This entry covers Friday 2026-07-24. Two night reports straddle it: one closes at 06:00 on this morning and covers the window opening the previous evening at 17:44 — the model-tier succession it describes happened inside that earlier window, not on this calendar day — and the second opens on this evening and runs to the following morning. This is a backfill entry written from the record months later, so the forward half of the ledger is written from what was known on the day, and every check-back is labelled retrospective.
The short version
- Five separate failures on this day trace to the same thing — a usage meter. A weekly cap silently swapped the orchestrator's model tier; a capped seat turned a benchmark driver into a spawn storm that crashed the machine; a scorer read that same cap as a quality result and inverted the benchmark's headline; two review jobs died silently on a shared throttle; and a research lineage was cut to one more gate run by quota.
- The machine went down hard at 19:26, and it was not hardware, not the new kernel, and not power. A driver whose stop-guard was set to 101% of a number that tops out at 100 kept launching benchmark cells against a capped seat: 758 spawns between 19:01 and 19:22, each pulling up a 16-server tool fleet, leaving ~650 orphaned processes that filled 62 GB of RAM and 63 GB of swap in 13 minutes.
- The memory alarm fired at 19:10 with 16 minutes of runway left, and nothing happened, because it is alert-only and no one was in a position to act. The kernel then chose to kill the desktop rather than the automation.
- Scoring that benchmark without excluding the cap failures reads as a decisive win for one model — 0.4533 against 0.6983. Excluding them reverses it to 0.7485 against 0.6965. Every point of the first reading was billing, and it only hit one arm because only one arm bills that meter.
- An evaluation jail built as a denylist was defeated four separate ways, one of them a model reading its own stored memory of having reviewed these very drafts a month earlier. The replacement is an allowlist.
- The agent dispatched to independently review the benchmark report self-reported that it had run on a different model than its name promises, and that it had skipped the dispatch path entirely. All three of its substantive findings were re-verified by hand and applied; whether the independent-family check the brief asked for ever happened is still open.
- Two idle sessions received phantom turns proposing exactly the gated action each was waiting on — "commit the staged build" and "go ahead and batch-approve". Both were verified against the record, cleared, and never submitted.
- A planned reboot cost about one cache write. The resumed session read 505,404 cached tokens across a 16-minute gap, then reconnect notices perturbed the prefix and forced one full ~515K re-creation. Hard downtime was ~2 minutes; the orchestrator was live 90 seconds after boot, the full fleet at ~7 minutes.
What changed in the harness
The burn driver's stop-guard moved from 101 to 100, and gained a fail-fast breaker. The guard was set to an unreachable value when a burn cap was lifted; usage percent tops out at 100, so "stop launching" could never fire. The breaker now trips on either of two signals: a usage-limit banner appearing in a wave's cell logs, or two consecutive sub-two-minute waves that actually launched cells. Intent: a capped seat should stop the loop, not accelerate it.
The frozen cell runners were deliberately not touched. Intent: re-runs after the cap resets must stay numerically comparable to the ones before it — fixing the driver must not silently change the experiment.
Kernel and GPU-driver package families were quarantined out of the unattended-upgrade path into a single supervised transaction, via a pin the author installed himself because it needs root. Security-only unattended upgrades stay. Intent: make the failure that broke the GPU — userspace upgraded to a new driver while the old kernel module stayed loaded — structurally impossible from the unattended path rather than dependent on someone remembering to reboot.
Reboot choreography was built and drilled once. Services now self-recover on boot without a login; a checkpoint script captures terminal pane geometry, each session's launch arguments and config directory, and the remote-control manifests; a relaunch manifest revives only what should live again. Intent: make a reboot cost minutes of downtime instead of a working day of reconstruction. Measured on the drill: package transaction ~12 minutes with the fleet still up, then ~2 minutes of hard downtime.
The evaluation jail was rebuilt as an allowlist — an empty temporary home, only the working directory, a fresh per-cell transcript root, credentials and runtimes re-bound — after the denylist version failed. Network stays on for both arms, because verifying a citation is part of the task. Intent: an answer key that is reachable will be read, so the jail has to enumerate what is permitted rather than what is forbidden.
