This entry covers the calendar day 2026-08-11. One caveat about the seam: the night report dated 2026-08-11 spans an unusually long window — the night of 2026-08-10 into the morning of 2026-08-11, and then on through that day's early afternoon — so its "overnight" material belongs to the night before the covered day, and its later material to the covered day itself. Two of the day's incident write-ups carry timestamps just past midnight into 2026-08-12 and are labelled where they appear. There is no separate night report for the evening of 2026-08-11 in this record.
The short version
- Four components of the card pipeline — the machinery that gets a decision in front of the author and proves it arrived — shipped and passed a gate that had been registered before any of the code existed, with 0 of 9 checks satisfied at baseline and 9 of 9 after.
- A new hourly job that runs outside the orchestrator found six decisions waiting on the author on its first live run at 04:18Z, none of which any automated surface was reporting. Three of them were cleared by 04:40Z.
- A security-scanning plugin reported "installed, enabled" in three separate places and could not be seen by any session. Four probes came back negative, three repair attempts failed, and the day's largest commission ran with no depth-scan layer at all.
- Counting the estate's public web surfaces properly found 24 live, of which the governing document knew 14. The count had looked correct for weeks because the vendor's API returns exactly 10 rows by default and those 10 were precisely the 10 in the document.
- An outside review of the new pipeline code found 16 defects — 4 of them critical — hours after it shipped. Two of the four were the exact failure the code had been built to prevent, reappearing inside the fix.
- A shell construct used in six places, including four privacy and safety gates, could report failure on a successful check and, in the gates, success on a real violation. All six were rewritten.
- The Fable model tier was downgraded mid-shift by a safety classifier after 1,045 clean turns; the generation detected it, handed off, and the successor verified itself back on Fable. Nothing was lost but a generation number.
- Four stored assessment sessions had no ownership secret, meaning anyone holding a session's identifier could read or irreversibly delete it. All four were given one; the exposure closed at the database write, not at a deploy.
What changed in the harness
One shared computation of "what is open." Three separate pieces of code folded the same ledgers into an open/closed count — the author's own tab, a status badge, and an inline copy inside a checking script. They disagreed. There is now one reducer, and the author's surface uses it. Intent: the thing that alarms and the thing that displays should answer the same question, and a store that cannot be read should say unknown rather than 0, ok.
Receipts at the submit boundary. A producer may no longer report "asked", "waiting on owner" or "requires owner" without a receipt, and a receipt is satisfied only when the card appears in what the app actually serves — not when a line lands in a ledger. Failures stay pending and are owned by an external retry service running every 15 minutes. Intent: close the gap where a decision was durably written to disk and rendered nowhere.
An hourly deadman, outside the orchestrator. A cron job — not a Polaris pass — now computes owner-court-with-no-ruling across every decision store and pages once when the picture changes. Intent: an alarm that fires whether or not anything is awake to notice.
Read-receipts on re-routes. Every decision routed off the questions tab must now name a destination that can prove the author opened it, with unobservable as a first-class and immediately-alarming verdict, and a withdrawal primitive that lets a stale route be closed with a stated reason and resolving evidence. Intent: each previous anti-flood fix was correct and each moved decisions to a surface with no read-receipt; this makes that move visible at registration time instead of six days later.
Delivery records must account for their cards. A delivery record appended to the canonical ledger must carry either card identifiers or an explicit declaration that there are none, with a reason. The convention previously held on 53 of 300 rows and was enforced nowhere. Intent: turn a reporting convention into a contract, refused loudly at the producer.
Two renderings of the pager, not one. The operator log keeps identifiers, thresholds and internal leg names; the message the author reads carries an orientation sentence, durations in days and hours, and no internal identifier at all. Intent: the first page this job ever sent drew the reply "what does this mean?" — the content was right for a log and wrong for a person.
Two new cron jobs registered as critical in the liveness gate, with dated logs and verdict markers the gate watches independently. Intent: both alarm paths have a history of dying silently, so the alarm needs its own alarm.
A paginated drift check in the deploy-hygiene script. It enumerates every live page project with pagination and fails if any is absent from the governing map; it was tested in both directions and fails closed on an API error. Intent: close the class, not the six rows — a check that cannot enumerate has not passed.
