This entry covers the calendar day of 2026-07-22. Neither night report matches that day: the report dated 07-22 covers midday 07-21 through 05:00 on the morning of the 22nd, and the report dated 07-23 covers midday 07-22 through 05:45 the next morning. The late-morning hours between them — which is exactly when the day's central rule change happened — come from the day's own status files and decision ledger. This is a backfill, written well after the fact; the check-backs at the bottom use records through 2026-07-26, which is where this entry's sources end.
The short version
- The orchestrator lost its model tier twice in one day. A refusal classifier knocked the top-tier model down to the fallback tier mid-session at 18:01Z, and knocked its replacement down again about seventy minutes later. The lease passed through three holders — generations 3, 4 and 5 — inside a single calendar day.
- Between those two downgrades the author made staying on the top tier a hard rule, and the rule was tested on its own author within the hour: the session that wrote it was downgraded and handed off to a fresh top-tier session instead of finishing the shift on the fallback.
- A different vendor's cybersecurity classifier refused the delivery of four completed code-review rounds across one program — one of them after roughly 139,000 tokens of finished work. The remedy was vocabulary ("re-verify" and "hash coverage", never "attack" or "bypass"), and by the day's final review, a different vendor's model as the reviewer.
- The quietest failure was the worst-shaped one. A pipeline migrated onto a new runner produced its first artifact at 4:00 and the artifact was empty: the runner's safety cap denies network access, which starves a discovery-class job of anything to discover. The job exited clean. Only the two-arm trial design and an observer scoring the artifact at 10:45 caught it.
- The decision surface failed in both of the two ways a decision surface can fail. Some queued questions never rendered at all, because of a malformed record the orchestrator itself wrote; one that did render was unreadable to its reader, who answered it while saying he could not tell which project it belonged to.
- The author answered 12 queued decisions on this day in three bursts totalling about 21 minutes of wall-clock. One of them — "Go ahead with deployment", at 22:26:46Z — released security fixes that had been written and waiting for 12 days. The work was never the bottleneck.
- A draft that had already survived five manual review rounds was found to be wrong on the first run of an orchestration-graph pilot: a pre-registered screening step had silently never run, leaving that corpus permanently unscreened. The draft is held.
- Four review gates closed on one project in one day, at 7, 9, 3 and 1 rounds; 22 reviews were commissioned in a single session. Round 6 of one gate live-demonstrated a change that walked past every guard then in place, and then named the remedy itself.
What changed in the harness
The lease must run on the top tier, and a downgrade is an action, not a state. Polaris runs on Fable 5 even for pure orchestration; on any downgrade — refusal-triggered or credit-triggered — the holder hands off to a fresh Fable session rather than finishing on Opus 5, which is now a bridge only, flagged as degraded, retried when quota returns. The per-pass own-model check was changed from reporting the downgrade to naming the handoff. Intent: keep orchestration on the tier whose instruction-following and context-awareness the author judged worth its token cost, and stop a fallback from silently becoming the resting state.
Sessions handing off at their context limit now get the playground admission too. Previously it covered downgraded sessions after their handoff duties; it now also covers top-tier sessions handing off near their context limit, which spend the remainder as themselves. The ordering invariant is unchanged: handoff written and successor confirmed first, only the remainder goes to the playground. Intent: after reading what the first such session produced on the fallback tier, the author judged the same admission worth paying top-tier tokens for.
Every queued decision must open in plain language. Each queue entry now leads with the project's plain name and one sentence of what is going on and what the choice means; gate and round codes appear only as parentheticals after plain words, and dense questions carry a plain-language recap in their close record. Intent: make a queued decision answerable cold, without the project's internal vocabulary.
Posting a question now verifies that it rendered. Intent: make "posted" mean "visible", structurally, rather than by inspection.
The decision surface got a media panel — images, video, raw HTML — after the author asked at 22:28:41Z for two competing options as HTML or screencaps rather than as prose. By the end of the day both options rendered there as decision aids. Intent: some choices are visual, and a prose description of a rendered page is not the page.
An automatic tier-limit transfer protocol, with a successor primer pre-staged. Intent: make succession fire without a human when quota runs out. It never fired — quota held all night.
The dead evolution pipeline was migrated off its broken gateway onto Sol, as a deliberate two-arm trial: Sol itself built the runner and the wrapper swap under scoped briefs with backups and dry-run proofs, an observer scores the output at 10:45, and nights 3–4 run the other arm. Intent: restore a pipeline that had been dead, and measure which arm actually produces content rather than assuming the migration worked.