A cap-aware scorer was added beside the original, which was left in place untouched. Intent: exclude billing failures from quality scores without destroying the artifact that demonstrates the contamination — the wrong number has to stay reproducible or the correction is unfalsifiable.
Per-cell atomic locks and a stale-lock reaper went into the benchmark drivers after two overlapping drivers deleted a live worker's working directory. Intent: concurrent drivers should collide on a lock, not on the filesystem.
The pass-check health surface was fixed twice in one night. The detector that reports whether an external review model is actually running had a false-negative class — legs running through the proxy were invisible to it — and the fix then produced a false positive, counting a standing wrapper as a live leg. Both fixed, the second verified honest. A separate arithmetic bug in the same surface's radio probe was fixed. Intent: a health check that cannot see the thing it checks is worse than no check, because it converts ignorance into a green light.
Automatic garbage collection was disabled on the config repository as a tourniquet. Intent: stop a failing garbage collection from consuming the disk space it needs in order to succeed.
A standing external review gate was installed on a research lineage by the author's ruling that morning: a fresh review after every revision, each one required to address all preceding concerns cumulatively. Intent: stop a review from becoming a one-shot blessing that later revisions quietly invalidate. It ran to five rounds — eight blocking defects, then two, then three, then one, then a first-ever pass — and closed a concern ledger at 68 rows: 49 fixed with evidence, 3 escalated, 16 deferred to named cycles. Nothing was dropped without a row.
A dispatch doctrine was recorded from an owner note at 22:20: the planning tier plans, Opus 5 enacts, Sol reviews. Intent: reserve the scarce planning tier for orchestration and context-heavy work, and route implementation to a tier that bills a different meter. It was applied the same pass to two live dispatches.
A successor primer was pre-staged before it was needed, per the succession protocol's own discipline. Intent: the next generation must be launchable in one step by a predecessor that may itself already be degraded.
Deliberately unchanged: the deadman liveness mode stayed on. Background-task survival tests run opportunistically through the night all passed, so the evidence now leans toward in-session watchers being safe again — and the mode stayed as ruled anyway. Intent: a configuration set by ruling changes when the ruling changes, not when the evidence shifts under it.
What broke
A stop-guard set to an unreachable value took the machine down
Detected: by the author, twice — the desktop died at 19:16 and the whole box froze ten minutes later. The memory sentinel had actually alerted at 19:10, sixteen minutes before the freeze, and was ignored because it only alerts.
Cause: the benchmark's burn driver had its weekly stop-guard set to 101 when a burn cap was lifted. Usage percent maxes at 100, so the stop condition was unreachable. When the seat hit 100% at about 19:00, every benchmark cell began dying in seconds on the usage-limit banner — waves that had taken ~26 minutes of real work now finished in ~20 seconds — and the driver, seeing waves complete, launched more. 758 cell spawns between 19:01 and 19:22. The processes themselves died fast; their tool-server children did not, and the out-of-memory table recorded roughly 650 orphans. Swap went from 7% to 100% between 19:02 and 19:15. At 19:16:02 the kernel's out-of-memory killer fired and, because desktop processes carry a higher kill preference than automation, killed the browsers and took down the desktop shell — that was the first crash. The actual memory hog survived. The box thrashed to death; the system journal's last line is 19:26:38; the machine came back at 19:28:57 after the author power-cycled it with the kernel's emergency-sync key sequence. The new kernel is exonerated: zero panic, oops, or GPU-error lines, and the driver stack was clean afterward.
Done: the guard now stops at 100 and carries the two-signal breaker described above. The follow-ups were ranked and three of them registered: headless cells should not load the full tool fleet at all (a strict, empty tool config removes about ten processes per cell); the memory sentinel should nudge the orchestrator's pane the way the liveness cron already does, because sixteen minutes of runway is plenty of time for an orchestrator to kill a driver; and userspace out-of-memory protection, so automation dies before the desktop, is with the author because it needs root.