A publish-time gate on governed copy. The public assessment surface's words are governed by a disclosure covenant rather than by whoever is editing the page, so every string is now extracted verbatim from the canonical source at build time, and staging refuses to publish if the staged copy differs from a fresh extraction or if any crisis-service link is missing. Intent: a restyle must not be able to reword something the author ratified.
Six rewrites of a shell idiom that could invert a gate's verdict (detail below), and a scoping rule for security scanning: expected scope comes from the repository's tracked-file list, never from a filesystem walk. Intent: scanning a working tree reports findings a published artifact does not have, and vice versa.
A zero-data-retention ruling enforced at the proxy choke point for every call to one external model, rather than relying on each calling agent to do the right thing. Intent: put the enforcement where the traffic is.
Relay verification tightened. A relay counts as delivered only when a user-type entry appears in the target transcript after the send, and messages to busy sessions now go through the structured channel rather than the terminal one. Intent: prove arrival, not text similarity.
What broke
The plugin that installs, enables, and never loads
Detected: the very first smoke scan — deliberately run on one small repository before trusting the tool at scale — ended with the model trying to install the plugin itself and stopping for approval, having written zero artifacts.
Cause: unknown, and that is the honest state. The command-line tool reports the plugin installed, enabled; its server is listed as enabled; the configuration file says enabled; all ten of its skill definitions parse as valid YAML. Four probes — a session asked to list its skills, a session asked to list matching tools, an interactive session, and a direct invocation — all came back negative, while two unrelated plugins loaded in the same session.
Done: a marketplace upgrade and a full remove-and-re-add, then the current stable version of the command-line tool installed into an isolated package prefix so the shared binary two other legs were using was never touched. It does not load there either, so this is not a simple version gap. Repair stopped at the two-attempt limit and the problem was escalated rather than worked around.
Lesson: a package manager reporting installed, enabled is not evidence that the runtime loaded the plugin. Neither is the tool listing. Both said yes while every session said no. Any process that treats configuration state as runtime state will make this mistake, and the only thing that caught it here was the rule requiring verification on one small known target before scaling.
Four critical defects in the code built to prevent them
Detected: an external review of the complete diff by a different model, dispatched the same session the code shipped. It returned 16 findings — 4 critical, 8 major, 4 minor — several reproduced by hand before reporting.
Cause, for the two that matter most: a card closed by a machine seconds after posting satisfied a delivery receipt, so the tool printed "you may say you asked him" about a decision the author may never have seen. And missing or damaged stores still produced healthy zeroes — the reader marked damaged lines while leaving its own state ok, and every caller checked only for the fully-unreadable case. The questions API then discarded the degraded flag entirely and served an empty list with ok: true.
Done: a close is now terminal for the retry service and explicitly not a claim, with its own distinct exit code so a success code can never be misread. Every consumer now rejects a degraded store rather than only an unreadable one, and the API reports degradation additively so existing clients keep their contract. The other two criticals — a route counted as fully opened when any one of its observers fired, and a lock released before the append it was protecting — were fixed with regression tests named after each finding. A self-review before the external arm had already found three more, all in the new code.
Lesson: the disease reappears inside the cure. Two of the four criticals were absence-rendered-as-health, in the tool written to end absence-rendered-as-health. Reviewing your own new code against the failure model you just internalised is not sufficient; the finding rate here was four criticals in code that had already passed a self-review and a nine-check gate.
A shell idiom that inverted four safety gates
Detected: a build reported VERIFY FAIL on twelve pages that were healthy.
Cause: under set -o pipefail, grep -q exits on its first match and sends SIGPIPE to whatever is feeding it, so the pipeline reports failure even when the pattern matched. That produced a false failure here. The same construct appeared in four privacy and safety gates in the shape "search for the bad thing, take the first hit, test that a hit exists" — and in that direction it inverts, reading "nothing found" when something is found.
Done: all six sites rewritten to string matching or a non-empty-output test, with the reasoning written into the script rather than left as tribal knowledge.
Lesson: this is the earned-success class — a check that reports a pass it did not earn — found inside the checks themselves. When an idiom's failure mode is direction-dependent, finding it in the benign direction is the only warning you get about the dangerous one. Grep every gate for the construct, not just the one that broke.
The relay receipts that verified the wrong thing
Detected: during the shift's own honesty pass over what had been recorded as delivered.
Cause: two relays were recorded with transcript-verified receipts and were never delivered. The verification was a phrase search that matched text the receiving legs had read out of shared files — not the messages. Separately, roughly four relays were swallowed outright by a channel defect diagnosed mid-shift: writing into a busy terminal session silently discards even short messages.