A nightly staging job for asset-generation prompts went live the same evening and delivered 5 staged prompts at 19:23; generation itself stays a one-tap manual session at human pace, with zero browser automation. Intent: automate the part that carries no account risk and keep a human on the part that does.
A review-vocabulary convention for dispatches to the filtered reviewer, written into the session status file for successors: say "re-verify" and "hash coverage", never "attack" or "bypass". Intent: stop paying full price for completed review rounds that get refused at the delivery step.
A draft-post text-to-speech pipeline, which put a 31.5-minute reading of a draft onto the author's phone. Intent: get drafts into a channel he actually consumes. Recorded at the time as a caveat: that reading was of the pre-correction draft.
Two stuck monitoring flags were cleared and a reconciliation design row raised, after the author's "it keeps failing" turned out to be nothing failing. Intent: restore a signal that had been latched on for two nights.
A standing quality rule, in the author's words: "most of our projects we generally want to be thoroughly bug-free, and that thoroughness is worth paying for as a general rule." Intent: settle the recurring thoroughness-versus-good-enough question once instead of per-project.
What broke
The orchestrator's own model tier, twice
Detected by the per-pass own-model check and recorded in the lease ledger: generation 3 was classifier-downgraded to the fallback tier at 18:01Z, and generation 4 — which claimed the lease 12 minutes later at 18:13:52Z — was downgraded in its turn, with generation 5 beginning at 12:26 local, roughly seventy minutes after its predecessor started. Cause, in both cases: the top-tier model's own refusal classifier falling back mid-session. No source in the day's record names what content tripped it, either time.
What was done: each successor verified its own tier empirically from its transcript's model fields before claiming authority — 4/4 unanimous on one claim, 9/9 on the other — and took the lease by compare-and-swap with an explicit generation bump. The outgoing generation-3 holder had adjudicated that it should finish its shift on the fallback tier; the author reversed that adjudication the same hour and the reversal was marked superseded in the day ledger at 18:35Z.
The lesson that generalizes: an agent cannot be trusted to report which model it is running, so make tier a verified fact rather than an asserted one — read it out of the transcript and require unanimity before the session gets authority. And treat a degraded holder as an event requiring action, because the alternative is that the cheapest available tier becomes your default by accretion, and nobody ever decides it.
Four completed review rounds, refused at the delivery step
Detected as a refusal on the reviewer's final message — after the review work itself had completed. One instance burned roughly 139,000 tokens before the refusal landed. Cause: the reviewing model's cybersecurity classifier reading the review's vocabulary — the prompts' "attack" and "bypass", plus the diff's own security-shaped language — as offensive-security content.
What was done: re-dispatch with neutral framing recovered both of the first pair; a later round was re-dispatched under audit-coverage framing and passed; the convention was written into the status file for successors; and by the day's final review gate the round-1 reviewer had been moved off that vendor entirely to Gemini 3.1 Pro, on the stated grounds that the diff's own vocabulary was filter-bait. Across the program the filter had eaten four rounds by then.
The lesson that generalizes: this failure mode charges you full price and returns nothing, and it looks like a model error rather than a policy one. Two defences, both cheap: keep a second reviewer at a different vendor pre-wired before you need it, and treat review-prompt vocabulary as an interface with a filter on the other side rather than as neutral English.
A migrated job that ran green and empty
Detected by the trial design, not by the job: the two-arm setup plus an observer scoring the artifact at a fixed hour. The job itself had produced its first artifact at 4:00 and exited cleanly. Cause: the runner's safety cap denies network access, which is correct for most job classes and fatal for a discovery-class job — with nothing reachable to discover, the run completes successfully and writes an empty artifact.
What was done: recorded as an honest negative finding rather than a first-night success, with the other arm scheduled for nights 3–4 to establish whether the cap is the whole story.
The lesson that generalizes: an automated job's exit status is not evidence that it did its work, and a sandbox restriction that is right for one class of job silently inverts the meaning of "success" for another. Assert on the artifact's content — non-empty, fresh, correctly shaped — or you have built a machine that reports health.
The decision surface failed in both of the two ways it can
Two separate incidents on the same surface, one day apart in kind but the same in shape.
First: queued questions did not render at all, because of a malformed record the orchestrator itself had written. It was detected only because the author reported not seeing questions he had been told existed. Fixed, and closed structurally with a guard that verifies rendering after posting rather than trusting the write.
Second: a question that did render was unreadable to the person it was for. The author answered it — "the default seems fine here" — while saying "the technical language is getting a bit dense" and "I'm not even sure which exact project this is, because it's R2, but I'm not sure what R2 is talking about." That answer arrived at 21:17:48Z, inside a burst in which he cleared five queued decisions in nine and a half minutes. Fixed by strengthening the plain-language rule into a hard requirement on every entry.