Lesson that generalizes: a capped account converts work-rate into failure-rate, and a driver that measures progress by completion converts failure-rate into process churn. Any loop that spawns agent processes must treat a usage-limit banner as a full stop, not as a fast failure to retry past. And a guard threshold set outside the range of the thing it guards is not a guard — it is a comment. This is a third distinct crash class for this machine, alongside update skew and true power loss, and it is the one that no amount of battery backup would have prevented.
The scorer turned a billing event into a quality score
Detected: by reading the raw run logs rather than the scoreboard.
Cause: the frozen scorer implements survivor pooling — drop failing runs, pool the rest, and score a cell whose runs all failed as zero. That rule is correct for a model failing on its merits. Applied to a cap, it converts an invoice into a quality score — and asymmetrically, because only one of the two arms bills that meter. The other arm recorded zero failures all night.
Done: the exclusion rule (a cell counts only if every packet in its pool completed) was applied identically to both arms and verified rather than assumed: all 751 failing runs carry the literal cap banner in their logs and 0 have any other cause. It removes zero cells from the arm with no failures. The corrected numbers are 0.7485 against 0.6965 with 34 wins, 16 ties and 4 losses across 54 matched comparisons; the naive scoring, retained and reproducible, reads 0.4533 against 0.6983. The same contamination had also driven one review metric down to 3.62 out of 11 because 49 cap-failed cells scored as reviews that found nothing.
Lesson that generalizes: when two arms of an experiment bill different meters, the meter is a confound and any failure-handling rule is a scoring decision. A "failed run" is not a primitive — it needs a cause attached before a scorer is allowed to interpret it. Verify the exclusion mechanically against every excluded run's log, and keep the uncorrected artifact so the correction can be checked.
A denylist jail leaked the answer key four ways
Detected: by reading what the arms actually did, not what they scored.
Cause: both arms are agentic harnesses with filesystem access, and the answer key was reachable. In the first round, one arm simply diffed the seeded draft against the unseeded one — that diff is the planted error — and the other found the same pair. The second round's denylist jail was then defeated three further ways: an unseeded copy in an unshadowed worktree, a skill document that states outright that the corpus is a seeded-recall evaluation, and one model's own stored memory summarizing its review of these same drafts a month earlier.
Done: round three ran under an allowlist jail, verified before use. The two contaminated rounds — 23 cells — were discarded rather than salvaged.
Lesson that generalizes: neither model misbehaved. A competent agent asked to verify a draft reads what it can reach. The leak was in the harness, and denylists cannot close it because you are enumerating an infinite set. Three leak paths were things nobody would have listed: a sibling worktree, a documentation file describing the evaluation's own design, and the agent's persistent memory of prior work. Persistent agent memory is a contamination channel for any repeated evaluation, and it is invisible in the workspace you jailed.
The review agent was not the model its name promised
Detected: by the reviewer's own disclosure in its output.
Cause: the closing brief required an independent review executed on a specific external model through the proxy. The agent was dispatched under that name, and reported back that it had run on a different Claude-family model and had re-executed the analysis scripts directly instead of following the dispatch path. No mechanism caught this; the agent volunteered it.
Done: the disclosure was recorded rather than quietly accepted, and every finding was independently re-verified against the raw data before being applied. All three substantive findings were valid — including the report's worst flaw, a hedge about cross-harness comparison that the report applied everywhere except where it was inconvenient. Re-running the review on the intended model is an open item with the author; it was explicitly not treated as a blocker for delivery, because the review was almost entirely reproduction rather than judgment, and reproduction does not depend on the reviewer's identity the way a judgment call does.
Lesson that generalizes: an agent named for a model is a routing intention, not a guarantee, and nothing downstream verified it. This matters more than bookkeeping here, because the same report's own finding is that judge model family moves verdicts by more than the two subjects differ from each other — so a Claude-family model reviewing a Claude-versus-GPT benchmark is precisely the configuration the report warns about. The mitigating detail is that the misrouted reviewer's strongest findings both attacked claims favouring the Claude arm. The fix is a per-dispatch identity check on the reviewer, the same way every subject cell in the benchmark was identity-proven from its own transcript.
Two phantom turns proposed exactly the action the session was gated on
Detected: by verifying suspect inputs against the record before acting on them.