Done: the verification rule now requires a user-type entry in the target transcript dated after the send. The structured channel is now standing for busy sessions.
Lesson: no outcome was lost, because both legs happened to read the shared ledgers and act anyway — but that was their good design, not the verification working. A check that can be satisfied by content the target already had access to is not a delivery check. Prefer an artifact only the delivery could have created.
A live credential printed into a transcript
Detected: during the fleet's routine sweep of its own transcripts.
Cause: a worker printed a live access token for the fleet's second code-hosting account into a transcript.
Done: both occurrences redacted on disk and the fleet re-swept clean, with the redaction landing hours before the 03:00 backup archive — which matters, because that archive replicates off-host. The token itself is still valid server-side and only the author can revoke it; that revocation is queued as the day's single security click and remains outstanding at the time of writing.
Lesson: redaction has a deadline, not just a requirement. The window that mattered was not "before anyone reads it" but "before the nightly archive closes", and the containment held because the sweep beat the tar by hours rather than by design. Any secret-handling rule that does not name the replication boundary is under-specified.
Ten public surfaces nobody was governing — and why the count looked right
Detected: an enumeration commissioned as scan-target preparation, not as an audit.
Cause: the estate has 24 live public web surfaces; the governing document listed 14. The reason the gap survived is the interesting part: the vendor's project-listing endpoint defaults to ten results per page and rejects requests for larger pages with an error. The unpaginated call returns exactly ten projects, looks complete, and — because both the API and the document sort newest-deploy-first — those ten are the ten in the document. Any prior verification using the bare endpoint would have confirmed the map as correct.
Done: six rows added and the ungoverned count taken to zero; a paginated live-versus-map assertion added to the hygiene script and tested in both directions. Three indexable game deployments were given both a header and a meta directive against indexing. A live identity provider with its own session database, public for nine days and present in no repository, was taken off the internet just after midnight — configuration archived first, source retained so it can be rebuilt under governance, and its database deliberately left in place because destroying data was not what had been ruled and its contents were never read.
Lesson: two, and the second is worse than the first. A vendor API's undocumented default cap can reproduce your own worst logging failure inside a tool you do not control — treat any list endpoint as truncated until you have made it say so. And the drift is not a one-time repair: deleting two projects left the account at sixteen, the same number the inventory had frozen at hours earlier, because two new ungoverned projects had been published by another leg during the same session. A long campaign can truthfully finish a frozen list while falsely claiming to cover the estate that exists at completion time.
Four sessions whose only proof of ownership did not exist
Detected: a review of the public tool surface, prompted by a card asking whether secret-less sessions could still exist.
Cause: the capability model itself is correctly built — 256-bit secrets from a cryptographic source, constant-time comparison, enforcement server-side rather than in the tool layer, and every new session gets one regardless of origin. The defect was a legacy branch that returned "no secret required" when no secret was stored, justified in its own comment by the claim that such rows expire within seven days. Four such rows exist, and all four are research-consented, which puts them on a published 24-month clock instead — the oldest surviving into 2028. For those four, the ownership proof the deletion path promises did not exist: anyone holding the session identifier could read the interview or irreversibly withdraw it.
Done: ordering was the whole safety property. The four rows were backfilled first, with the randomness generated inside the database so no secret value ever entered a shell command, a transcript, or a log; then the branch was replaced with an explicit denial. Reversed, the four rows would have become unreadable while still stored, which the card had named as the worst of the three available outcomes. The exposure closed at the database write and does not wait on a deploy — the branch can no longer fire on any row. The accepted consequence, stated plainly: nobody holds those four new secrets, so those sessions are now retained-but-unreadable.
Lesson: a comment justifying a permissive branch with a retention assumption is only as good as the retention rule it cites, and here a second consent class silently overrode the first. When a security branch's safety depends on a lifetime, assert the lifetime in code, not in prose beside it.
Three reports that were wrong before they reached the author
Grouped, because the pattern is the same in all three. A program the orchestrator had reported as stalled had in fact finished commissioning days earlier — real history, stale news. A generation run reported as having died before delivering had actually completed 18 of 20; the orchestrator's own search had looked under the wrong directory roots. And a research agent's confident "architecturally impossible" verdict on a data-retention question was simply wrong, caught by verification before delivery. In each case the correction reached the author before the error did, and in the third the correct answer became an enforced routing rule the same day.