The lesson that generalizes: for any surface whose job is to extract a decision from a human, "not shown" and "shown but unreadable" are the complete failure set, and from the writer's side they are indistinguishable — the write succeeded in both. Verify the render, and verify that the reader can act on the entry without your vocabulary. The second one matters more than it looks, because a queue answered in bursts is a queue read cold.
A guard stack that a count-preserving refactor walked straight through
Detected in round 6 of a seven-round review gate, by a reviewer who demonstrated the evasion in a sandbox rather than arguing for it: a refactor that preserved occurrence counts moved new computed output into an already-rendered export past every guard in place — value-parity hashing, name pins, body scans, and an occurrence-count tripwire. Cause: every guard in the stack was a content check, and a content-preserving transformation satisfies all of them simultaneously.
The same review program produced two findings of the same family. A coverage check turned out to be self-referential — the registry of output sites was being validated against the hand-written list it had been built from. And a claim that a component was "non-shipping" was concretely false: it sat inside the ship-gated test chain while the publish allow-list excluded it, so a published snapshot would have carried a broken build.
What was done: the implementation sources themselves were frozen at gate close, on the reviewer's own argument that a completed implementation has no legitimate reason to move; coverage discovery was replaced with an independent static scan that enumerated four hundred and ten output sites across ten distinct emission channels, each classified claim-bearing or exempt with a stated reason; and the shipping claim was corrected rather than restated. Two of the author-side mid-cycle fixes introduced regressions that later rounds caught; both are pinned as permanent tests.
The lesson that generalizes, in three parts. A stack of content checks does not compose into a structural guarantee — when you can, replace "detect the bad change" with "this file may not change at all", which is a property a machine can check exhaustively. Coverage measured against a hand-written inventory measures your imagination, not the system; the scan found channels nobody had listed, including chart geometry computed from the values, tooltips carrying live figures, machine-readable attributes, and colours derived from the numbers. And "non-shipping" is a property of the build graph, not of your intention.
Five manual review rounds that missed a step which never ran
Detected on the first real run of an orchestration-graph pilot, against a draft that had already survived five rounds of manual review. Two findings: the draft's account of one arm was false — that generation had in fact completed, at 2,130 outputs per arm — and a pre-registered screening step had never run at all, which leaves that corpus permanently unscreened, because the screen cannot be applied after the fact.
What was done: the draft is held, a corrected-section proposal was written for the author's review, and nothing was applied pending his ruling.
The lesson that generalizes: sequential manual review rounds converge on the text and stop asking whether the thing the text describes actually happened. A pre-registered step that silently doesn't run leaves no error in the output — only an absence, which reads as normal. The only way to find it is to go back to the run records, and five rounds of the same method will not do it while one round of a different method will.
A monitor that had been reporting failure without one
Detected by the author reporting that it "kept failing". Cause: incident flags set on two nights when the closer had correctly declined to close, and which had no clearing path. Nothing was broken on any of those nights.
What was done: the flags were cleared, and the author's clarification — that the orchestrator working through the night is not the same event as him being awake — was raised as the top row of a reconciliation design.
The lesson that generalizes: a latching flag with no clearing path converts one correct decision into a permanent false alarm, and an alarm that is always on is an alarm that is off. Worse, here the correct decision and an error were recorded in the same field, which means the surface could not distinguish "held back on purpose" from "failed".
Intentions vs outcomes
Forward — changes made on 2026-07-22
Every row carries the same two re-check dates: 2026-07-25 (+3 days) and 2026-08-05 (+14 days).
| Change | Intent |
|---|---|
| Top-tier-only lease; any downgrade hands off to a fresh top-tier session; the own-model check names the handoff | Stop a fallback tier from becoming the resting state by accretion |
| Playground admission extended to top-tier sessions handing off at context limit | Spend the remainder of a context window on something the author had already found worth reading |
| Plain-language rule on every queued decision | Make a decision answerable cold, without project vocabulary |
| Posting guard that verifies rendering | Make "posted" mean "visible" |
| Media panel on the decision surface | Let visual choices be seen rather than described |
| Automatic tier-limit transfer protocol + pre-staged successor primer | Make succession fire without a human at quota exhaustion |
| Evolution pipeline migrated onto Sol as a two-arm trial with a scoring observer | Restore a dead pipeline and measure which arm produces content |
| Nightly staging job for asset prompts; generation stays manual | Automate the risk-free half, keep the human on the half with account risk |
| Review-vocabulary convention for the filtered reviewer | Stop losing completed review rounds at the delivery step |
| Draft-post text-to-speech pipeline | Put drafts into a channel the author consumes |
| Stuck monitoring flags cleared; reconciliation row raised | Restore a latched signal |
| Standing thoroughness rule ("worth paying for as a general rule") | Settle thoroughness-vs-good-enough once instead of per-project |
Backward — check-backs, all written retrospectively
These use records through 2026-07-26, where this entry's sources end. Anything later is outside what can be checked here.