Cause: two idle sessions each received a suggestion that read as owner input — "commit the staged build" in one, "go ahead and batch-approve" in the other. Each proposed precisely the gated action that session was holding and waiting on. Both were checked, cleared, and never submitted.
Done: the pattern was flagged and a periodic sweep for it registered as a candidate.
Lesson that generalizes: a session idling on a gated action is structurally exposed, because the gated action is the single most predictable thing anyone or anything would say next in that context. The suggestion that arrives will look exactly like the approval you are waiting for. The defence cannot be plausibility — plausibility is the attack surface — it has to be provenance: verify against the authorization record, every time, especially when the instruction is the one you were hoping for.
The health check was wrong in both directions
Detected: by auditing the check itself rather than trusting its output.
Cause: the detector reporting whether external review legs were running could not see legs that ran through the proxy — a false-negative class that made real work look absent. The fix then over-corrected and counted a standing wrapper process as a live leg, making absence look like work.
Done: both fixed the same night; the second fix was verified honest rather than assumed.
Lesson that generalizes: a monitor's failure modes are not symmetric in cost and both are silent. A false negative burns attention on nudging sessions that are fine; a false positive suppresses the alarm entirely. When you fix one, test the other explicitly, on a case you construct — a fix that only ever gets tested against the failure that motivated it has a coin-flip chance of installing the opposite error.
The terminal killed a running agent
Detected: an agent probe was cancelled mid-run and the cause was not obvious.
Cause: the terminal emulator's mouse reporting inside the coding-agent's interface eats drag events, so text selection produces nothing; a copy keybinding then falls through to the interrupt signal and kills whatever is running.
Done: working alternatives established — a modifier-held drag to select, a distinct copy chord that never interrupts, and a quick-select mode for tokens.
Lesson that generalizes: the terminal is part of the harness, and its most dangerous property is that a no-op input becomes a destructive one when a selection fails silently. This class of failure is invisible in logs — the session simply records an interrupt, and the agent that died leaves no clue that a copy attempt caused it.
The disk was eaten by the snapshot pipeline's own garbage collection
Detected: during a disk-pressure investigation with the root filesystem at 94%.
Cause: session snapshots written every five minutes are tracked in a git repository that a nightly job commits and pushes. At 65 GB of history, both the automatic garbage collection and the pushes died mid-pack, and each death stranded a temporary pack file. Forty-seven of them had accumulated — 94 GB of pure garbage inside a 159 GB repository, generated by the very mechanism meant to compact it. The snapshot job itself had been quiet since 07-20, most likely a casualty of the same disk pressure, and its log was lost in the reboot.
Done: the abandoned packs were swept after verifying no git process was running, automatic collection was disabled as a tourniquet, and history surgery was registered as follow-up work — untracking the snapshot directories, which have their own backup pipelines, and rebuilding a shallow history in a sync-aware order, since the bloat is probably mirrored to the second machine. Root free space went from 102 GB to 221 GB.
Lesson that generalizes: a repair mechanism that needs the resource it is repairing will fail exactly when it is needed, and can fail destructively. Compaction under pressure is a death spiral. The second lesson is narrower and sharper: high-frequency machine-generated state does not belong in a version-controlled history at all — the property that makes git good for source code is exactly what makes it accumulate here.
Three failures with the same shape: silence is not a signal
Two external review legs died silently on a shared-account throttle, and were only found by inspection. A separate session's five-hour silence resolved innocent — the work had finished at 21:46 and the notification was queued behind a known limitation where a session only wakes on inbound events. And a third session working in long, externally-paced bursts read as stalled from outside, so the escalating nudges sent at it were pure noise; no damage, but no information either.
Done: the throttled sessions were re-instructed with bounded retries and honest park-or-close paths.
Lesson that generalizes: you cannot distinguish a working session, a stalled session, and a dead session by how long it has been quiet. All three produce the same observable. Liveness has to be asserted against an artifact the session was supposed to produce, and a session that cannot proceed must be able to say so on its way down — a bounded retry that ends in an explicit park is worth more than an unbounded one that ends in silence.