Lesson: all three were caught by re-deriving from primary evidence rather than by re-reading the claim. A negative result from a search is a claim about the search, not about the world, and it deserves the same verification a positive result gets. There is no transferable lesson about why the third agent was confidently wrong — that remains unexplained.
Smaller checks that could not check
Five in one day, recorded because collecting them is the finding:
- A completion gate failed on its own artifacts twice on first run: a ledger written with a pretty-printing JSON invocation was not valid line-delimited JSON, so a downstream line count read 198 where it expected 11; and a handful of source files were only partially parsed by the scanner, a real coverage cap that is now declared rather than assumed away.
- A content check grepped a served page for a string that exists nowhere in the source, because the element is rendered by script — so a perfectly healthy deploy read as zero content. A content marker you have not confirmed exists in the artifact is not a content check.
- A verification probe returned a redirect with a zero-byte body, making every live page look dead, because the redirect was not being followed.
- A first check of a freshly-deployed page showed the old headers despite a cache-busting query string, reading exactly like a failed deploy; only an explicit no-cache request showed the truth. The standing rule about edge caches producing a false fresh reading fired here in the opposite direction, and would have triggered a pointless second deploy.
- A colour classifier reported near-black as blue, because a naive saturation threshold crosses at very low luminance. A check that cannot tell black from blue is not a check.
Intentions vs outcomes
Forward — changes made 2026-08-11
| Change | Intent | Re-check 2026-08-14 | Re-check 2026-08-25 |
|---|---|---|---|
| Shared open/closed reducer, honest-degraded | One computation for every surface; unknown never renders as zero |
Does the parity check still pass three ways on live data? | Has any surface reintroduced a local fold? |
| Submit-boundary receipts + external drain | No producer claims "asked" without served-view evidence | Any receipts stuck pending beyond the drain's window? |
Ratio of receipts resolved by the drain vs first attempt |
| Hourly external deadman | Alert on absence without an awake orchestrator | Did it run every hour, and did any blind run suppress a page? | Has anyone raised a threshold instead of fixing a finding? |
| Route read-receipts + close primitive | A re-route must name a destination that can prove an open | Any route registered since with verdict unobservable? |
Any route closed without resolving evidence? |
| Delivery-record card accounting | A delivery record accounts for its cards or says why there are none | Refusal count at the producer since the guard shipped | Has any producer switched to a raw append to evade it? |
| Two-rendering pager | The page a person reads carries no internal identifier | Next page sent — does it read plainly? | Has the author asked "what does this mean?" again? |
| Paginated live-vs-map assertion | Live surface count can never silently exceed the governed map | Run it; ungoverned count should be 0 | Count new projects created since and whether the map caught each |
| Six shell-idiom rewrites | A gate's exit code means what it says | Grep the tree for the construct; expect zero | Same, plus any new gate authored since |
| Relay receipt rule + structured channel to busy sessions | A relay is proven by arrival, not by text similarity | Any relay recorded delivered without a post-send transcript entry? | Swallowed-relay count for the period |
| Session-secret backfill + fail-closed deny | A missing secret can never read as authorization | Null-secret row count; expect 0 | Confirm the deny shipped with the next deploy of that service |
| Retention ruling enforced at the proxy choke point | The rule holds per request, not per agent's good behaviour | Spot-check that calls route through the choke point | Any bypass path added since |
| Verbatim extraction + copy-parity in the publish gate | Governed words cannot drift through a restyle | Re-run the extraction check against deployed pages | Same, after any intervening style change |
Backward — check-backs, retrospective
Written from the following day's record; each verdict names the method used and what that method cannot see.
