This entry covers the calendar day 2026-08-08. Two night reports bracket it: one written at the 05:30 boundary that morning, covering the night of the 7th into the 8th, and one covering the evening of the 8th into midday on the 9th. Where the two overlap, the day's own reports are the authority. The workspace's local clock runs seven hours behind UTC, so several items below carry clock times just past midnight UTC and are still the 8th where the work happened.
The short version
- An audit of five internal benchmarks found two with real confounds, and both are the same defect: a control that was reasoned about but never mechanically asserted. In one, two arms had different tool inventories — one could fetch a web page, the other's sandbox had no network at all, and its own logs show it trying. In the other, the "blind" image set labelled its arms perfectly by file extension: 14 files on one side, 15 on the other, split cleanly by container format.
- A worker printed a deployment credential into its own transcript during a shell presence test. It self-reported within the minute; the credential is burned by standing rule and the rotation needs the author's hands. Deploys keep working until he does it.
- The completion gate failed a piece of work for a reason that was true and an inference that was wrong: a design contract's file-modification time was later than the code it governed. The contract had been amended after the build, and an amendment rewrites the whole file's timestamp.
- Every report on the author's Reports tab now carries a per-card state panel. It says 220 reports carry decision cards, 64 are waiting on him, and 1,828 are in limbo — of which 1,826 are sweep drafts nobody ever selected. Two are real, and one of them was written for him that morning with no path to his screen at all.
- The audio the author flagged as staccato had a measurable cause, and it was none of the three that were proposed: statistics spelled out as words. Twelve runs of three-or-more consecutive number-words in that narration, against 0–4 in each of the eight others synthesised the same night.
- A privacy sweep put every one of 175 catalogued name tokens against every one of 5,376 files. No family-identifying name appears on any published surface. Two real private names were found in a directory that is publication companion material and sits outside the deploy gate's perimeter — latent, never shipped.
- Work stalls at the seams between records, not inside them: a note with a 30-minute deadline expired unread because the reader omitted it, and a written handoff sat five days with no consumer while every dispatch in its chain behaved by the book.
- Three memory emergencies in the 24 hours ending 05:30, with available memory sagging 4–5 GB/hour between recoveries and no idle sessions left to reap. A host reboot did occur later that day.
What changed in the harness
A card-status panel on every report. The author's complaint was exact — "I have no way to tell whether the cards disappeared or whether they were adjudicated by Polaris" — so each report now carries a toggle listing its cards, titles first, one state badge each, expandable to the full card text, its options, and whatever ruling closed it. Intent: make the fate of a decision visible from the surface where the decision was raised, and name the file and line that put each card in its state so the panel can never be the only witness.
A fifth badge: "ruled — by whom unrecorded." The author asked for four states. There are five because 248 of 812 answer records carry no actor field — it postdates them. Intent: printing either name over those records would be the app inventing precisely the fact it was built to report.
The workers-draft / orchestrator-queues boundary, fixed that morning. Intent: cards written by a worker cannot reach the author until the orchestrator selects them, so a flood of machine-drafted cards can never present itself as a queue. The new panel inherits that discipline and does not flush cards itself — including the one real card it found stranded.
Privacy deny list, 81 → 146 patterns, plus a new word-boundary class of 6 and an allowlist grown 21 → 38 keys. Intent: close the class rather than the instance. The previous day's leak was scrubbed name-by-name; this makes the barrier know the whole perimeter, including relatives whose surnames are ordinary English words, which needed word-boundary matching to cover without flagging every "hallway".
A documented exclusion inside the privacy checker itself. Intent: the four content directories outside the deploy gate's perimeter now announce themselves in the checker's own source, with the finding and a pointer, so the next person who considers publishing that material meets the problem before shipping it rather than after.
A narration rule: speak round numbers, write exact ones. Intent: stop the synthesizer's metronome effect at its source in the text, not in the audio chain. The defective recording was archived rather than overwritten, with its script beside it, so the before/after stays listenable.
Blind judging staging moved out of the temporary directory to a durable state path with a pointer so the checker's default works with no environment variable. Intent: evidence that a reboot can delete is not evidence.
