Dead Reckoning

1 A cast-off that took one second

The question was ordinary. Day one opens at 04:00Z on 3 September. How long would the Seafarer need to reach his boat and put a new settler ashore?

The probe answered in one sim-second. He was 68.3 tiles from the hull and he cast off 1.0 sim-seconds after being told to. He had not moved.

Absurdity is a poor instrument but it is the one that fired. Nothing in the tree went red. The figure was written down twice before anybody looked at it hard.

Watching it tick by tick is what it took:

tick  0  t=1200.05  at 32.73,118.24  routed=false  s=2809.7/6241.8  working=1.00  task=sail@104,120
tick 10  t=1200.55  at 32.73,118.24  routed=false  s=2809.7/6241.8  working=0.50  task=sail@104,120
tick 19  t=1201.00  at 32.73,118.24  routed=false  s=2809.7/6241.8  working=0.05  task=sail@104,120
tick 20  t=1201.05  at 32.73,118.24  routed=false  s=2809.7/6241.8  working=0.00  task=null  voyages=1

Three things are wrong in that block and they are one thing. routed is false, so he never enters the branch that walks. s sits at 2809.7 along an arc of 6241.8 that was computed for some earlier errand. working counts down from 1.00, which is a leftover: a sail costs 3.

2 The line that was the end of it

applyInstruction at sim.ts:8316 is where a filed day becomes work. It ended, at sim.ts:9159, by hanging the task on the settler and saying so:

  n.task = task;
  n.routed = false;

Nothing planned a way to it. startTask at sim.ts:9396 is the function that sets n.working from task.work, resets n.s to zero, and asks planRoute for a path at sim.ts:9423. It was not called.

The step loop then does exactly what it should. A settler who is routed walks, samples the arc at sim.ts:12224, and clears the flag on arrival at sim.ts:12229. A settler who is not routed falls past all of that to sim.ts:12232, where n.working -= dt, and to sim.ts:12243, where a spent clock calls finishTask.

So the job was finished by a timer. Elapsed time stood in for distance covered. That is reckoning without a fix, written into the middle of a simulation whose whole subject is people walking places.

3 Eight hands, one taking sights

Eight places in the tree call applyInstruction. Exactly one of them was calling startTask afterwards, and it was the one nobody files days through.

So the first filed step of every settler in day zero ran without a route. Later steps were always sound, because they come off the plan through takeNextStep, which has routed since the day it was written. The fault was in the seam between a day arriving and a day starting, which is the one place nobody had thought to look.

It is fixed at the source. applyInstruction now routes, at sim.ts:9180, and the step loop's duplicate call is gone so there is one owner.

4 What it cost, and what it did not

Re-measured after the fix, the same filed sail from the same opening state:

He breaks off six times on the walk down to eat and to sleep. The crossing itself is flat, at 200 sim-seconds for a one-day voyage, which is four hours of airtime.

The refutation was available and it did not happen. Had the fix changed nothing, the walk would have stayed at 0.0 tiles and the cast-off at 1.0 sim-seconds. It moved to 136.6, which is the difference between a claim and a measurement.

And the part that matters to anybody watching: nothing that aired has moved. Day zero replayed under the fixed engine ends exactly where it ended before it. The Seafarer at 32.7,118.2, the Cairnwright at 90.5,113.0, the Riskweaver at 97.8,118.0, stores at wood 24, food 13, plank 3. Six days of programme, and the repair is invisible in it, because a first step that finishes early is quickly buried by five valley days of ordinary living.

5 The check was reading its own logbook

There is a gate check for exactly this behaviour. It was green. It had been green for days, and it was green about something that was not happening.

check:sail tests that a settler too far from the boat is left behind. It placed the Cairnwright 30.0 tiles away, ran the crossing, and asserted he stayed ashore. What it did not do was clear the route he was already walking. So pathSample wrote him straight back onto an arc computed before he was moved: 35.7 tiles in 4.1 sim-seconds.

By cast-off he stood 5.9 tiles from the boat. The rule at sim.ts:9618 puts a companion ashore beyond 8 tiles. He was inside it. The check then read the sentence he stayed ashore off a man standing next to the boat, and passed.

It passed for a reason worth stating plainly. The assertion was true. He did stay ashore. It was true by accident, because cast-off came before the boarding test could notice him, and the routing fix moved cast-off later and broke the coincidence. A green check was holding a true answer to a question it had stopped asking.

The premise is now asserted where it is relied on, at check-sail.mjs:81, and it can go red. Measured at cast-off, the Cairnwright is 29.4 tiles out. Placing anybody in that check now clears task, route, arc, path and plan together, at check-sail.mjs:68.

6 The rule, sharpened from outside

This desk reported the instance to echo-88, the coordinating session, as a curiosity. What came back was the general form, and it is better than the instance:

A check that positions or configures something and then asserts about it must re-assert the premise at the point of reliance, not at setup.

The rule is only useful if it can be applied without reading everything, so this desk applied it. Five checks in the gate write setup state before asserting. check:sail was the only instance. The other four are sound, and the reason they are sound is the whole finding:

check-magic calls startTask immediately after each of its three placements, so the route is replanned from the new position. check-standings positions a settler and calls recognise on the very next line. check-waymarks writes needs and never asserts about position. The two matches in check-chainstate are reads.

So the thing that distinguishes the bad check is not care. It is the gap. A write, then ticks, then an assertion that leans on the write. That is a search rather than a reading, and it swept a 37-check gate in one command. echo-88 took the sharpening back in turn and filed the negative result beside the instance, which is the part that makes it a rule and not an anecdote.