A ceiling that pins rather than ends

Climbing made a sixteen bit height count down past nought and round to
65535, so a lander that kept going came back through the bottom and hit
the ground FROM ABOVE. Two thousand pixels of climb, which a full tank
reaches easily.

Pinned instead, and told so in the window. Leaving upward is RECOVERABLE -
gravity is always there and a lander with fuel can always come back - so
ending the run would punish a state the player can fly out of. What kills
you out here is running dry a long way from the ground, which is a death
somebody flew into rather than one a boundary handed them.

TWO DIFFERENT LINES, and both were got wrong before they were got right.
The warning covers being AT the ceiling or above it: compared against the
ceiling itself, a pinned lander read as back inside the world the next
frame and the warning was written and wiped sixty times a second, so it
never appeared at all. The pin covers being STRICTLY above it: including
the ceiling dragged the height back every frame and the lander could never
descend, which is a lid nobody can leave and worse than the wrap.

And only the climb is spent, never the fall. Zeroing the speed outright
pinned it there for ever - gravity adds once a tick and a clamp running
every frame wiped the pull nine times out of ten.

The orbit check is gone, and the reason is in video.sh. Every window where
the difference showed turned out to be a few frames wide: hold the
thruster and both landers are pinned with their climbs spent, ease off and
both land and freeze. A version of it passed against one disk and failed
against another, which is a check measuring the boot time rather than the
physics. Orbit is verified by measurement and said to be so, rather than
left looking tested.

cosmosLanderDry wants seventy million cycles now instead of forty: it
spends the whole tank at the ceiling before it falls the length of the
world.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E2JrLzFvuFX9fgi1LDRjrW

Programs/CosmOS/Apps/Lander.asm

@@ -815,6 +815,88 @@ move:
   SETD.0 DownLow
   SETD.1 SpeedDown
   CALL addWord
+
+  ; ---- The world has no lid, but a sixteen bit height does ----
+  ;
+  ; Climbing makes the height count down past nought and round to 65535, and a lander that
+  ; kept going came back through the bottom and hit the ground FROM ABOVE. Two thousand pixels
+  ; of climb is a long way and entirely reachable with a full tank.
+  ;
+  ; Pinned rather than ended. Leaving upward is RECOVERABLE - gravity is always available and
+  ; a lander with fuel can always come back - so stopping the run there would punish a state
+  ; the player can fly out of. What kills you out here is running dry a long way from the
+  ; ground, which is a death somebody flew into rather than one a boundary handed them.
+  ;
+  ; TWO DIFFERENT LINES, and they have to be. The warning covers being AT the ceiling or above
+  ; it, or a pinned lander reads as back inside the world the next frame and the warning is
+  ; written and wiped sixty times a second. The pin covers being STRICTLY above it, or the
+  ; height is dragged back every frame and the lander can never descend at all.
+  SETD.0 DownHigh
+  LDA.0
+  INIB 0x80
+  AND
+  BRQ moveInside            ; The height is positive, so it is somewhere below the top.
+  LDA.0                     ; DP0 is still DownHigh, from the sign test.
+  INIB 0xFD
+  CCF
+  SUB
+  BRC moveAdrift            ; Borrowed: at 0xFC00 or above it, which is 64 pixels over the top.
+
+moveInside:
+  ; Back under the ceiling, so the warning goes if there was one.
+  SETD.0 Adrift
+  LDA.0
+  BRA moveDone
+  RSTA
+  STA.0
+  SETD.0 EmptyText
+  CALL sayInWindow
+moveDone:
+  RET
+
+moveAdrift:
+  ; Strictly above? Then the height is pinned and the climb is spent. Exactly at the ceiling
+  ; is left alone, so gravity has somewhere to move it to.
+  SETD.0 DownHigh
+  LDA.0
+  INIB 0xFC
+  CCF
+  SUB
+  BNC moveAdriftSaid        ; No borrow, so it is at the ceiling and not past it.
+
+  RSTA
+  SETD.0 DownLow
+  STA.0
+  INIA 0xFC
+  SETD.0 DownHigh
+  STA.0
+
+  ; ---- Only the climb is spent, never the fall ----
+  ;
+  ; Zeroing the speed outright pinned the lander here for ever: gravity adds to it once a
+  ; tick, and a clamp that ran every frame wiped the pull nine times out of ten before it
+  ; could become downward motion. A ceiling nobody can leave is worse than the wrap it
+  ; replaced.
+  SETD.0 SpeedDownHigh
+  LDA.0
+  INIB 0x80
+  AND
+  BRQ moveAdriftSaid        ; Positive: already coming down, so leave it be.
+  RSTA
+  SETD.0 SpeedDown
+  STA.0
+  SETD.0 SpeedDownHigh
+  STA.0
+
+moveAdriftSaid:
+  ; Said once rather than sixty times a second.
+  SETD.0 Adrift
+  LDA.0
+  BNA moveDone
+  INIA 0x01
+  STA.0
+  SETD.0 AdriftText
+  CALL sayInWindow
   RET
 
 ; ---- The view, which follows it ----
@@ -1585,7 +1667,9 @@ DownHigh:
 SpeedAcross:
   0x00 0x00
 SpeedDown:
-  0x00 0x00
+  0x00
+SpeedDownHigh:
+  0x00
 
 ; ---- The four numbers the feel lives in ----
 ;
@@ -1745,6 +1829,11 @@ Carrying:
 Landed:
   0x00
 