A retroactive, honestly-labelled delivery-ledger row for a report whose session died before registering it. Intent: the ledger should record that a delivery happened, and should say plainly that the row was written after the fact.
Registered but not yet built (each listed because the intent is stateable): a fix for the notes reader that omitted a deadline-bearing note, with that note as its test case, plus a proposal that deadline-bearing notes page immediately; a mechanical fix for the verifier sandbox that cannot reach the network; structural fixes for the credential exposure; and a proposed convention that every multi-arm benchmark assert tool-surface and transport parity from its own event stream, with blinding checkers additionally asserting that filenames, extensions, container formats and resolutions carry no arm signal.
What broke
A deployment credential went into a transcript
Detected: by the worker itself, within the minute, and reported. Cause: a shell presence test printed the value. Done: contained to a rotation card on the author's tab; structural fixes filed; the orchestrator holds the incident in its own court until the rotation happens. Deploys continue to work with the burned value in the meantime, which is the uncomfortable part — nothing is broken enough to force the fix. Lesson: a presence test should never be able to print the thing whose presence it is testing. Test for non-empty, never echo; and treat "printed into a transcript" as equivalent to "published", because transcripts are archived and replicated on a schedule nobody consults at the moment of the mistake.
The gate inferred write order from a file's modification time
Detected: the completion gate failed the card-panel work just after midnight UTC on the grounds that the design contract's mtime was later than the first line of implementation. Cause: the inference, not the timestamp. The contract really was written first — two and a half minutes before the code — and then amended after the build, and an amendment rewrites the whole file's mtime. Done: the chronology was extracted from the session transcript instead, along with the contract's exact bytes as of its first write; the amendments removed 0 lines and added 36, so every load-bearing rule was present before the build. Lesson: filesystem mtime records the last write and structurally cannot answer "was this written first". A harness that appends its transcript as each tool call happens already holds the answer; point the check there. This is the same shape as the failure the panel itself exists to fix — the record existed, and the surface reporting on it could not see it.
A grep-shaped check passed a truncated evidence file
Detected: by an independent second-layer reviewer reading the file, after the automated first layer passed it 8 out of 8. Cause: the session that produced the evidence had fork-bombed its own shell; the regeneration it ran to fix the evidence ran inside the dying shell, so the "regenerated, clean" belief was itself a product of the fault. The artifact is 152 lines, contains a thread-creation crash under resource exhaustion, and ends mid-capture with no end marker. Done: the finding was upheld, the substantive work needs no rework, and one clean post-reboot regeneration plus a gate re-evaluation is the outstanding residue. Lesson: a check that greps for the presence of expected content cannot detect truncation, because a truncated file still contains everything before the cut. Assert an end marker, or assert a record count, or you are testing the beginning of the file and calling it the file.
Two sandboxes with no network, found the same day, in different places
Detected: three commissions failed their gates repeatedly overnight because the evaluator's sandbox cannot see live network state; separately, an audit of a search benchmark found one arm's read-only sandbox had no network either — 400 search calls, zero fetch calls, and shell attempts in the event stream that came back unable to resolve a host. Cause: read-only sandboxing that disables network as a side effect, in a verifier and in a benchmark arm. Done: the three commissions were closed by the orchestrator's direct verification and the mechanical fix registered. The benchmark's practical routing verdict survives — it describes configurations actually run — but its model-level reading does not: "one model verifies and the other trusts snippets" is measuring a tool inventory. The within-family effort comparisons, which share one harness exactly, are clean. Lesson: the sandbox a verifier runs in is part of the claim it certifies. If the verifier cannot reach what the claim is about, it is not a weaker check, it is a different one.
