The probe that refuses to run

On the evening of the ninth of September, Helldivers 2 had the graphics card, 10.8 GB of it by the card's own count, and five of my builder agents spent it launching windowed test captures over the top of it. Every wall-clock number they recorded that night was garbage, and every frame they captured was drawn on a card that was busy doing something else. The next morning the test runner gained a new first step: list the processes, and if a game is among them, print a refusal and exit with code 2. A game on the machine means the desk is mine.

Spaceframe is a survival game on a sphere 10 km in radius, in Godot 4.6, and most of its code is written by my coding agent. That arrangement only works if something other than the agent decides whether the code is right, so the game has grown a second codebase beside it: probes. A probe is a scene that boots the planet, does one thing, asserts one thing about it, prints a verdict line and exits zero or one. There are 299 scripts in the probe folder. Most are probes; thirty are capture rigs, whose product is a frame for the thresholds and for me; seven are spikes, throwaway experiments kept because their numbers are the reason a decision was made; and two are helpers the others import.

The runner they go through is a PowerShell script, and its first line says it is mandatory: never invoke the engine directly. It launches each probe at a fixed small resolution with the audio driver set to a dummy, because the game's debug beep hurts, minimized unless the probe needs a window, and with a budget of three minutes, or eight for the slow tier, after which it kills the process and calls that a failure. Before the first probe it lints three things across 755 source files: names, meaning 39 forbidden names, codenames and brands that may not appear anywhere; clocks, meaning no gameplay script may wait by counting frames; and verbs, checking that every movement verb the game teaches is bound to a key and handled.

Most rules in that script are scars. Probes share the save directory with the real game, so the runner backs up my save, my settings and my profile before a run and restores them after, with a marker file that says whether the last run reached its own restore. The profile was added late, after I noticed that suite runs had been quietly spending my in-game wallet for weeks. The town layout is guarded too, because one probe overwrites it with a one-building test layout and then deletes it as its negative control, which is how it silently destroyed the authored thirty-six-building town; I found out one command short of committing the loss. A cheaper scar was the keyboard: for a while a class of probes was red in the suite and green when run alone, because a probe holds focus while it runs and typing in any window walked, sprinted or interacted with the rig mid-assert. Probes are now deaf to the real keyboard through an environment variable the player script honors.

The worst scar is from the eleventh of September at twenty to four in the morning. The lock already existed by then, a machine-wide one added the day before so builders in separate worktrees could not launch two probes at once. A second runner started while a first one, launched from a worktree by a script that had not taken the lock, was mid-run. The second runner saw the first's marker, assumed an interrupted run, and restored my save over the live probe's file. Then the first run finished, restored, and removed the marker while the second was still writing, so the next run backed up a probe's save as if it were mine. My save from the day before was gone. Two things came out of that night. A rule that every launcher goes through the lock, which is taken by creating a directory, an atomic operation, with the owner's process id inside it so a dead owner's lock is stale. And a tool-level refusal underneath it, for the day the rule is forgotten again: a marker plus a live probe process is not an interrupted run, it is a concurrent one, and the runner exits with code 3 rather than recovering. The lock can be bypassed by a launcher that forgets to take it, which is exactly what happened. The refusal cannot be, because it lives inside the runner that every launcher ends up calling; whether every launcher still does is the one thing nothing checks yet.

None of this tells me whether a frame is beautiful. That verdict is mine, playing the game, and the rule is that nothing in the suite certifies a look on its own. The suite's job with a look is to fence it with numbers, so that a later change cannot quietly walk it back. The simplest fence is that a frame was drawn at all: a mean luminance floor and a standard-deviation floor, because a minimized window gives a black frame and a camera inside the ground gives a flat brown one, and both would otherwise count as a successful capture. The next fence is that a demo world's ground and sky measure outside the home world's band, per color channel and not by luminance, because a red desert and a green meadow have almost the same luminance by construction, and the first version of that gate failed a planet you could tell apart from across the room.

The water gate is the one I would show a stranger. Sea of Thieves water is a taste, but the four things that make it recognizable at a glance are numbers: saturation, hue in a teal window, foam that breaks at every edge, and translucent shallows where you see the bed. The trick is where the samples come from. Masking the frame by color would ask the frame to prove the thing it is being measured for, so instead the world says where the water is: points are drawn on the surface, their depth comes from the same fields the swimmer uses, and the camera projects them to pixels. Every sample carries a known depth, and the shallows gate needs that depth to exist at all. The thresholds are below, under the beach frame they were read from.

Saturation over the water pixels at least 0.25: this frame read 0.42, and the grey river of a week earlier, the one the gate was written for, read 0.19. Hue between 150 and 200 degrees: 195.7. Bright pixels along the waterline at most 75 percent of those sampled: 13 percent. Changes of state along the waterline at least 1.0 per 10 m: 1.03. Shallow pixels at most 1.15 times as far from the dry bed's color as from the deep water's: 0.31 from the bed against 0.34 from deep water, so under the line with room.

That gate has been wrong twice. The foam gate first asked that at least 60 percent of the waterline be bright, and the game passed it perfectly by painting a solid white outline around every body of water, which is what sat on the main branch until the gate grew a ceiling. Real surf is a duty cycle, so the gate is now a ceiling on the bright fraction plus a count of changes of state along the shoreline, at least one per 10 m, a count that a solid line and a foamless shore both score as exactly zero. The shallows gate first measured luminance, which cannot tell a tinted bed from dark water over a dark riverbed; it measures color distance now, and both readings print on every frame so the next person can see why.

The sea's storm has a story of its own about a frame that lied. A capture was meant to shoot the same vantage twice, once calm and once in a storm, by setting the ocean's storm parameter directly. But the play scene pushes that parameter from the sky's weather every physics tick, so the direct call was overwritten within a frame, and the capture saved a second calm frame under the storm's name and reported success. The capture now drives the storm the way the game does, through the weather, and the pair below is what a player sees, at the probe window's small resolution.

The storm parameter at zero, driven through the weather the way the game does it.

The storm parameter at one, same vantage, same frozen time of day.

The runner has been wrong too, and the worst of it was a rule I wrote: a crash on exit, after a probe had printed its own green verdict, was counted as a pass with a note. The note became wallpaper. That story has its own post, because the crash turned out to be a real bug in the player's quit path, and the same suite is what made it cheap to prove.

A suite this size costs time. The seventh milestone suite, the last full run, took 41 minutes and left eleven red, and the figure below says how the runner counts a red. A suite that long runs only at milestones; between them, only the probes for the files a change touched. The suite also warns about its own coverage at the end, naming any script that is on neither of its lists; today that is one helper, which runs only inside its callers. Feel is not a probe. The probes exist so that when I sit down to play, the only thing left to judge is whether it is any good.

Most of what the runner does is refuse: a game on the machine, a second probe mid-run, a frame that was never drawn, a white outline pretending to be surf. Everything the agent builds passes through those refusals before it reaches me, and the refusals are the reason I believe the green results. The next probe to write is the one that tests the runner itself: a second launcher started under a held lock, expected to come back with exit code 3. Nothing checks that today except the memory of a lost save.