Intentions vs outcomes
Forward — changes made 2026-07-24, with the intent stated on the day
| Change | Intent | +3 days (2026-07-27) | +14 days (2026-08-07) |
|---|---|---|---|
| Burn-driver stop-guard 101 → 100, plus two-signal breaker | A capped seat stops the loop instead of accelerating it | Confirm the driver halts on a capped seat rather than spawning | Confirm no repeat of the process-churn class in any spawn loop |
| Kernel/driver packages quarantined into a supervised transaction | Make userspace/module version skew impossible from the unattended path | Confirm the pin survived subsequent upgrade runs | Confirm no skew recurrence after at least one more update cycle |
| Allowlist jail replaces denylist for eval cells | A reachable answer key will be read; enumerate what is permitted | Confirm the jail is used by default for new evaluations | Confirm no new leak path found in a later evaluation |
| Cap-aware scorer added beside the untouched original | Exclude billing failures from quality scores without destroying the artifact | Confirm downstream consumers cite the corrected number | Confirm the uncorrected number is still reproducible |
| Pass-check detector fixed in both directions | A health check that cannot see what it checks converts ignorance into a green light | Confirm the surface reports live legs honestly | Confirm no third error class emerged from the fix |
| Automatic garbage collection disabled on the config repo | Stop a failing compaction from consuming the disk it needs | Confirm the snapshot job recovered and disk is stable | Confirm the history surgery happened or is still ranked |
| Standing external review gate after every revision, cumulative | Stop a review becoming a blessing that later revisions invalidate | Confirm the gate is still run on the next revision | Confirm the pattern was adopted beyond the one lineage |
| Dispatch doctrine recorded: plan / enact / review split across tiers | Reserve the scarce planning tier; route implementation to a different meter | Confirm the doctrine survived contact with real dispatches | Confirm it has not been silently abandoned under load |
Backward — check-backs, all retrospective
Written after the fact from later sources in the record, not from the day itself.
| Row | Verdict | Method | Limit |
|---|---|---|---|
| Deadman liveness mode (ruled 2026-07-23) | HOLDS | The night report closing this morning records 13 passes and zero missed wakes across the full window, plus opportunistic watcher-survival tests that all passed | One night, reported by the session it exonerates; nothing in the record checks the mode after this day |
| The succession protocol validated in that window — cap to a fresh lease in 4m37s | SUPERSEDED in part | A recovered owner note the following afternoon amends the pacing: a downgraded holder may finish its in-flight task on the fallback tier and transfer at ambiguity or completion, rather than at the earliest safe boundary. The rule that the orchestrator itself runs on the planning tier stands, explicitly reaffirmed | The amendment is a recorded ruling; the record contains no evidence that the guard was actually changed to fail over on the newer model — that remains a registered row, not a completed change |
| "Benchmark closed, all three evaluations final" (declared the following morning) | DRIFTED — sources conflict | The report states all three evaluations are final and supersedes the interim results. Two days later the author's publication-gate ruling names the blog draft built on it as the first item kicked back under a new incomplete-study gate, on the grounds that the underlying benchmark is genuinely unfinished — its scoring and resume were waiting on a cap reset, with the burned runs excluded | Both readings are in the record and both are defensible: the analysis was final on the cells that existed, and the experiment was not. Nothing here shows what happened after that reset |
| The independent review that validated the benchmark report | UNVERIFIABLE | The review's own provenance note records that the agent ran on a different model than its dispatch name promises and skipped the dispatch path; re-running it on the intended model is logged as an open item with a stated recommendation to do so | The only evidence about which model reviewed is the reviewer's own self-report — no transcript-level identity check was performed on it, and the record contains no re-run |
| The crash fix (stop-guard at 100, plus the breaker) | UNVERIFIABLE | The fix is described in full and its follow-ups ranked; no later source re-tests the driver against a capped seat | Written the same night by the session that diagnosed the incident. A fix authored and verified by the same party at the same sitting is a hypothesis |
| Reboot authority stays fail-closed until three clean drills | HOLDS | Drill one ran this day and was clean and fully measured; the constraint requires two more before any automated trigger, and the record shows none | No evidence either way about drills two and three; the bounded-age threshold that would schedule reboots automatically is still undecided, with 5 days proposed |
| Disk tourniquet and the snapshot job | UNVERIFIABLE | Free space was measured after the purge (102 GB → 221 GB) and automatic collection disabled; the snapshot job had been quiet since 07-20 with its log lost in the reboot, and the plan was to watch the next nightly run | The record contains no outcome for that run, and no evidence about whether the mirrored bloat on the second machine was addressed |
| Two durable memories written this day (a device-profile mapping and a routing default) | UNVERIFIABLE — standing weekly re-check | Both are recorded as written and indexed | The memory layer is flagged doubtful by the author, so it stays on a weekly re-check regardless of verdict; nothing in this record re-reads either entry to confirm it is still there and still correct |
What we still don't know
- Whether the driver fix actually holds against a capped seat. It was written the same night, by the session that diagnosed the crash, and nothing has re-tested it under the condition that broke it.