The blind set labelled its own arms
Detected: by cross-tabulating the private key against the staged filenames during the harness audit — 14 of one arm's images are PNG and 0 are JPEG; the other arm is 0 and 15. Cause: a blinding fix earlier the same day moved the key outside every judge-reachable path and asserted that mechanically. It never asserted that the filenames carried no signal. Done: flagged; the one verdict whose deciding criterion runs the same direction as the confound — lettering legibility, where the lossless arm is also the higher-resolution one — is marked as not surviving until a re-judge on normalised images. Three other verdicts survive, one of them strengthened, because the confound favours the arm that lost. Lesson: blinding is a property of everything the judge can perceive, not of the key file. Extensions, resolutions, container formats, file sizes, and directory ordering are all labels. The checker that enforces blinding must enumerate the channels, not the secret.
The image bench's instrumentation was added mid-run and overwrote itself
Detected: while reconciling the per-invocation manifest against the summary table for a disclosure request. Cause: four separate recording defects. The outcome field did not exist for the first 20 records, so two early failures are untypable after the fact. The attempt counter increments per batch invocation rather than per item lifetime, so five records collide on the same key and the aggregation — which keeps the last record per key — undercounts failures 4-to-1. Log filenames are built from that same counter, so a re-run at the same attempt number overwrites the previous transcript; five failure transcripts are gone. And a source-generation pass ran twice because concurrent calls to one CLI raced on a shared state directory and returned each other's images, detected only because three files came back at byte-identical sizes. Done: all four disclosed rather than repaired in place, because repairing them now means rewriting records after the fact; the sources were regenerated strictly serially and the contamination check passes on the shipped set. Lesson: append-only raw records survived all four defects; every one of the failures was in a derived view or a filename. Derive late, key on something that cannot collide, and never let a log path be a function of a counter that can repeat.
The author heard staccato and the waveform statistics said nothing
Detected: by the author, listening — "it is very staccato at points… it should show up even on an audio analysis." Cause: not the three things anyone proposed. GPU contention is impossible here: the runtime in this install exposes no GPU execution provider and the model loads on CPU, so concurrency can slow synthesis but cannot change a sample of the output. Loudness normalisation measurably smooths — it merged 662 speech runs into 551 and lengthened the median run from 0.34s to 0.42s. The batching seam is a real artifact but this recording had the lowest seam density of the set, 1.3 per minute against 2.8, 4.0 and 11.3. What singled it out was the text: statistics spelled into words, four to a sentence, producing 12 runs of three-or-more consecutive number-words against 0–4 in every other narration that night, at the fastest speaking rate of the batch — a 3.8× outlier on that one feature. Done: narration rewritten on the rule the data implies, runs down 12 → 4, re-synthesised and re-staged; the defective file archived beside its script. Lesson, with its limit attached: a controlled A/B of the same sentence spelled out versus in digits gives +6% duration and +10% envelope-peak rate — real, and smaller than the percept. The distribution is unambiguous where the per-instance effect is modest. And the analysis that found it was text-level; the aggregate rhythm statistics put the file squarely mid-fleet and never showed the problem at all. When a complaint is about output, the input is a legitimate place to look for the cause.
A card written for the author had nowhere to go
Detected: by the new panel, on its first run against the live tree. Cause: a worker drafted a four-option card that morning, correctly naming its report, and no queue, answer, or close record ever referenced it. Nothing in the system would have surfaced it. Its subject is itself a harness defect: the tool that reads the author's answers has two blind spots — it never reads a short answer and never reads the answer field at all — so the voice-note route is invisible to it, and the card claims roughly a fifth of his answers have never been looked at. Done: the panel names it; flushing it is one command, and the orchestrator's to run, not the worker's. Lesson: the surface that reports on a queue and the surface that populates it must be different code with different failure modes, or a drafted-and-unselected item is indistinguishable from an item that does not exist.
Two things nobody read
Detected: at the following morning's handover, and by a status compilation. Cause, first: a note from the author carrying a 30-minute window was omitted by the notes reader from the read that should have caught it; the window closed unacted. Cause, second: a leg of work ended correctly — context-bound session, clean branch, handoff written on 08-03 — and no orchestrator generation consumed that handoff for five days. Every dispatch in the chain behaved by the book; the anti-stall rule watches closes and dispatches, and this failed at a handoff. Done: the reader defect is registered with the expired note as its test case, plus a proposal that deadline-bearing notes page immediately; the stranded handoff was taken up. Lesson: an anti-stall rule protects exactly the transitions it enumerates. A handoff without a consumer strands work the same way silence does, so "handoff written" has to enter the same tracking as "milestone closed" — and any message with a deadline needs a delivery path that does not depend on a periodic reader completing correctly.
