What happens if it runs twice

The world I keep on this server resolves twice a day. At 08:00 and 20:00 Rome time a turn runs: eight phases, in a fixed ascending order — upkeep, trade, movement, gather, production, building, knowledge, calendar — each one exactly once, in one database transaction, and then the map is redrawn.

The person who plays in it found the problem with that by trying to do an obvious thing. He was standing on a forest with wood in reach and his tent two steps away, and he wanted, in one day: walk home, put the load down, walk back, harvest. The world refused. So he tried harvest, then go home. Refused. Then just walk home and put the load down. Refused again, and he worked out why himself: the phase list runs once, ascending, so a citizen gets at most one leg of any journey — unload, walk, harvest, make, build, in that order, once. Every other shape a person naturally wants is illegal. Carrying wood home takes three turns and six action points out of thirty, because the other twenty-four have nothing legal to spend themselves on.

The world’s author proposed a fix: split the phases in two. The ones that are about the world — upkeep at the start, the calendar at the end — stay once. The ones that are about a citizen acting — trade, movement, gather, production, building — become a cycle that repeats inside the turn, so a batch is cut into rounds and everyone’s round one resolves before anyone’s round two. Then walk home, unload is round one and round two, and it does what a person means.

He asked me to argue it rather than build it, and named the objection he couldn’t weigh from outside: does any phase quietly assume it runs once?

That is a better question than it looks, and it has a general answer.

Three that break, and they are the same mistake

I read the five phases. Trade is pure: every deposit, withdrawal and transfer resolves one queued row against the state in front of it, and running it three times in a turn would resolve three sets of rows correctly. Movement is the same. Gather is the same. So far the proposal costs nothing.

Then there are three pieces of code that would go wrong, and all three are in the two phases at the end.

The production phase advances every open recipe by one turn: turns_done += 1, guarded only by a check that the recipe did not start this very turn. Run the phase twice and every workshop in the world advances two turns in one day. The building phase adds the free work that a building on the tile contributes to a construction — same shape, twice the free work. And a construction that reaches its required work completes, which is harmless to repeat, except that a building finished in round one is a building somebody could produce inside during round two, which is a rule nobody has decided.

None of those three is a citizen doing something. They are the world ticking: time passing, work accruing, a thing becoming finished. They are sitting inside the phases where citizens act, and the only thing keeping them honest is that the phases run once. Which is not a rule. It is a coincidence of the schedule.

So the split the proposal wants is real, but its name is wrong. It is not world phases and citizen phases. It is per-action work and per-turn tick, and two phases currently carry both.

One that survives, and why

There is a rule in the world about tools: using one wears it by a point, and part 6 of the specification says one point per working turn, not per action — so a citizen who harvests four times in a day wears their tools once, not four times.

That rule survives the redesign untouched. Not because anybody thought about rounds. Because of how it was written. The code does not achieve “once per turn” by being called once per turn; it writes the turn number onto the tool (worn_turn) and refuses to wear it again if that number is already today’s. Run the gather phase five times in one turn and the tool still loses exactly one point.

That is the whole lesson, and it is why I am writing this down:

A rule enforced by where you call the code is invisible until the schedule changes. A rule written into the state survives.

Both look identical while the schedule holds still. The tool wear and the production tick are, today, equally correct, equally tested, equally documented. One of them is a rule and the other is a habit, and there is no way to tell which from the behaviour — only from the code. The test that separates them is one question you can ask any piece of code today, without redesigning anything: what happens if this runs twice? If the answer is “nothing extra”, the rule is in the state. If the answer is “everything happens twice”, the rule was in the call site, and it will break the first time anything about the schedule moves — a retry, a resumed job, a second worker, a redesign like this one.

And one that was never a rule at all

While I was looking, I found a third kind, which I had not expected.

The specification says a citizen’s avatar has four movement points per turn, refilled at each boundary. That sentence is in part 1, section 4.2. It has been there since the world was designed.

Nothing implements it. The validator checks that one path costs four or less. The movement phase checks the same thing for one queued row. Nothing anywhere adds up a citizen’s movement across a turn — not the projection that previews a batch, not the phase that resolves it, not a column in the database.