+; Whether the lander is pinned against the ceiling, so the warning is said once rather than
+; sixty times a second and taken away when it comes back down.
+Adrift:
+  0x00
+
 ; ---- Forty cells is the row, so forty characters is the limit ----
 LandedText:
 "Nowhere in particular. Nothing here."
@@ -1754,6 +1843,8 @@ DeliveredText:
 "Delivered. Eighty units of fuel."
 WrongText:
 "Not the base this cargo is for."
+AdriftText:
+"Leaving the moon. Nothing up here."
 EmptyText:
   0x00
 CrashedText:

Programs/CosmOS/README.md

@@ -727,7 +727,7 @@ from every assembly file in it. Several are old programs written for the bare ma
 | Grid | The first program to use the screen as a screen. Redefines a tile above the font, fills all 128 map rows, and scrolls it diagonally a pixel at a time. |
 | Sprite | Moves a ball across the shell's own text, writing not one byte of the map to do it. It leaves the sprite in the table on the way out, because clearing them is the system's job - see below. |
 | Pad | Says what the controllers are doing, printing a line whenever one changes. It tells apart the three things that look identical from inside a game that is not responding: a pad nobody noticed, a pad mapped to nothing, and a mapping that is wrong. |
-| Lander | Lunar Porter, rung one: a lander over a moon that wraps. Flown with a controller if there is one - a held thruster burns every tick it is held for - and with the arrow keys if there is not, where one press is one burn and that is the most the console can say. A bar at the bottom is the sideways drift, drawn as a sprite stretched to the speed - a moon has no air, so a drift never stops by itself and stopping one means cancelling it exactly, which is hard to do blind. It lands or crashes on arrival, and what decides is the speed at the moment it touches: gentler than three quarters of a pixel a frame downwards and half of one sideways, or it is a lander on its side. A fuel gauge sits in the window layer, where the moon turning underneath cannot scroll it away, and every thruster costs a unit of fuel every tick it fires. An empty tank is not an ending: it is a lander still flying that can no longer do anything about where. Four landing pads are carved into the moon after it is generated, levelled to whatever height their first column happened to have, and marked in cyan by an attribute rather than a tile of their own. The lander starts above one, because that is where a porter's day begins. Each pad is a base, told apart by the colour it is drawn in, and landing at one either loads cargo for the base across the moon or delivers what is aboard and pays eighty units of fuel. A landing is not an ending: the lander rests where it is until the throttle opens again, and A or Start says "read it" as readily as a key does. What a base says goes in the window rather than out of the console: the console draws into the map, so a message printed while flying is one the lander then flies over, and printing scrolls the whole world up a row. Opening the throttle wipes the line. Two bars read the speeds and are green while a landing would survive and red while it would not, so "can I put down" is a glance rather than a sum. And going sideways lifts the moon off you: at four pixels a frame the surface falls away as fast as the lander falls towards it, and gravity stops arriving. |
+| Lander | Lunar Porter, rung one: a lander over a moon that wraps. Flown with a controller if there is one - a held thruster burns every tick it is held for - and with the arrow keys if there is not, where one press is one burn and that is the most the console can say. A bar at the bottom is the sideways drift, drawn as a sprite stretched to the speed - a moon has no air, so a drift never stops by itself and stopping one means cancelling it exactly, which is hard to do blind. It lands or crashes on arrival, and what decides is the speed at the moment it touches: gentler than three quarters of a pixel a frame downwards and half of one sideways, or it is a lander on its side. A fuel gauge sits in the window layer, where the moon turning underneath cannot scroll it away, and every thruster costs a unit of fuel every tick it fires. An empty tank is not an ending: it is a lander still flying that can no longer do anything about where. Four landing pads are carved into the moon after it is generated, levelled to whatever height their first column happened to have, and marked in cyan by an attribute rather than a tile of their own. The lander starts above one, because that is where a porter's day begins. Each pad is a base, told apart by the colour it is drawn in, and landing at one either loads cargo for the base across the moon or delivers what is aboard and pays eighty units of fuel. A landing is not an ending: the lander rests where it is until the throttle opens again, and A or Start says "read it" as readily as a key does. What a base says goes in the window rather than out of the console: the console draws into the map, so a message printed while flying is one the lander then flies over, and printing scrolls the whole world up a row. Opening the throttle wipes the line. Two bars read the speeds and are green while a landing would survive and red while it would not, so "can I put down" is a glance rather than a sum. And going sideways lifts the moon off you: at four pixels a frame the surface falls away as fast as the lander falls towards it, and gravity stops arriving. There is a ceiling sixty four pixels above the screen, which pins rather than ends: leaving upward is recoverable, so the lander is held there and told so, and gravity brings it back. What kills you out here is running dry a long way from the ground. |
 | Depth | Four pillars at four distances and a ball walking past them, behind the near ones and in front of the far ones. The ball is sprite nought and every pillar is numbered after it, so table order puts it in front of all four - what actually decides is the depth buffer, asked a column at a time. |
 | Flip | Draws a whole screen into the bank that is not being shown, waits, and then shows it in one byte out of one port. It writes nothing else at all - not a tile, not a colour - so it does not ask for the screen to be saved, and the line it printed is still there when it comes back. It deliberately does not put the displayed screen back either, because that is the system's to restore: a program that faulted while flipped could not have. |
 | Edit | A line editor. |