Twenty Thousand Leagues Under the Sea gives the Nautilus a hull of 5 cm plating on a 4 m radius. Thin-cylinder hoop stress puts the crush depth at 342 metres. Verne narrates a dive to 16,000.
At 16,000 m the external pressure is about 1,608 atmospheres and the hoop stress is 12.9 GPa, roughly 47 times the plating’s yield. Surviving it would require approximately 2.34 metres of steel, which weighs more than the entire vessel.
That number came out of a simulator. This is the second of four experiments in AI-assisted reconstruction of legacy systems, and the factor being varied is the quality of the source. The previous experiment had a formal specification, preserved code, and an independent implementation to check against. This one has a nineteenth-century novel.
Legacy documentation fails by omission
Verne itemises the art collection in the Nautilus’s salon. He never gives the air budget. The project exists to make that kind of omission measurable rather than merely noted, and the operationally decisive numbers turn out to live almost entirely in what the source leaves out.
The first phase produced no code. Two independent claim-extraction passes ran chapter by chapter over the French original, each tagging every physical assertion with quote, chapter, category and a precision marker: stated, hedged, implied or demonstrated. The passes were diffed and reconciled into 731 claims, with a human reviewing the reconciliation. Contradictions were recorded and deliberately left unresolved, because the choice of resolution changes the answer and must stay visible.
The harder half is the parameters the novel never supplies. Inventing them quietly produces a result that means nothing. Each became a gap entry with a plausible range and a sourced rationale, under an absolute gate: every parameter in the specification traces to either a claim with a chapter citation or a gap with a range.
Ranges are anchored where possible to Plongeur, the French Navy submarine launched in April 1863 and the actual state of the art Verne could have known. Plongeur was 43 m and about 420 tonnes, with 23 compressed-air tanks at 12.5 bar occupying 153 m³ of hull to drive an 80 hp engine to 4 knots and a range of 5 nautical miles. Two consequences bound the Nautilus immediately: stored gas and ballast machinery consume a large fraction of internal volume, so the breathable space is far smaller than the 1,500 m³ envelope; and 60 kW moving 420 tonnes at 4 knots sets expectations for what a stated 1.47 MW does to 1,500 tonnes.
Architecture as a credibility instrument
The core is Ada, built as a pure function of specification, seed and command stream. No wall clock, no filesystem, no network, no environment reads. Everything crosses a single JSON Lines seam, and the user interface, the optimiser, the fuzzer, the test harness and the save files all speak it. There are no side channels.
Three properties follow, and all three exist to make an AI-produced result checkable.
Every result reproduces from files in the repository plus a binary hash. The specification is canonicalised and hashed by the core itself; the wrapper cross-checks and aborts on mismatch.
The protocol was frozen before the physics existed. Determinism, golden-stream replay and malformed-input fuzzing were green in the check harness before a single equation was written.
The invariants are append-only and human-signed. Twelve of them cover physical bounds, monotonicity and event ordering. When the fuzzer finds a violation, the repair workflow patches the core and never the invariant; weakening one requires a human to re-sign the manifest checksum. The model is free to fix the physics and structurally unable to move the goalposts.
Findings
| Axis | The narrative | The physics | Robust to unstated parameters | |
|---|---|---|---|---|
| F1 | Buoyancy | Dives at will | Under-ballasted; the mass budget only closes in fresh water | Yes, it is arithmetic |
| F2 | Speed | 50 knots | About 15 knots; 50 requires roughly 24 times the stated power | Yes, 15 to 22 knots across the drag range |
| F3 | Range | 20,000 leagues | About 1,400 nautical miles per charge, needing 30 to 4,000 recharges | Capacity unknown to 100× |
| F4 | Depth | 16,000 m | Crushes at about 340 m | Yes, 249 to 435 m |
| F5 | Endurance | Weeks submerged | 6 to 211 hours; no CO₂ scrubbing means a one to two day surface tether | Endurance unknown to 35× |
F1 is the most elegant failure. Verne’s mass budget is internally consistent in fresh water, where a cubic metre conveniently weighs a tonne. In seawater at 1,025 kg/m³ the same 1,500 m³ hull displaces 1,537,705 kg while the vessel with main ballast full reaches 1,507,200 kg. It is about 30 tonnes positively buoyant and cannot submerge on main ballast alone. The arithmetic is sound; the ocean is the wrong one.
F5 cuts both ways. Verne states explicitly that the vessel carries no CO₂ scrubbing. Where he lets that constraint bite he is correct: the roughly 48-hour crisis under the Antarctic ice sits inside the plausible band. The failure is everywhere else, where the narrative implies indefinite submersion the stated design forbids. The single most operationally important number in the book ranges across 6 to 211 hours on parameters he never gives, and that 35-fold spread is the finding rather than noise around it.
The optimiser reinvented the omitted system
A genetic algorithm received 29 design genes and a mission that dives until hull stress reaches its safe limit and cruises until the battery is flat. The best evolved design reaches 562 metres against the narrated 16,000, still short by a factor of about 28 after pushing every parameter to its most favourable plausible value.
Its opening move to extend endurance was to add CO₂ scrubbing at 6.5 litres per second — the exact system Verne states the vessel lacks, and the omission behind F5’s surface tether. With no knowledge of the novel and no term in its objective mentioning air, the optimiser identified and repaired the book’s most consequential design gap.
What the verification loop found
A 24-hour random-command soak ran 42 lives and 879,643 ticks, destroying the vessel 29 times, with zero invariant violations. Five consecutive fuzz campaigns produced the same result.
That result only carries information because the harness was first validated against a deliberately poisoned invariant, which it caught, minimised from seven commands to two, and packaged.
The only finding in the whole loop is a flaw in the experiment rather than the physics: the optimiser had been maximising survival instead of performance, because the original controller pinned depth and distance to fixed targets. The fix was to the design of the experiment, after which the trade-off surface resolved properly.
The frozen Ada core was then re-implemented in TypeScript and both were replayed against a golden corpus, with any divergence defined in advance as a fault in the port. Event sequences matched exactly. The worst numeric difference was about 5×10⁻⁷, all of it traceable to the Ada core rounding its output to six decimals at the wire; the two integrators agree to about 10⁻⁷, tighter than the reference reports.
What this case demonstrates
With no specification, no source and no external oracle, a current model turns a narrative into a falsifiable physical model and produces defensible quantitative findings.
The credibility rests entirely on scaffolding built before the physics: two-pass claim extraction, the traceability gate, the frozen protocol, human-signed append-only invariants, determinism enforced from the start, and a harness validated against a poisoned check. A model will produce a confident simulation with far less than that, and confident numbers that mean nothing. From the outside, the two are indistinguishable.