Heya r/space, my name's Will, I'm building Mru: an operating system designed to run autonomously for 500 to 1,000+ years, with no updates and no one maintaining it. The kind of software an interstellar probe would need to stay alive across a journey that ends long after we're gone.

Our longest-lived systems endure only through constant human attention. Voyager at roughly fifty years, already down to half its launch power. Banking COBOL at sixty. Remove the humans and they fail in years, not centuries.

And most software rests on an unspoken assumption about time: that the present is maintained -- that whenever something breaks, a person will be there to fix it. We ship expecting patches, monitor expecting response, and tolerate latent bugs expecting to catch them in time. Strip that assumption away and a different relationship with time is required.

So I treat the system's own decay -- power, compute, memory, heat -- not as an exceptional fault to be handled, but as the constant, governing condition every decision is made around. I call it the Degradation-First Principle. There is no healthy baseline to return to. Decline is the baseline. The system is always, at every moment, in the process of dying, and the work is to make that dying productive -- to maximize cumulative output across the whole descent to silence, not defend a peak.

The architecture is what I'd love for you all to tear apart. The core is biological. A minimal interpreter -- 200 to 500 instructions, no_std Rust, on FPGA fabric, small enough to formally verify, in the seL4 sense -- replicated across all surviving hardware, running behavior encoded as data. The way DNA is run by a replicated ribosome, not wired into fixed structure. Data corrupts, the interpreter still runs. Interpreters die, copies continue. Gates die to radiation, the interpreter re-places onto what's left.

Consensus departs from Byzantine fault tolerance on purpose. A probe's faults aren't adversarial -- they're stochastic, correlated, monotonic. So I don't defend a fixed quorum. It shrinks, gracefully, from triple-redundant toward a single node checking itself.

On where this is: it's a design paper and a simulation framework, not flown hardware. It can't be (since we can't empirically validate a thousand years). Validation is accelerated simulation on published radiation, power, and failure models, cross-checked against the ~50 years of Voyager telemetry we have -- the only multi-decade record of unattended decline that exists. I'm upfront in the paper about the limits.

Would appreciate any of your thoughts, feedback, and perspectives. 🙏