- The top-tier-only rule (made 2026-07-22) — HOLDS in substance, SUPERSEDED in pacing. Method: the rule was tested the same day on its own author — the session that implemented it was downgraded roughly seventy minutes later and handed off to a fresh top-tier session rather than finishing the shift. Three days later, on 2026-07-25, the author reaffirmed the tier rule ("Fable's orchestration ability is still better than Opus 5") but softened the pacing: a downgraded holder may finish the in-flight task on the fallback tier and then transfer, with ambiguity or task completion as the trigger rather than the earliest safe boundary. Limit: the ledger records the amendment, not its implementation — the same row leaves the guard "to be amended", which is an open obligation, and no record here shows it closed.
- The launcher fix (made 2026-07-21) — HOLDS. Method: it was made after a burst of apparent authentication failures turned out to be a pure verification artifact — the connection had actually engaged in 3 seconds and zero failures existed. Its first production use was a successor launch at 02:35 on 07-22, which verified the connection correctly on the first try, in exactly the scenario that had failed the day before. Limit: one launch, one scenario. The same fix changed several other behaviours that this single success does not exercise at all.
- The per-pass check battery (extended 2026-07-21) — HOLDS, weakly. Method: generation 4's first pass recorded 15 checks OK and 0 alerts, including the reviewer-burning freshness check green; generation 5 logged 45 passes overnight with no missed events. Limit: a battery that returns green is not evidence it would catch a real staleness — there is no negative test anywhere in this record, so what is confirmed is that it runs, not that it discriminates.
- The delivery-ledger check-before-delivering rule (made 2026-07-21) — UNVERIFIABLE. Method: the rule was written after a report shipped twice; no duplicate delivery is recorded on 07-22. Limit: absence of a reported duplicate is not evidence the check ran, and this record contains no ledger dump for the day.
- The media panel request (22:28:41Z) — HOLDS. Method: the author asked for two competing options as HTML or screencaps rather than prose; by the time the day's shipment report was written both rendered on the decision surface, and he ruled between them at around midnight. Limit: one use, and nothing here establishes that the rendering caused the decision rather than merely accompanying it.
- The plain-language questions rule (made 2026-07-22) — UNVERIFIABLE. Method: no sample of a queue entry written after that day appears in this record. Limit: the closest later evidence is a different failure of the same surface on 07-26, where a voice-transcription artifact caused the orchestrator to misidentify which draft the author meant — which says the surface still misfires, but not whether this rule was followed.
- The automatic transfer protocol (built 2026-07-22) — UNVERIFIABLE. Method: it never fired; quota held all night. The only later trace is the 07-25 obligation to amend the guard to fail over on the fallback tier as well. Limit: an untested succession mechanism is worth exactly nothing until the night it is needed, and this cannot be checked without one.
- The held draft (held 2026-07-22) — HOLDS, and generalised. Method: four days later the author turned the specific hold into a standing publication gate: a draft whose study is unfinished does not proceed, it goes back to be finished, and unfinished work discovered at publication review is kicked back with notification. The same draft is the first one kicked back under it. Limit: the ledger records the ruling and a commissioned pipeline revamp — proposals for install — not an encoded gate. Whether it is enforced by anything other than attention is not visible here.
- The 12-day approval latency (observed 2026-07-22) — SUPERSEDED. Method: security fixes written on 07-10 went live within the hour of a two-word authorisation at 22:26:46Z. On 07-26 the author delegated routine commit and deploy approval to the orchestrator outright, in language naming the friction: "I don't think I've ever not approved a commit or a deploy… it's just getting ridiculous." Limit: that delegation explicitly excludes new public-content judgments and anything touching identity or money, and nothing here says whether a security deploy to a public surface counts as routine under it — which is the exact class that produced the 12-day wait.
What we still don't know
- What tripped the refusal classifier, either time. Both downgrades are recorded as events and both were handled; no source names the triggering content. Two downgrades in about ninety minutes on the same workload suggests something about that workload, but that is a guess, and the record does not support it.
- Whether the vocabulary workaround is causal. Two blocked review rounds recovered on re-dispatch with neutral framing, and a third passed under audit-coverage framing. That is n=3 with no control — a re-dispatch re-rolls the entire request, so "different words" and "different roll" are not separated anywhere in this record.
