# Peer locality and territories

> **In one sentence:** the cockpit places a peer according to evidence about the path—not according to its name, color, transport brand, or our hopes.

![The Cursors territorial netwalk separates same-device, LAN, direct, relay, mailbox, storage, trust, and unknown machinery](images/locality-territories.svg)

The central view is a **territorial netwalk**, not a social graph and not a map of physical people. Machinery is kept in stable operational regions. A live transport wire joins the region supported by the observer’s evidence. If the evidence is incomplete, the peer goes into **Topology Unknown**.

This matters because “peer,” “nearby,” “direct,” “trusted,” and “authorized” are five different statements.

## The six peer labels

| Label | Minimum evidence | What it does *not* prove |
|---|---|---|
| **Device-local** | loopback, LocalStorage, BroadcastChannel, or an explicit same-device runtime scope | that the local page is enrolled or authorized |
| **LAN-local** | private, link-local, IPv6 unique-local, mDNS, or an explicit LAN observer | identity, physical proximity, or safety |
| **Internet-direct** | an observed native public TCP/µTP peer socket, or an observer explicitly reporting a direct path | absence of NAT, decryption rights, or cursor authority |
| **Relayed-remote** | explicit TURN, WebSocket, edge, or other relay mediation | who controls either endpoint |
| **Mailbox-mediated** | explicit store-and-forward through a named Cursors or external mailbox | simultaneity, freshness, or authority of the sender |
| **Topology unknown** | a carrier exists but locality evidence is hidden or insufficient | nothing; unknown is intentionally not rounded up to “direct” |

Carrier-grade NAT space (`100.64.0.0/10`) is not classified as LAN. WebRTC by itself is not classified as direct: browsers may conceal candidates with mDNS, and a WebRTC session may use loopback, LAN, direct Internet, or TURN.

## Try the live instruments

- [Inspect this device-local Self](#cursors-inspect:self%3Alocal)
- [Inspect the same-device fabric](#cursors-inspect:fabric%3Alocal)
- [Inspect the unconfigured LAN fabric](#cursors-inspect:fabric%3Alan)
- [Inspect the direct native fabric](#cursors-inspect:fabric%3Anative)
- [Inspect the optional relay fabric](#cursors-inspect:fabric%3Arelay)
- [Inspect the meeting mailbox](#cursors-inspect:mailbox%3Ameeting)

These links move the real cockpit and open its inspection drawer. No simulated peer is silently counted as live.

## How the classifier decides

The order is deliberate:

1. Preserve a valid locality observation supplied by the connected native or mailbox runtime.
2. Prefer explicit mailbox mediation over endpoint guesses.
3. Prefer explicit relay mediation over endpoint guesses.
4. Recognize loopback and declared same-device carriers.
5. Recognize private/link-local/unique-local/mDNS LAN evidence.
6. Recognize an explicitly direct path, or a public endpoint on an observed native TCP/µTP socket.
7. Otherwise return **unknown**, with the reason attached.

The trace table, canvas node, and inspection drawer show the same label and evidence. Full endpoints are not exposed merely to make the diagram more impressive; the native bridge classifies before redaction.

## What the territories mean

The shaded regions are operational backplanes:

- **Trust / Signed History** holds cursor history, grants, DHT heads, admission, and release succession.
- **Device-local Body** contains this runtime, its local curve/mailbox, observers, and same-device carrier.
- **LAN-local** remains visibly empty or unconfigured until a LAN listener or private endpoint exists.
- **Further / Direct** holds observed public peer sessions and their browser/native fabric machinery.
- **Remote / Relay** holds explicit intermediaries such as TURN or an opt-in Cloudflare WebSocket edge.
- **Mailbox-mediated** holds addressed store-and-forward meeting machinery.
- **Storage / Resurrection** holds encrypted blocks and operational journals.
- **Topology Unknown** is a first-class region, not an error swept out of sight.

The background lines are bus traces. Dashed routes are designed relationships. A moving photon appears only when the current observer reports non-zero activity.

## Security boundary

Locality is routing evidence. It never grants:

- permission to decrypt a swarm;
- permission to continue a cursor;
- permission to write a mailbox;
- permission to cause an external effect;
- confidence that a person—not automation—controls the endpoint.

Those decisions require identity proofs, signed admission, capabilities, replay defense, and application policy. Read [Capabilities](capabilities.md), [Admission and Human Presence](admission-identity.md), and [Cryptofabrics](cryptofabrics.md) next.