A retro thruster, at half the strength of the one that lifts

Arresting a rise meant a sideways burn and a wait for the orbit to come
back round. That is how a rendezvous really is flown and it is a lot to
ask of somebody who has not flown one before, so down now makes the
correction directly.

HALF THE STRENGTH, deliberately: one sixteenth a tick against two, which
is exactly gravity's own step. So it can stop a climb and it can hurry a
descent, and it can never turn a landing approach into a crash faster
than simply letting go would - the cheap way out of a mistake stays the
expensive one. Four against eight on a keyboard, which is the same ratio.

It does NOTHING to a lander on the ground, and that guard is load
bearing rather than tidy. touchdown has already had its say and returns
early once a lander is down, so there is nothing underneath to stop it
and no crash to say it happened: measured without the guard, holding it
drives the lander clean off the picture and spends a fifth of the tank
doing it.

---- And the fixture that hid all of that ----

The first version of the landed check passed just as happily with the
guard deleted, and the reason is worth writing down. A lander that has
landed WAITS to be told its message has been read, and the keyboard
fixture pads with NULs, which are not keys. So the program sat in that
loop for ever and the picture was frozen at the moment of touchdown -
every thruster held afterwards did nothing, which reads exactly like a
working guard. The pad now presses A to get past the wait before the
check tests anything, and both the row AND the fuel are read, because an
engine that fired and moved nothing would keep the row and one that moved
the lander for free would keep the fuel.

The altitude bar check upstream leans on that same freeze for its stable
end, and its comment said "stays landed" when what it means is "is not
running any more". Corrected, because that is the sort of comment that
sends the next person looking in the wrong place.

Programs/CosmOS/Apps/Lander.asm

@@ -681,6 +681,11 @@ readControls:
   SUB
   BRQ burnUp
   LDA.1
+  INIB 0x81                 ; Down
+  CCF
+  SUB
+  BRQ burnDown
+  LDA.1
   INIB 0x82                 ; Left
   CCF
   SUB
@@ -704,6 +709,16 @@ burnUp:
   SETD.1 ThrustUp
   CALL addWord
   RET
+burnDown:
+  ; The same rule the pad's retro thruster has: nothing to push away from on the ground.
+  SETD.0 Landed
+  LDA.0
+  BNA burnDownDone
+  SETD.0 SpeedDown
+  SETD.1 ThrustDown
+  CALL addWord
+burnDownDone:
+  RET
 burnLeft:
   SETD.0 SpeedAcross
   SETD.1 ThrustLeft
@@ -875,6 +890,31 @@ fallAlreadyUp:
   SETD.1 PadUp
   CALL addWord
 fallNotUp:
+  ; ---- And down, at half the strength of up ----
+  ;
+  ; Arresting a rise took a sideways burn and a wait for the orbit to come back round, which is
+  ; how a rendezvous is really flown and is a lot to ask of somebody who has not flown one
+  ; before. A retro thruster makes the same correction directly.
+  ;
+  ; HALF THE STRENGTH, deliberately. Up is two sixteenths a tick and this is one, which is the
+  ; same as gravity - so it can stop a climb and it can hurry a descent, and it can never turn
+  ; a landing approach into a crash faster than simply letting go would. The cheap way out of
+  ; a mistake stays the expensive one.
+  SETD.0 Landed
+  LDA.0
+  BNA fallNotDown           ; Sitting on the ground, where there is no down to go.
+  SETD.0 Held
+  LDA.0
+  INIB 0x04                 ; Down
+  AND
+  BRQ fallNotDown
+  CALL takeFuel
+  BRQ fallNotDown           ; Nothing in the tank, so nothing out of the engine.
+  SETD.0 SpeedDown
+  SETD.1 PadDown
+  CALL addWord
+fallNotDown:
+
   SETD.0 Held
   LDA.0
   INIB 0x02                 ; Left
@@ -2490,6 +2530,8 @@ FallTick:
 ; A press on a machine with no pad, which has to be a whole burn because it happens once.
 ThrustUp:
   0xF8 0xFF                 ; Eight sixteenths upwards, which is minus eight.
+ThrustDown:
+  0x04 0x00                 ; Four down, which is half of the eight that lifts.
 ThrustLeft:
   0xFC 0xFF                 ; Four to the left.
 ThrustRight:
@@ -2508,6 +2550,8 @@ PadUp:
 ; ONE, not two. There is no air on a moon, so nothing slows a drift but the opposite thruster
 ; and stopping means cancelling the velocity exactly. At two a tick the smallest correction
 ; was twice as big as it needed to be and overshooting was the normal outcome.
+PadDown:
+  0x01 0x00                 ; Plus one: half of up, and exactly gravity's own step.
 PadLeft:
   0xFF 0xFF                 ; Minus one.
 PadRight: