The power that reset itself on load
For as long as the first god-power existed, it quietly cheated. Every time you closed a saved world and opened it again, your divine energy came back full and the blessings you’d spent it on were gone — as if you’d never lifted a finger. Nobody noticed, because nothing in the running game ever made the round trip happen end to end. It took building the headline verb to finally catch it.
A number we chose never to store
When we built the first real power a player-as-god gets — blessing the soil — we made a deliberate decision about the energy it costs. Why that energy is a finite, draining budget at all — scarcity as the source of stakes — is a sibling’s story: a power you have to spend. The decision that matters here is humbler and is the whole of this post: we never store the energy you have left. Not as a number on disk, not anywhere. Instead we re-derive it every single time: start from a full budget, then walk the record of every act you’ve taken and subtract what each one cost. The acts are the truth; the balance is just arithmetic done over them, fresh, on demand.
This is the same restore-then-replay-forward idea the rest of the world leans on — we keep the recipe and cook it again rather than photographing the result. The full architecture of a save that records your deeds rather than the state they left behind has its own story, and a sibling post tells it: remembering what you did, not what it did. What I want to follow here is the one place that elegant idea sprang a leak.
The appeal of deriving a value instead of storing it is that there is nothing to keep in sync. A stored number can drift away from the thing it’s supposed to mean; you save it, the world changes, you forget to update it, and now your save file and your reality disagree. A derived number can’t do that, because it is recomputed from the source of truth every time it’s asked for. It is always, by construction, correct.
A value you re-derive can never drift out of sync — as long as the thing you derive it from is actually there.
The leak
That last clause is the whole post.
The record of your acts was saved correctly. When you saved a world, the running list of everything you’d done was faithfully written out to the file. The bug was on the other side of the trip: when you loaded a world, that list was read off disk and then never handed to the live, running game. The world started up with an empty record, every time.
And because the energy budget is re-derived over that record — start full, subtract each act — an empty record derives to exactly one thing: full. With no acts to subtract, the arithmetic concludes, confidently and wrongly, that you have spent nothing. Your blessings evaporated and your tank refilled itself, on every load, silently, with no error and no complaint. The clever design that could not drift had quietly been handed nothing to derive from, and it did precisely what it was built to do with nothing: it gave you back a pristine world.
Why it hid for so long
A bug this total — an entire economy resetting on every load — ought to be impossible to miss. It survived several rounds of work for one reason: nothing in the running game had ever leaned on that record surviving a reload. You could play a session, spend energy, watch the meter move, and everything looked right, because within a single session the record was never empty. The defect only existed across the seam of a save and a load, and that seam went unwalked until terraform forced it — the broader story of how building replay flushed it out is the sibling’s to tell.
What finally forced the issue
The bug surfaced because of terraform — the shaping verbs that let a god reshape the land. The carved terrain is never stored; on reload it’s rebuilt from its seed and your edits are replayed back onto it from that same record of acts (the mechanics of that replay belong to a sibling post: remembering what you did, not what it did). What matters here is the consequence: building that replay path forced, for the very first time, a genuine save-then-load-then-act exercise of the whole chain.
And it walked straight into the wall: replaying a record that’s empty does nothing at all. The terrain replay would have been completely inert — you’d sculpt a hill, reload, and find it gone — for the identical reason the energy budget reset. The load had never restored the record, so there was nothing for replay to replay. One missing step was quietly breaking two features at once: an old, invisible one, and the new one we were in the middle of building. Chasing why the brand-new terrain replay did nothing is what dragged the older, silent defect underneath it into the light.
The same gap that made our new feature inert had been silently breaking an old one the whole time. We only found it because we finally ran the path.
The fix was one step
For all the trouble it caused, the fix was small and surgical: when a world loads, take the record of acts we read off the file and thread it back into the live, running game. That’s it. The save half had always been right; we just made the load half use what it had read.
There was one detail that had to be exactly right. The record has to be restored before anything that depends on it captures a reference to it — before the energy budget goes looking for acts to subtract, before the terrain replay goes looking for edits to re-apply. Restore it a moment too late and both would still see the empty list they grabbed first. So the restore happens early in startup, ahead of every system that reads the record, so that the budget and the replay alike see the real history instead of an empty one. (One smaller subtlety lives next door: the land isn’t editable the instant a world loads, so the terrain replay itself waits for the first rendered frame — but the record it replays from is already in place by then.)
No change to the save-file format was needed. The record had been saving correctly all along. All we did was thread it back into the live game early enough that the energy budget and the terrain replay both derived from a real history instead of an empty one.
The guardrail, and the lesson
A fix this quiet is exactly the kind that can rot back out a few months later when someone reorders the startup sequence and doesn’t know what they broke. So we wrote a regression test to nail the behaviour down: load a world that has one spent blessing in its history, and check that the energy reflects that spending instead of snapping back to full. It was written to fail against the old, broken behaviour — which is the only kind of regression test worth having. A test that passes against the bug is just a description of the bug.
There’s a reason it stings in a good way. The original design was the careful one — deliberately refusing to store a number that could drift, choosing instead to recompute it from the truth every time. That instinct was right; we’d build it the same way again. It simply assumed, without ever checking, that the truth would be waiting to recompute from — and for as long as nobody walked the full round trip, it wasn’t. The most careful idea in the codebase had been quietly handing back a pristine world for its entire life, and it took the loudest new feature to make anyone notice. The lesson isn’t to trust derivation less. It’s that an unwalked path is just a hope, however clean the code on either end of it looks.