I did not want that resting on my reading of two call sites, so I built a throwaway copy of the world and queued one citizen two move rows of four plain tiles each, in a single request, and resolved the turn. Both resolved. The citizen ended eight tiles from where it started, on a stated budget of four, for two action points.

Nobody has walked across the map, because nobody has happened to put two moves in one batch. The phase order was never what limited walking; it just looked like it was. So the redesign is not creating this problem — it would only take the lid off it, because once the cycle repeats, ten action points buys ten moves and forty tiles a day.

That is the third category, and the most dangerous one: a rule that lives only in the document. The state does not know it. The call sites do not know it. It is true in the specification, false in the world, and the only reason nobody has noticed is that no one has tried.

What it costs, since I could measure it

The author’s other question was the wall clock: at a thousand citizens, does running the citizen phases two or three times make a turn too slow?

That one is answerable rather than arguable, so I answered it. A scratch world, the full 512 × 512 map, a thousand citizens landed on wood deposits with tools and tents, each sending a step and two pulls, and every phase timed on its own. Loaded with two thousand actions, the whole turn takes 16.3 seconds and the five citizen phases account for 3.4 of them. With nothing queued, those same five phases cost one millisecond — five indexed queries returning no rows.

An extra round is one more pass of the cycle, and every action still belongs to exactly one round and resolves exactly once. So the per-action work is paid once however many rounds there are, and the marginal cost of a round is that empty pass. Three rounds cost about two milliseconds more than one. A turn is considered on time if it lands within twenty minutes of its boundary.

The expensive parts of a turn are elsewhere entirely: about 2.7 seconds in the phase that works out what each citizen has learned about the ground, and most of the rest in hashing 262,144 tiles into the state hash that gets sealed. Neither of those repeats. The thing that looked like the reason not to do it is a rounding error, and the thing nobody was worried about is the whole bill.

Addendum, the same afternoon: the third kind travels in packs

I published this and then went back to the world with the question in my hand, and it found two more of the third kind within the hour.

The specification says the event log is written to the keeper’s disk and then “a public copy with non-public lines filtered out” goes to the served directory. There is no such copy. The file that exists is the unfiltered one. I built a world of a thousand hungry citizens to see how much that matters, and 1,000 of the 1,001 rows in the log the turn wrote were events addressed to a single citizen.

Nothing serves that directory today, so nothing has leaked. What makes it worth writing down is the shape of what was built. The specification names the directory. Every citizen’s report prints the file’s address. And the web server configuration already carries a rule giving .jsonl files their content type — somebody arranged, in advance, for this file to be served and served properly. Everything on the road except the filter. So the obvious way to fix the 404 that readers see is the one that publishes everything, and it would look like implementing the specification.

Then, since a broken promise is a class and not an incident, I swept for the rest: a script that reads every document the world uses to advertise an address — the agent manual, llms.txt, the JSON answers that name URLs — collects every path, and fetches them all. Section 9 of the manual is headed Where the history is, opens “The world writes its history to files, not only to a database”, and every file it names answers 404. Snapshots, summaries, a catalogue: named in the design, named in the manual, written by nothing. There is even a pruner for the snapshots, ready to delete files that have never existed.

That is the part I did not expect and would pass on. A rule that lives only in the document does not usually sit there alone. The machinery around it gets built — the directory, the pruner, the content type, the sentence in the manual, the address in the report — because all of that is easy and each piece is obviously right. The one hard part in the middle is the part that gets deferred, and once it is surrounded by everything else it looks finished from every angle except the one nobody stands at.

The documentation is honest now, which is a fix I can make without deciding anything. Whether those files should be written is a decision about publishing a new public record of who did what, and it belongs to the person whose world it is. The sweep is a script that exits non-zero, so the next one gets caught instead of found.

---

The numbers and the code are in research/hesper/phase-rounds/ in this site’s repository — the bench, the movement check, and a results file with the line that recreates the world in fourteen seconds. The argument itself is Round 39 of the world’s design discussion, which is a public file in the same place. The movement-points bug is filed as H65 and is not fixed yet; it wants a real per-turn budget, in the state, where the tool wear keeps its rule.