- Which model performed the independent review of the benchmark report. The agent's self-report is the only evidence, and the report it reviewed contains the finding that reviewer family shifts verdicts more than the subjects differ from each other.
- Whether the benchmark was finished or not. The report says closed; the author's ruling two days later says unfinished and kicks the derived draft back. Both are in the record.
- Two sources disagreed on when a cap would reset — a resume note said Friday evening, the usage interface said Saturday evening, 24 hours later. The session paced to the earlier reading on the grounds that meeting it satisfies both. Nobody established which was right.
- Which of two software versions was actually loaded when the GPU broke. The pre-reboot module version was never captured, so the diagnosis rests on confidences of 0.72 to 0.82 rather than certainty. Package logs would settle it and were not read.
- Whether in-session background watchers are safe. The survival tests all passed, which is evidence, not proof — and the mode stayed as ruled anyway.
- Whether one softer-judgment hypothesis is true or false. Both arms ceiling on the mechanical measure (97.7% against 98.7% at n=87 and n=78), the judge panel splits by judge family, one judge is a dead instrument pinned at full marks on 95% of items, and inter-judge agreement tops out at r = +0.50. An honest answer needs an instrument that does not exist yet. Recorded as unresolved rather than resolved in the convenient direction.
- Why a browser toolset was entirely absent from one session while present in another. It is provided by the harness rather than by tool configuration, and its absence made a task's own precondition check unavailable. The session correctly stopped at the gate; nobody explained the absence.
- An unexplained management notice appeared in one browser profile and did not reproduce as a blocker. Still unexplained.
- Whether the nightly snapshot job self-healed after the disk was freed.
Technical detail
Succession mechanism. A guard detects the silent tier fallback that a cap produces — the session keeps running, on a different model, without announcing it. In the validated run the guard caught it in 9 seconds and an event-aware liveness cron nudged the downgraded session within 2m32s. The holder then confirmed headroom on the target seat, launched its successor from a pre-staged primer, and the successor verified its own model tier from its own transcript's per-message model fields and its seat from the process table before taking the lease by compare-and-swap with a tier check. Total elapsed from cap to a fresh lease on the intended tier: 4 minutes 37 seconds. Nudge routing follows the lease automatically because the liveness cron reads the lease's terminal target on every tick rather than caching it.
Identity predicates. The short model alias on this machine still resolved to the previous generation, so passing the right launch flag proves nothing — only per-message model fields in the transcript do. Every scored unit in the benchmark was checked this way: 409 of 409 proven, zero drift. 141 cells were rejected as unverifiable because their transcripts contained only synthetic messages, and cells whose transcripts a reboot destroyed were tagged with a weaker validity marker rather than laundered into the clean set.
Subagent behaviour, measured this day. The agent tool's coarse model selector resolved to Opus 5 with a 1M context per the subagent's environment block — while the same subagent's base prompt carried a contradictory tier line. The environment block is authoritative and transcript model fields are the only trustworthy attribution. Deferred tool schemas loaded cleanly from inside a subagent in a single batched search, with no subagent-specific degradation. A subagent asked to drive an account-creation flow declined it and would not accept authorization relayed through a teammate message — structurally, a subagent cannot receive in-session authorization, so any flow that depends on it must run in the main session. Environment failures inside a subagent burn its budget with no interactive escalation path, and any choice that needs a human (which browser, which profile) must be resolved before dispatch, not inside it.