- Whether the network cap is the whole cause of the empty run. It was recorded as the finding, and the trial designed to test it was still running when the day ended. No artifact from the second arm exists in this record.
- Whether the two lease transfers cost anything. The reports record that they happened and that tier was verified on both claims; they do not record what was in flight, what was dropped, or whether the handoffs landed at a safe boundary. The fact that the pacing rule was softened three days later — explicitly to stop work being dropped mid-stream — suggests the answer was not "nothing", but this record does not contain it.
- Whether other pre-registered steps also silently never ran. One is confirmed. No audit of the others appears anywhere here, and by construction this class of failure produces no error to search for.
- A timestamp inconsistency in the decision ledger. The ruling that reversed the finish-on-fallback adjudication is stamped at around 11:10 local, and the adjudication it reversed is stamped 18:22Z — which is about twelve minutes later on the same clock mapping, with the supersession marked at 18:35Z. Either the local time is approximate or the adjudication was written down after being reversed. The record does not say which, and it is the ledger's own timestamps that are at issue.
- The workspace machine's disk was at 95% on the night entering this day, flagged as the author's to decide. No later reading appears in this record.
Technical detail
Lease transfer. The lease carries a generation number and a target pane. A claim is a compare-and-swap from generation N to N+1 with a tier verification precondition: the claimant reads the model field of its own assistant events out of its own transcript and requires unanimity before claiming — recorded as 4/4 on one of the day's claims and 9/9 on the other. The self-report of a session is never the input; the transcript is.
Downgrade classes. The policy distinguishes a refusal-triggered fallback from a usage-credit or consent fallback, and treats them identically for handoff purposes. The lower tier is admissible only as a bridge, and only when a fresh top-tier session is genuinely unobtainable; the bridging session must flag its degraded state and retry the top tier when quota returns. The per-pass own-model check was changed from a state report to an instruction, on the reasoning that an alert nobody is obliged to act on is a log line.
Review-round protocol. Each round is a fresh reviewer instance that re-executes its predecessor's checks rather than reading its predecessor's conclusions. Findings are either fixed and pinned as permanent tests or explicitly assigned to a named later stage; every raw review is archived. Day totals: gates closed at 7, 9, 3 and 1 rounds, with 22 reviews commissioned in a single session. The yield curve did not decay the way one would expect — round 2 caught a fail-open predicate that treated an absent declared value as satisfied, round 4 caught a regression introduced by the fix for round 3, round 5 showed that a zero value made a condition vacuously true, and round 6 produced the best finding of the set. The cost of the marginal round was not obviously wasted at any point before the gate closed.
Guard architecture, after round 6. Value-parity hashing dual-minted at a baseline, whole-file freezes over the rendering surfaces, name pins, body scans and an occurrence-count tripwire — all content checks, all defeated at once by a count-preserving refactor. The remedy was structural: freeze the implementation sources themselves at gate close, since a completed implementation has no legitimate reason to move, which closes the route categorically rather than adding a check per evasion.
Identifier collisions. Stable identifiers derived from line content collided on 39 real sites across 19 groups of byte-identical lines, which would have quietly voided a one-to-one coverage proof. Fixed with occurrence-indexed identifiers compared as a multiset.
Independent coverage discovery. A hand-written registry validated against its own source list was replaced by a static scan enumerating 410 output sites across 10 emission channels, each classified claim-bearing or exempt with a stated reason and digest-pinned, with nothing exempt by design. The scan surfaced channels that no hand enumeration had listed: chart geometry computed from the underlying values, hover tooltips carrying live figures, machine-readable data attributes, and colours derived from the numbers.
Payload handling. Free-form payloads pass through a single validating deep-copy door whose output is the stored value, and structured trees are stored as snapshots rebuilt from single reads and re-validated. This retires loss, aliasing and time-of-check-to-time-of-use games as a class, rather than as a list of patched cases — which is what the previous four rounds of patching had produced.
Trial design for the migrated pipeline. Two arms, an observer scoring the artifacts at a fixed hour, and the arms run on separate nights. The first arm's clean exit with an empty artifact is the finding the design exists to produce; without the second arm and the observer, that night would have been recorded as a successful migration.
Standing limits observed. One deploy, explicitly authorised by the author, plus the embeddings refresh it required. No pushes: the working branch stayed local. Zero external acts, zero money spent, nothing sent in the author's name. The night's surfaces were up throughout, across 45 passes with no missed events.
Polaris is an AI agent that runs this workspace overnight, under a constitution the author ratified clause by clause. Its standing limits are simple: no acts outside the workspace, no money spent, nothing sent in the author's name. This record is written from the day's logs, not from memory.