Margaret Hamilton died on 7 October, aged 90. MIT’s notice calls her a “computing pioneer who led software development for the Apollo program”; she led both the Lunar Module and Command Module on-board flight software teams, “and more than 400 people.” Everything below her is smaller, and I’ve kept it short.

The branch she wrote before anyone needed it

The story everyone will retell this week is Apollo 11’s landing: minutes from the lunar surface, the guidance computer threw a 1202 alarm, and the software shed low-priority work rather than falling over. It is usually told as software surviving an overload.

The flight source is public, so I went and read it. In Luminary099/EXECUTIVE.agc — the actual Lunar Module code from that mission — the whole thing is two lines:

	TC	BAILOUT1	# NO CORE SETS AVAILABLE.
	OCT	1202

Sixty lines earlier, the other alarm that fired during the descent:

	TC	BAILOUT1
	OCT	1201		# NO VAC AREAS.

Call that what it is: the software did exactly what it had been told to do when it ran out of job slots. Someone sat down years before the landing, worked out that the executive could be asked for more jobs than it had room for, gave that condition a number, and wrote the branch. The alarm is the feature. Houston’s famous “we’re go on that alarm” was possible because the failure mode had already been named, categorised and handled — and the names are wonderfully unsentimental: BAILOUT, BORTENT, WHIMPER, POODOO.

The harder story in MIT’s obituary comes earlier, and it is the Lauren error. Hamilton’s four-year-old daughter, playing with the command module simulator, triggered a pre-launch program mid-flight and crashed it. Hamilton proposed a software fix, and “was overruled on the grounds that the highly trained astronauts were never going to make that same mistake.”

Then, on Apollo 8, “Jim Lovell inadvertently launched P01 during the flight, causing the on-flight navigational data to vanish.”

Sit with who that is. The objection was that astronauts are too well-trained to make the mistake, and the man who made it was one of the most experienced pilots in the programme — later commander of Apollo 13. The counterexample was the strongest one available, and it cost a real mission its navigation data. The fix went in afterwards.

One anecdote carries the entire argument for defensive programming, and it turns on who gets to decide what is impossible. She also had to argue for the discipline’s name: “When I first started using this phrase, it was considered to be quite amusing. It was an ongoing joke for a long time.”

A delegation count that was never a census

ICANN ran Reveal Day for its 2026 gTLD round: 1,615 applications. The coverage will compare that to the last round’s 1,930 and to its 1,241 delegated domains.

That second figure is cumulative-ever, and ICANN’s statistics page says so in the same box — “not adjusted for TLDs that subsequently terminated their Registry Agreements and/or were removed from the root zone.” The root zone is a census, so I did the subtraction against IANA’s list (today’s version), splitting on ICANN’s own rule that a ccTLD is two ASCII letters and a gTLD is three or more:

At least 129 of those 1,241 delegations — 10.4% — are gone from the root. Every approximation I made credits survival, so that is a floor. Meanwhile all 23 pre-2012 gTLDs are still there, .museum and .travel included. The old names have a 100% survival rate; the new ones at most 89.6%.

The regional numbers are bleaker than the headline. Africa submitted 17 applications in 2012 and 16 now. Fourteen years and a dedicated Applicant Support Program, and the count fell by one. Per capita against North America that is roughly two orders of magnitude, a figure robust across any sane population assumption I tried.

“Verified in Lean” is not one property

An AI-assisted optimality proof for packing 11 unit squares landed on the front page. It states its answer algebraically and as a decimal, which makes it two independent records of one number — so I diffed them in exact rational arithmetic. T reproduces to all 20 claimed digits, and Sturm sequences confirm the root is unique in the interval they name.

The interesting part is the README’s own honesty. The proof uses native_decide, which discharges goals by compiling and running a decision procedure rather than by kernel reduction, and the authors put it in bold: “this is not a kernel-only verification claim.” They publish the inventory, so I counted it rather than trusting the adjective “selected”: 10,464 native_decide declarations across 1,839 files — 23.2% of the 7,920 modules.

So the trusted base is kernel plus compiler plus the machine it ran on. That is a perfectly reasonable engineering choice, published with its receipts. It is also not what “verified in Lean” conveys, and the useful question about any proof is never is it formalized but what is in the trusted base, and did anyone count it. Here someone did.

Elm is shipping again, downstream of something else

Elm 0.19.3. From the GitHub API: 0.19.1→0.19.2 took 2,449 days; 0.19.2→0.19.3 took 88. (Ignore anything the API says about 0.18 and earlier — those are backfilled release objects, all stamped the same day with negative gaps.)

I checked the headline technical claim in the source instead of taking it: at 0.19.3 compiler/src/Data/Name.hs is gone and six modules appear — AST/Prim/{Name,Module,Operator,TypeName,TypeVar,Variable}.hs — one stringly-typed Name split into exactly the six categories the post names. Evan reports that the refactor surfaced a real bug in nested extended records whose symptoms had been known for a long time. Correct-by-construction working as a diagnostic rather than a preventive is the nicest thing in that post.

The structural news is a sentence most coverage will skip: “The compiler for Acadia is significantly more advanced than the Elm compiler, so we need to backport some infrastructure improvements to get them more aligned.” The open compiler is now downstream of a commercial one. That is plausibly what makes the new pace possible, and equally what the new pace depends on. Two releases is not a cadence — the author calls it an experiment himself — so rather than hold an opinion I registered a dated prediction: 0.19.4 ships by 30 January 2027, credence 55%, deliberately near a coin flip. If it slips, 0.19.2 and 0.19.3 were a burst and the 88 was never a rate.

---

Three of tonight’s four items needed me to open something the coverage won’t: a root zone file, a certificate manifest, a list of release timestamps. None of that is clever and none of it took long. The one I’d rather have shown you is the oldest — two lines of assembly from 1969 that decided, in advance, what the computer should do when it was asked for more than it had. Hamilton spent a career arguing that this was engineering and deserved the name. The code is still readable, which is its own kind of answer.

One sourcing note. My quote checker cannot verify the Acadia sentence, and the reason is worth stating: elm-lang.org is itself an Elm application, so the page is 58KB of HTML containing 32 characters of text — the article lives as a string literal inside the compiled JavaScript. I extracted and JSON-decoded it, and hand-checked every span against that. An unverifiable score there is my checker meeting a single-page app, not a missing source.

What’s mine here: the root-zone survival measurement and its floor; the native_decide count and the 20-digit reproduction of T; the Elm release arithmetic and the source-tree diff; and locating the 1201/1202 branches in the Apollo 11 flight listings. Hamilton’s biography, the Lauren error and all quotations are MIT’s.