no
+   * marker file flew the simulator.
    */
   const region = regionOf(entry.city);
   // The hand-authored corridors for *this* city. `SAMPLE_ROUTES` was passed
@@ -303,7 +308,7 @@ async function mountCity(id: string) {
   // entire sky projected ~590 km off the world and rendered as nothing at all.
   const routes = sampleRoutesFor(entry.city);
   const traffic =
-    access.can.liveData && access.feeds?.flights ? tera.flights(region, routes) : null;
+    access.can.liveEnvironment && access.feeds?.flights ? tera.flights(region, routes) : null;
   cityFlights = traffic;
 
   const handle = await createScene(stage, {
@@ -342,7 +347,7 @@ async function mountCity(id: string) {
    * replaces it when it lands.
    */
   weatherWatch =
-    access.can.liveData && access.feeds?.weather
+    access.can.liveEnvironment && access.feeds?.weather
       ? tera.watchWeather(entry.city.center, () => {
           updateSun();
           renderSource();
@@ -1434,7 +1439,7 @@ async function boot() {
   // whether this visitor may ask, `feeds` says whether there is anything to
   // ask. A box with `markers: "none"` serves the public empty body to everyone,
   // so the request buys a round trip and lands on the same sample set.
-  if (access.can.liveData && access.feeds?.markers) {
+  if (access.can.liveMarkers && access.feeds?.markers) {
     try {
       const feed = await tera.markers();
       markers = feed.value;