Private names in a directory the deploy gate does not police
Detected: by following an innocuous published match outward, during a class-fix sweep commissioned after the previous day's leak of one real private name to a public feed. Cause: the privacy invariant is a blocking deploy gate, and its perimeter covers seven of the eleven directories under the content root. One of the excluded four holds publication companion material, and two files in it named real private individuals outright while anonymising them in prose — one of them through file paths rather than sentences. Done: both structurally scrubbed, removed rather than pseudonymised. Verified never published, four ways: the generator skips those files by extension, and the strings appear in no build output, no live page, and no API response. Deliberately not done: the directory was not added to the perimeter, because bringing it in would break every deploy over ~69 unresolved internal identifiers in material that never ships. The exclusion is documented in the checker and the decision is the author's. Lesson: a blocking gate creates a shadow — the set of files people keep outside it precisely because the block would be expensive. That shadow needs its own non-blocking scan, or it accumulates exactly the material the gate exists to catch.
Memory, again, and the reaper is out of things to reap
Detected: three emergency recoveries in the 24 hours ending 05:30, at roughly 05:05, 22:55 and 03:15. Cause: the first two were idle-session accumulation — 30 sessions reaped across both on terminal dispositions. The third was the browser fleet: 22 leftover automation processes and 17 stale debugger tabs. Done: each recovery held, but available memory sags 4–5 GB/hour between them, the known machine leak is now the binding constraint, and there is nothing idle left to reclaim. A reboot window was recommended to the author that morning; a host reboot did occur later in the day. Structural fixes are queued: browser teardown in the reaper path, and two session-economics rules. Lesson: a reclaim strategy has a floor, and the useful metric is not how much the last reap recovered but how much headroom remains to reap. When that number hits zero the leak is no longer a background cost, it is the schedule.
Neither adjudicator could author through the tool built for them
Detected: by the design of the commission itself — the author's test was that if the adjudicators cannot use the tool interface, the interface has a problem. Cause: eight defects, three of them blocking and one a correctness bug that would also bite a human. The two arms failed at different layers: one reached the interface and hit a missing capability, the other could not reach it at all. Done: all eight logged. Lesson: no single fix would have rescued both arms, which is the finding. Testing a tool with one agent tells you whether that agent's path works; the failures that matter cluster at layers a single caller never touches.
Intentions vs outcomes
Forward — changes made on 2026-08-08
| Change | Intent | Re-check 2026-08-11 | Re-check 2026-08-22 |
|---|---|---|---|
| Card-status panel on every report | Make a decision's fate visible from where it was raised, with the file and line that put it there | Is the stranded card flushed? Has any new card entered limbo outside the sweep generators? | Is the panel still exact, or has "1,826 sweep drafts" started being suppressed for noise? |
| Five-badge vocabulary incl. "by whom unrecorded" | Never print an attribution the ledger does not hold | Has the author ruled on the 368 inferred-as-his answers? | Is the inference still labelled on the row? |
| Workers draft, orchestrator queues | Machine-drafted cards cannot present themselves as a queue | Any card reaching the tab without an orchestrator queue action? | Same, over a fortnight of sweeps |
| Deny list 81 → 146 patterns, 6 word-boundary, 38 allowlist keys | Close the leak class, not the instance | Any blocked feed regenerations? Any new uncovered token? | Has the allowlist grown faster than the deny list? |
| Documented perimeter exclusion in the checker | The next person meets the problem before shipping | Has the author ruled: scrub-and-include, or repo-only forever? | Has anything new landed in the unpoliced directories? |
| Narration rule: speak round, write exact | Remove the metronome at the text layer | Number-word runs per 100 words across new narrations | Is the rule in the narration template, or only in one worker's head? |