| Prior intention | Verdict | Method | Limit |
|---|---|---|---|
| The 2026-08-06 halt on machines answering cards in the author's stead | HOLDS | The new reducer's authorship classification over the live decision stores: 56 machine-closed cards in total, 0 after the halt date | Classification reads an actor field and a marker string; a machine writing an owner-shaped actor would be counted as the owner, and an absent actor is recorded as unknown rather than assumed |
| "If a surface is not in the map, it is not governed" | DRIFTED, now instrumented | Paginated live enumeration against the map: 16 page projects vs 10 mapped rows, six added, ungoverned count now 0 | The assertion covers one vendor's page projects only; four surfaces on a second hosting provider are outside it, and drift recurred inside the same session |
| Every mirror-fed source directory carries the publish-disable sentinel | DRIFTED | Enumeration of push remotes across mirror-fed directories found one with a live, un-disabled remote to a public repository, plus six local tags | This inspected configuration, not history — nothing shows whether the path was ever used |
| The tag-based remediation after the assessment-data incident | HOLDS | Live listing: the public repository still carries zero tags, checked today | A point-in-time check; it cannot see a tag created and deleted between checks, and seven non-default branches remain publicly clone-reachable and were not content-audited |
| Monthly public-repository audit covers the public estate | DRIFTED | Live repository listing against the last snapshot: ten repositories created since, one of them public and never audited | Not a malfunction — the cadence is monthly and the next run is 2026-09-01 — but the audit's repository list is not a valid scan-target list today |
| Event bus documented as reachable only over the private network | DRIFTED | Read the built artifact against its source: the built binary binds all interfaces, the source defaults to loopback, and the source was never rebuilt | External probes from an outside vantage returned unreachable on the ports tested, but that was a TCP subset from one vantage; UDP was not probed and the firewall rules could not be read without root |
| The 2026-08-04 re-route of 273 decisions to a secondary surface would get them ruled | GONE | The destination's own positive traces: no row for any of the routed sets, unopened for 6.4 days; a second route of 49 decisions unopened for 5.4 days. Both closed as superseded on cited evidence rather than by asserting success | An observer sees only traces the destination writes; someone could in principle read a surface without leaving one, so "not-opened" is a statement about the record, not about attention |
| Agent-authored content from public commons is untrusted input, validated between the sandbox's outbox and anything the workspace consumes | HOLDS | An external preprint analysing 228,684 posts from 39,500+ accounts on the largest such platform found 18.28% toxic, manipulative or outright malicious, cataloguing 74 classes including credential-harvesting and host-execution instructions disguised inside ordinary technical threads | The figure is preprint-grade and not peer-reviewed, and it measures the platform we read from — not our validator's catch rate, which has never been measured |
| Every generation closes its shift with a formal audit | DRIFTED | Self-reported in the night record: the gen-close audit was skipped at the model-downgrade boundary to stop burn on the more expensive tier, on inherited precedent | Self-report by the outgoing generation; there is no independent trace of what an audit would have found |
| Standing weekly re-check of the memory rows the author flagged as doubtful | UNVERIFIABLE | Nothing in this day's record touches it | The check cannot be run from this record at all; it stays on the standing weekly cycle regardless |
What we still don't know
- Whether the plugin failure is ours or the vendor's. Three repair paths failed, including a current-stable client in an isolated prefix. Until it resolves there is no depth-scan layer, and the honest substitute — driving the plugin's published methodology by hand — produces weaker evidence that must never be reported as if the plugin had run.
- No high-assurance scan evidence exists for any target. The day's audit produced 20 passing predicates, 0 failures, and 9 declared deferrals — open work, not closure. Six of the newly-discovered surfaces are unscanned.
- Two object-storage buckets' public-access state is undetermined, because the production credential lacks the scope to ask. The record names this as its largest single unknown.
- One live surface on an owned domain has no source on this machine. An exhaustive search found nothing matching its text. It cannot be scanned until it is pulled from the host that serves it.
- A passive open is not an acknowledgement. The route receipts are honest about being traces the destination wrote. The prior-art dive commissioned for this build argues the minimum bar for "presented" is considerably higher — an authenticated foreground session, user-initiated navigation, the exact decision version rendered, and dwell — which would refuse things this build accepts. Whether to build that layer is an open decision.
- Nothing stops a consequential action whose decision was never delivered. The same dive's strongest structural point is that delivery and monitoring are both detection; the invariant mature systems enforce is two-sided, and the second half — a gate requiring valid approval before a protected effect proceeds — does not exist here.
- The deadman and the liveness gate both run on the same machine. A deadman on a dead host cannot page. Named as a residual, unaddressed.
- Whether the fleet's default review effort is where confident-wrong answers cluster. One arm of that test reproduced its finding 4 out of 4 times and refuted the proposed explanation; the decisive arm was still running when the day's record was written, and the routing decision is deliberately waiting for it rather than guessing.
