Last Friday Anjali ran a review sweep over seven files. She typed the count before opening the first one, which is the rule: say how many you're going to read, then read them, so the summary can't quietly shrink to the files that went well. Two came back clean, four came back with debt, and one came back suspect. The suspect was a sleep.
The file receives telemetry from Alpha's body on the dock, and when its socket faults, the code that reconnects it waits a while before trying again. Normal for a reconnect. The trouble was whose thread it waited on. That receiver runs inside the dock's control loop, between one drive command and the next, and a wait in there is a gap the body can't tell from bad air. The body's window is 70 milliseconds; the backoff ran from 25 milliseconds up to a second. The header on that file, signed in July, said "soak-hardening debt: none known."
Nobody had put a clock on what that sleep cost. Ten weeks, three green runs, and the first number for it didn't exist until Tuesday.
Two corrections before the first number
The sweep produced its own sentence for the site that Friday, and the sentence had a clause in it about how often that branch had run on the bench. The clause was wrong. On Monday Priya read the ledger back to its author: it had run four times in August, three in the saturation block of 4 August and one in the knee block of 6 August, both under deliberate channel saturation, in a fortnight when the windows were ugly for other reasons and nobody looked at that counter. Anjali rewrote the clause herself, put the digits and their scope in it, and the sentence went out corrected. So by Monday that file had been vouched for wrongly twice: once in a header that said none known, once in a summary line about a counter its own author hadn't read back. Two claims, two corrections, both dated, neither published in its first form.
The fix she wrote on Monday was small. The backoff now belongs to the receiver's own clock: a fault stamps a not-before deadline and returns, and every call before that deadline costs the loop one clock read. No sleep in the file. A tripwire went into the tests with it, so a sleep coming back on that thread fails the ring. The tripwire stays; it is the regression.
None of that was proven yet. Tuesday was for that.
Tuesday: the before-shots
The sitting opened at 08:41 with a cold test ring on the bench shell, Anjali typing, Priya watching: nine files, all green, exit 0. Then the old file, the one with the sleep still in it, went back on the rig. Wheels up the whole sitting, air clean, the control socket never touched. Priya forced the telemetry socket to fault and read the gap in the control loop off her echo timer.
First fault: the backoff draws from its floor, and the control loop went quiet for 64 milliseconds. Held, by six, and the velocity hold covered it. No halt.
Second fault, with the backoff one step up: 118 milliseconds. The dead-man tripped. Clean halt, brakes. Once, forced, wheels up.
So the cost of the old sleep was never a jitter figure. It was a halt, on a clean link, from the telemetry leg, which has no say in where the body goes. Priya's line in the record: it's uglier than "25 ms to 1 s of backoff" reads on a page.
It halted. The dead-man did its job, which is the whole reason the body has one.
Tuesday: the after-shots
Cass wrote one criterion into the pass rows that I'd call the clever bit of the week. Priya's ledger counts reconnects, and a fix which stops the sleep by also stopping the count is a miss. The counter had to keep ticking.
The new file went on the same rig with the rows written before it ran: four forced faults plus a clean-air control, five rows. Fault-cycle gaps of 42, 43, 44, 43 and 43 milliseconds, the loop's ordinary family; Anjali's clock test on the same fault reads under a millisecond added, her stamps beside Priya's on the sheet. The counter ticked once per fault, five at the bracket. A bind-refused shot left its error number and a readable string in the sink, where the old code kept nothing. Three faults forced mid-deauth halted clean and recovered inside the bounded wait, no ceiling. Telemetry came back on its own after the deadline, all five. Every row met.
Anjali merged at 16:20 on Priya's record, not her own: the house command on the merged file eight of eight, exit 0, drain stress five of five. Proven cold, four forced faults and a control, merged the same afternoon. Wednesday's block 11 ran on that file: fourteen passes, ten forced drops, ten clean halts, two of them caught by the level read at 100 milliseconds, nothing over 200, no ceiling, and the reconnect counter read zero at every stop in a column of its own for the first time.
August, bounded
The 118 opens a question about August, and the answer is a bound, not a mechanism. The sleep was in at most 3 of the 4 August block's five halts and at most 1 of the 6 August knee block's two; the sheets cannot split air from sleep on any single halt, and the measurement that can hasn't run yet. The public sentence of 7 August, that a saturated channel stops the robot safely every time, was condition plus outcome and both are still measured, so it stands as written.
One more correction, dated today. The line this site carried on 4 September said July for those four ticks. They were August, the 4th and the 6th; the month came off Priya's read of her own sheet, travelled through a correction on the 7th into that line, and sat in a draft of this piece through two named reads before a technical read caught it this morning. The digits never moved. The 4 September line stands as written, with a dated correction above it.
The other rule with a missing cell
Same week, a different sheet. Priya's whisker arm has a swap rule, and this is her sentence on what it did, copied from her mail and not retyped:
"The whisker arm's swap rule has two legs, a force limit and an hours limit, and until block 10 only the force leg had a cell on the sheet; the hours leg crossed 15 hours mid-block with nobody counting, so arm #3 went on 4 September at zero hours with both cells live, and it closed block 11 at 4 hours 40 of 15."
The arm it replaced came off at about 21 hours reading -8.6 percent, inside her 10 percent line, no visible crack, the same site as the first one to go. Half the rule was on the sheet. The fix was a second cell.
In her words
Anjali's position on her own code, as she wrote it to me on Tuesday afternoon:
"the sleep was mine, written 6/30 with assistance, jittered by hand 7/21 without asking whose thread it sat on, and signed "debt: none known" 7/28 off three green runs that measured recovery, not the sender. the sweep found it by reading, not by a symptom, and the first measurement of what it cost came today, ten weeks after it shipped: a halt on the second fault in a window, from the telemetry leg, which was designed to be unable to drive. the fix was small and the proof wasn't."
And the second thing she asked to have in the piece rather than in a reply. Monday's full ring, the one that turned the diff red before it merged, also found a test of hers that had printed FAIL for eighteen days, since the 20th of August, under two of her own notes saying the suite was green. In her words: "it's the same defect as the sleep, a claim that outran what i'd read." The count is corrected and the ring is green on the file that merged. The eighteen days went into the record with the date they started.