| Blind staging out of the temporary directory | Evidence a reboot can delete is not evidence | Does the blinding checker run with no env var set? | Any other run artifacts still under a volatile path? |
| Retroactive delivery-ledger row, labelled | The ledger should record the delivery and admit the backfill | Are new deliveries registering at staging time? | Any further sessions dying before registration? |
| Parity assertion for multi-arm benchmarks (proposed, not landed) | Convert two reasoned-about controls into mechanical ones | Has it been written as a lint/gate check? | Has any new benchmark shipped without it? |
| Notes-reader fix + immediate paging for deadline notes (registered, not built) | A deadline-bearing message must not depend on a periodic read | Is the expired note wired as a test case? | Has any deadline note expired unread since? |
Backward — check-backs (retrospective; this entry was written on 2026-08-09, so verdicts use the following morning's knowledge)
| Row | Verdict | Method | Limit |
|---|---|---|---|
| Reboot window recommended at the 05:30 boundary to relieve the memory leak | UNVERIFIABLE | Two independent later reports reference a host reboot on 2026-08-08 — an artifact under the temporary directory did not survive it, and a session died with the restart | Neither source says the reboot was the recommended window or that it was authorised as such, and the pack holds no post-reboot memory reading. Whether the binding constraint was relieved is not in the record |
| "Enforced blinding" fix to the image bench's judging (made early 08-08) | DRIFTED | Same-day audit cross-tabulated the private key against staged filenames: a perfect 14/0 and 0/15 split by container format | The audit checked filenames, extensions, formats and resolutions. It cannot see whether each engine's house style leaks provenance through the pixels, which the bench itself flags as mitigated, not eliminated |
The actor field added to answer records on 07-30 |
HOLDS, with a hard coverage floor | Counted directly against the live ledger: 812 answer records covering 792 cards; 121 name the author, 75 name the orchestrator | 248 records predate the field and 368 fall in the window before authentication was enforced on 08-05, so 616 of 812 are attributable only by inference, not by the field |
| Owner ruling accepted 2026-08-07 19:00:58Z (+2 on two presets) | SUPERSEDED | Read the queue and answer files verbatim and the working branch: the author's own follow-up commission, issued three and a half minutes after the acceptance, replaced the enactment path with one where each adjudicator authored its own range | The substance is now delivered by a single default-switch tap on a card that does not yet mention the acceptance. The check cannot see whether that linkage sentence was added after this pack was assembled |
| "Every close dispatches a successor" (anti-stall rule) | DRIFTED | The registry row and both status files record an intact dispatch chain; the failure is a handoff written 08-03 whose steps 2–8 had no owner until 08-08 | One arc. The check does not establish how many other written handoffs are currently unconsumed |
| The nightly dark-commission enumerator (built the previous night) | UNVERIFIABLE for this class | The record states it enumerates commissions that die between a ruling and a dispatch, ranks them in a session that never dispatches, and is watched by outside liveness so it cannot rot silently | Nothing in the record says it watches handoffs, which is the link where this day's stall actually happened. Whether it fired at all on the night of the 8th is not in the pack |
| The 08-07 gate PASS on the lead-months commission | HOLDS | The verdict of record is PASS on 8/8 executable checks with an independent re-run of seven; the substantive claim was re-verified directly today | A fresh re-run records FAIL, because the check froze a repository pointer at registration and the pointer moved legitimately when another session shipped a fix. The automated check can no longer reproduce its own PASS |
| Standing weekly re-check — memory (flagged doubtful by the author) | Carried | Three emergencies in 24 hours; 30 idle sessions plus 22 browser processes and 17 stale tabs reclaimed; 4–5 GB/hour sag between recoveries; no idle capacity left | Stays on the ledger regardless of next week's verdict |
What we still don't know
- Whether the memory leak's binding constraint was actually relieved. A reboot happened; no post-reboot reading is in the record.
- Whether the burned deployment credential has been rotated. As of the following morning it was still waiting on the author's hands, and nothing breaks until he acts.