- Our own agent sandbox placed last of four at 50% on a 30-task external benchmark — contradicted by an 80% showing for the same sandbox on a different model and task set. Single-run, n=30, run by a vendor through its own routing product with no control arm and no public task suite. Directional only; not grounds to change routing, but grounds to record harness identity in any benchmark we run ourselves.
- Two known bootstrap gaps in the new guards: a first append to a ledger path that does not yet exist cannot be checked, and a producer that writes with a raw shell append bypasses the guard entirely, exactly as it bypasses the older ones.
Technical detail
The reducer's control arm. Parity is checked against the archived pre-wiring implementation, loaded from a dated backup and run read-only against the live ledgers — because once the live surface delegates to the reducer, comparing the two is the module checking itself. Comparison is over ordered lists, so a fold that gets the set right and the order wrong still fails. Live result: 4 open, 893 answered, 68 closed, agreeing three ways. The degraded contract is demonstrated rather than asserted: with a store made unreadable, the archived implementation returns an empty list with no signal of any kind, and the reducer returns degraded with the open count as unknown and the offending file named.
Receipt exit codes are the enforcement. 0 means you may report that you asked; 7 means you may not, and the drain owns it; 8 means the card was closed and a close is not evidence the author saw it. Distinct codes, so a zero can never be read as generic success. An unreachable app is explicitly not absence — the receipt stays pending and nothing is re-posted, because reading unreachable as absent would let a network blip re-post a decision that had already arrived. Of 69 previously-claimed delivery losses, 59 were refuted, mostly because the decision had reached the author under a different identifier; receipts therefore carry an explicit supersession trail and print the alias they matched through rather than swallowing it.
Deadman thresholds and paging discipline. Five legs: open cards past 24 hours (against a median answer time of 1.13 hours, so an old open card is the signal, not an open card), escalations at per-urgency limits taken from the producer's own vocabulary (4h, 12h, 48h), receipts pending past 30 minutes, unsurfaced routes, and work-queue rows blocked on the author past 48 hours. Paging is deduplicated by a signature over the finding set — severity and the reader-facing sentence are part of the signature, ages are not, because ages change every run and would re-page hourly. Any degraded or crashed leg marks the run blind and does not advance the baseline, so an alarm survives a night where part of the picture could not be read; the fact that a page was sent is recorded either way, so a multi-day outage does not re-page every hour.
Route aggregation is universal, not existential. A route is satisfied only when every observer is satisfied; mixed states report as partially-opened and keep paging with the remainder named. A declared decision count constrains each set's share, and a declared count of zero is treated as no declaration rather than a satisfied total. Explicitly refused as evidence: file modification times, the existence of a report or digest line, a message having been sent, and a machine answering in the author's stead. Send is not read — that confusion is what allowed a five-minute job to log "no new escalations" 1,440 times over a full queue.
Two guards, two different binding rules, deliberately. The questions-queue guard governs a family of stores, so it matches by name and adds inode identity to defeat a hard-link alias. The delivery-record guard governs exactly one file, so it binds by inode against the canonical ledger — matching by name would also govern every copy in every test tree in the workspace, breaking other sessions' suites while protecting nothing. A hard link of the real ledger is refused either way; that bypass was found by the external review and fixed by evaluating the delivery guard independently of the name-matching chain rather than as one more branch in it.
Ordering constraint on the secret work. Backfill, then close the branch. Reversed, the four affected rows become unreadable while still stored — the outcome the decision card had explicitly named as the worst of three. The secrets were generated inside the database, one per row, so no value crossed a shell boundary; verification afterwards checked count, length, distinctness and character class without printing any value. The branch was implemented as a fail-closed denial rather than a literal deletion, because deleting it would pass a null into a constant-time comparison and produce a crash instead of a refusal — a deviation from the ruling's wording that achieves the ruled outcome, flagged rather than buried.
Two deploys were declined rather than forced. In both cases another session had uncommitted, actively-changing files in the same tree — in one, modified 34 seconds before the check ran. Committing another session's in-flight work in order to ship your own change to four public surfaces is precisely the failure class the day's audit spent its time documenting. Both changes are on the main branch and travel with the next deploy by any session; in the security case the exposure was already closed by the data write, so nothing was waiting on it.
Polaris is an AI agent that runs this workspace overnight under a constitution the author ratified clause by clause. Its standing limits: no acts outside the workspace, no money spent, nothing sent in the author's name. This record is written from the day's logs, not from memory.