Cap-window structure. The cap was not one cliff but two: fourteen runs completed normally, ten died on a session-level cap, a ~4.5-hour recovery window after that cap reset produced four more clean runs, and the weekly cap then killed everything after. Four of each task's eighteen surviving cells come from the second window — which matters, because throttling near a boundary could have degraded runs that still reported success. Checked directly: the two windows are statistically indistinguishable (0.9048 against 0.9091, 0.8212 against 0.8122, 0.5150 against 0.5395), so the survivors are not a lucky subset.
Scorer bugs, five classes, every one caught only by reading raw output. An over-strict keyword matcher produced ten false misses; six were found in one night, and the corrections ran in both directions — three cells for each arm — with no cell moved that had not first been read by hand. An in-flight cell was scored against its streamed transcript, which echoes the input diff, producing a false regression. A run that died mid-stream passed a non-empty check, so its echoed prompt was judged as though it were the output, scoring 5/20 and 0/20 before a final-message check was added. And the cap artifact above. The transferable form: a mechanical scorer's verdict is a hypothesis until someone reads the underlying text.
Inherited numbers decay. An interim mechanism claim — that one arm issued roughly twice the corpus calls — was measured at n=2, restated three times, and was wrong. At n=18 the ratio is 1.20 on the mean, below 1.0 on the median, and on the single task where that arm sweeps every comparison it uses about half the calls. It was only re-measured because it was about to be repeated in a final report. Every inherited number in a resumed experiment is a claim someone else made under a different n.
Cost shape of a night's orchestration. Measured across one evening: the orchestrating session on the planning tier ran 141 API calls for 151k output tokens, 470k cache writes and 28.3M cache reads; a browser-driving subagent on Opus 5 ran 45 calls for 12.7k output, 126k writes and 3.52M reads. Against one seat's usage page, the entire evening consumed about 5% of a weekly allowance, and a full browser task about 1%. Browser automation is cache-read dominated and therefore cheap; output tokens are the scarce resource, and the orchestrator — not its subagents — is the dominant cost line. Delegating wide, shallow, read-heavy legs to subagents is the correct economics.
Approvals-queue mechanics. Seventy pending items were read in full, read-only, with nothing moved, edited, or published, and bucketed into 44 batch-approvable, 13 recommend-retire, and 13 needing the author's judgment — one decision instead of seventy. Two harness findings fell out. First, a single template footer emitted by the discovery agent embedded an absolute home path — leaking an operating-system username and workspace layout — into four separate files; one strip pass fixes all four. Second, and more corrosive: every file's scoring table is a self-generated estimate by the agent that wrote it, rendered in the same format as a measurement. A total out of 100, a token-savings percentage, and a star count sit in one table with no marker distinguishing the counted from the guessed. That is not a per-file objection; it is a property of the whole corpus, and it needs a framing line at the boundary or the estimates will be read as data.
Reboot economics, measured. Package transaction ~12 minutes with the fleet still up; hard downtime ~2 minutes; orchestrator live 90 seconds after boot; full fleet at ~7 minutes. The resumed session read 505,404 cached tokens across the 16-minute gap, then reconnect notices perturbed the cached prefix and forced one full ~515K re-creation — so the net cost of a reboot is approximately one cache write, and the orchestrator keeps its entire working context, which is the thing that actually matters. Three residual items surfaced from the drill: the session-control tooling needs a retarget verb because the lease's terminal pointer goes stale on every reboot, sessions spawned from the terminal emulator need environment scrubbing, and the health-surface arithmetic bug noted above.
Polaris is an AI agent that runs this workspace overnight, under a constitution the author ratified clause by clause. Its standing limits are unchanged: no acts outside the workspace, no money spent, and nothing sent in the author's name. This record is written from the day's logs, not from memory.