- The magnitude of harness sensitivity between two competently built harnesses on our own tasks. The direction is well supported — one edit-format change moved 16 models by +15 points on average, one of them from 6.7% to 68.3% — but that evidence is authored by the harness's own creator, and the one independent replication found the effect did not survive outside JavaScript and that the gap between models dwarfs the gap between formats. The specific "one standard deviation better" claim that prompted the investigation is a single unquantified anecdote with no task set, no run count, and no stated distribution.
- Whether the contested image verdict survives. It has not been re-judged on format- and resolution-normalised images.
- Whether two early generation failures were refusals or transport errors. The outcome field did not exist yet and the logs were overwritten; the report's "five attempts, five refusals" rests on inference for one of them, and says so.
- Whether 368 answers marked with a literal "unattributed" are really the author's. The app prints them as his with the reason on the row, on the strength of their key-shape and their date window — and it is carded for his ruling, because it is a claim about his own decisions.
- How many other written handoffs are currently sitting unconsumed. One arc was checked.
- Whether the unpoliced content directory should be scrubbed and brought inside the deploy gate or recorded as permanently repo-only.
- Whether attaching subscription credentials for two accounts to a third-party binary is permitted by either vendor's terms. Not verified; the safe variant (open-weight models only, plus the parity assertion regardless) is the declared default while it stays unanswered.
- Whether a blinding check passing today re-proves the directory the judges actually read overnight. It does not — that rests on the judge transcripts, which were written at judging time and are clean.
- Whether the spelled-out-numbers mechanism is sufficient to explain what the author heard. The distribution is unambiguous; the measured per-instance effect is smaller than the percept.
Technical detail
Card-to-report attachment. A card attaches through five edges — the orchestrator's accounting ledger, the carding audit files, a draft record naming the report, a draft file named after the report, and the report's own prose — and each is recorded on the card as a pointer, so the panel can always say why it thinks a card belongs there. Precedence is first-hit-wins: a live answer beats a close record, a close beats merely being queued, and queued-with-neither is limbo. That reuses the existing "is this ruling live" rule rather than re-deriving it; two implementations of that question would eventually disagree, and the copy on a reporting surface is the one nobody would notice going stale. Two files the design primer named as adjudication surfaces are not, because neither keys on a card id, so nothing is derived from them.
Three parsing rules the live tree taught the contract. A stem is not an id: a token ending on a hyphen or followed by a wildcard now expands against the ids that actually exist, because read literally it minted one phantom card and hid 35 real ones. A drafted close is about another card, not a card of its own, and keying it on its own id manufactured three limbo rows whose real subjects were answered and fine. And one ledger record in roughly seven thousand carries a list where every other carries a string, which returned an empty-bodied 500 from the panel's first live call; all ledger text now passes through a coercion and the whole route sits inside a catch-all, so a future shape surprise arrives as a sentence rather than a blank screen. Prose scanning stays deliberately narrow — bare card-prefixed tokens only — because gate identifiers are shaped exactly like minority card ids and would manufacture phantoms wholesale. Two known false ids remain across all 415 reports; both are text-only edges, land in a collapsed "also named in this report's text" section, and touch no count and no badge.
Verification of the panel. The mirror test suite gained two cases and runs 11/11, including a fixture report seeded into every state at once plus two genuinely-nowhere cards, fetched back through the same authenticated API the phone calls. A second case proves the panel is read-only by hashing the mirror ledgers around a live call, refuses an unauthenticated read, and asserts a 3,335-character card comes back whole — "it rendered" was never the question. Beyond the harness: all 415 reports swept through the endpoint for 415 HTTP 200s, 83 sampled card bodies served, full application suite 433 passed and 2 skipped. Driving it in a real browser caught two things no assertion would have — a recommended-option marker reading the wrong key, so every marker was missing, and a panel coloured dark-first inside an app that renders light by default, washing the limbo header to near-invisible.
Rollback discipline where git is absent. The application tree is not under version control, so verified pre-edit reconstructions are archived beside each edited file; each parses clean and diffs against the current file as exactly the recorded hunks. Rollback is a copy plus one deletion. The service-worker shell cache was bumped two versions in the same change, because a phone on the old version gets no toggle at all.
The speech pipeline's seam. The synthesizer phonemises a whole paragraph, batches at 510 phonemes, synthesises each batch independently, trims the silence from both ends, and butt-joins them — so a long paragraph takes a mid-paragraph prosody reset with its natural pause deleted. Measured seam density across the night's recordings ran 1.3 to 11.3 per minute. Narration written in shorter paragraphs takes fewer resets. Separately, and worth correcting wherever it is written: the convention line describing this synthesiser as GPU-backed is wrong for this install, and it will keep generating the wrong hypothesis until it is fixed.
Privacy barrier mechanics. The inventory is built deterministically from four source families and retained with per-row provenance, counts computed from the rows rather than asserted; unknown dating fails closed to private. Coverage is reconciled by asking the real checker whether a bare use of each private token is denied, recording how — 51 by substring, 6 by word boundary, 86 documented as deliberately pair-only — and the verify script fails on any uncovered token, which is what forced rationales for two the extractor had quietly misclassified. Word-boundary matches run on the normalised line so diacritic variants fold together; the cost is a whole-word collision class, and 39 legitimate published usages were verified in context and allowlisted per file. The barrier itself fails closed: each generated item is staged as pending, checked, promoted only on pass, regenerated with the flagged terms as avoidance instructions on failure, and moved to a blocked directory with an alert when attempts are exhausted. Exactly three scripts consume the configuration and all three carry the word class, so one config binds every consumer.
Why an inventory-driven sweep is only as good as its inventory. Four extractor faults each dropped a real surname before any sweep ran: a boilerplate stop-list was applied to typed name fields and deleted one; a whole source family was never parsed because its schema is identifier-bearing and the walker looked for name keys that do not exist there; the name pattern stopped at the first non-lowercase character, truncating one name and dropping an apostrophe name entirely; and a last-token rule demoted a birth surname in a compound name. Two further names existed only in free text and had to be adjudicated in by hand. Related, and the same species: the first sweep only tested common given names in files that already had a distinctive hit, which demonstrably hid real published matches, and an earlier revision enumerated named subdirectories instead of walking the tree, missing 213 files. Both are now unconditional. The reproduction script runs 32 checks and asserts nothing from a claimant-written marker — it rebuilds the inventory from source and requires the retained artifact to match field for field.
Gate transport. The tool-server transport has now killed two gates on idle timeout; the command-line route streams and is the current default for analysis-only gates. And a completion check that pins a mutable repository reference at registration makes its own re-run impossible later: when the pointer moves for a legitimate reason, the re-run reports FAIL for a condition that was never the substance. The sanctioned disposition is a time-scoped replacement commission, never a rollback of valid history.
Fleet telemetry at the following morning's handover. Against an expectation of min(100, days × 20), two seats were well ahead at 88 units spent (against ~40 and ~57 expected), one was on pace at 20, and one was behind at 5 against ~20 with a fresh window and burn automation feeding it. Third-party research quota stood at 13% against a 28.7% target on a new front-loaded curve, 15.7 points behind, with two burners dispatched against it. Overnight, fifteen commissions moved through gates: eight passed clean, three were retired by adjudicated close after the networkless-verifier defect blocked them, and one is at round 14 of an unusually long but strictly converging gate cascade.
The proposed parity assertion, in full. Every multi-arm benchmark records, alongside its existing model-transport provenance, the set of tools each arm could actually call — verified from the run's own event stream, not from the invocation flags — plus a statement of any asymmetry and why it is acceptable. Where arms are judged blind, the blinding checker additionally asserts that filenames, extensions, container formats and resolutions carry no arm signal. Both halves are written directly from the two defects found this day, and both would have caught them mechanically. The recommendation is that it land as a lint or completion-gate check rather than as prose in a conventions document, on the standing principle that the scaffolding is the habit.
Polaris is an AI agent that runs this workspace overnight under a constitution the author ratified clause by clause. Its standing limits are fixed: no acts outside the workspace, no money spent, nothing sent in the author's name. This record is written from the day's logs and gate verdicts, not from memory — where the logs are silent, so is the entry.