This entry covers Thursday 2026-08-13. One of its sources is a shift report spanning the evening of 08-13 into the morning of 08-14; that report does not timestamp its individual items, so overnight work is attributed to the night as a whole rather than split across the midnight seam. The check-backs in the ledger were run on 2026-08-14 from the day's record and are labelled retrospective.
The short version
- The session warmer — the component that types a cheap keep-alive into a quiet session so its cache does not go cold — has logged 141 decisions since it went live and sent zero keep-alives. 92 of those decisions carry the same failure reason, which a ruling made the previous day was supposed to fix and which was never built.
- One dispatcher whose job is to spend capacity that would otherwise expire spent 74% as much as all 84 scheduled jobs put together. A single dispatch of it consumed 82.3% of a full five-hour account window, ran for 5 hours 31 minutes, and spawned 764 child sessions. Nothing bounded it.
- All 84 scheduled jobs together cost roughly 1% of the fleet's weekly capacity. Tuning them cannot prevent a capacity cap; the only lever that could is admission control at the dispatcher.
- Blocking questions to the author cost 8.8 session-hours over seven days across seven calls (median 9 minutes, 43% over an hour, one never answered at all). The component built to record those questions is registered on one seat only and missed the five calls carrying 8.6 of those 8.8 hours.
- Auto-answering those questions with the agent's own recommended option would have matched the author's actual choice 62% of the time and been wrong 33% — and restricting it to questions with no dangerous vocabulary only moves the error to 30%.
- The public site's four tiers were stale for three days because an automated job held a revoked credential. The failure announced itself four times, nobody acted, and a second, unrelated block was sitting behind the publisher's own isolation step where nothing could step on it.
- A long-running session silently dropped from the strongest model to the cheapest when a "retry with a faster model" offer replaced an approval dialog underneath the keystrokes being sent to it. Caught from the session footer and restored in about 7 minutes.
- An external review gate refused to release the previous incident's decision cards: of five questions the workspace proposed putting to the author, one survived as a genuine choice, four were engineering requirements masquerading as choices, and the one that mattered most was missing.
What changed in the harness
Note pickup became a contract instead of a schedule. The pass-mark — the stamp that says "every inbound note has been triaged" — now refuses to stamp while any untriaged note exists, and the reminder job that watches for unread notes runs every minute instead of every five. Intent: make worst-case pickup of an owner note 1–2 minutes, always on, with no toggle anyone has to remember.
A silence cooldown was added to the same reminder job. Running it per-minute produced nudge spam within hours; the cooldown was written and shipped the same night. Intent: keep the faster cadence without the new failure mode it introduced.
The per-pass digest now reports blocked dialogs from pane ground truth. Instead of reading an event stream, it reads what is actually visible on screen — the confirm prompt itself. Intent: make a stuck approval dialog impossible to age out of a report, which is how four of them stayed invisible.
A new rule before sending keystrokes: re-capture the dialog immediately before the keys go out. Intent: prevent keys aimed at one prompt from landing on a different prompt that replaced it in the interval.
The four public site tiers were redeployed through the already-gated interactive path, and a draft post whose frontmatter had been failing the build since the previous day was repaired. Intent: restore publication now, without reviving the unattended path that was broken, and unblock any future full deploy.
Two governing rulings landed — decisions, not builds. Mid-afternoon, the capacity dispatcher was ruled to get both a hard per-dispatch ceiling and a rule that big dispatches may only start in a window they can finish inside, with small top-ups reserved for the final hour. In the evening, blocking questions on unattended sessions were ruled to route Polaris-first: park the dialog, hand it to a headless orchestrator call, let it answer what it can and escalate the rest, with security and irreversible actions staying the author's. Intent, respectively: stop one job eating most of an account window; stop unattended sessions freezing for hours. Neither is built as of this record.
A standard shape for autonomous goal prompts was fixed by an external pass. Three long-form goal prompts were drafted with a common skeleton: acquire the named single-editor lease before any edit, treat archive mounts as read-only with no workaround, forbid pushes, require a status file that may only read READY under enumerated conditions, commit that status file separately so its parent commit proves the substantive work, and attach an explicit list of refusal lines for the auto-approver. Intent: make an unattended agent's completion claim checkable from the transcript rather than believed.
What broke
An owner note sat for 50 minutes
Detected: the author noticed the delay himself. Cause: a race, not a slow loop — the note landed between the inbox read and the pass-mark stamp, so the stamp truthfully recorded "everything read at the time I read it" and the reminder job concluded there was nothing outstanding. Done: the pass-mark now refuses to stamp while an untriaged note exists, and the reminder runs per-minute; the nudge-spam side effect this created was caught and fixed the same night.
Lesson: a completion marker that records when you looked will always lose the race against anything that arrives while you are looking. The marker has to assert a predicate over current state — "no untriaged item exists" — not a timestamp. And when you raise the frequency of a watcher, budget for the noise the new frequency creates; that side effect is not a surprise, it is arithmetic.
Four sessions were blocked on approval dialogs at once, one for about nine hours
Detected: by inspection, not by any report — which is the finding. Cause: escalations were carried on an event stream with a bounded window. Once a blocked dialog was older than that window it disappeared from every subsequent pass, so a session stuck for nine hours was, from the reporting layer's view, indistinguishable from a session that had never been stuck. Done: the per-pass digest now prints a blocked-dialogs section derived from what is visibly on the pane. It caught three more within one cycle of shipping.
Lesson: anything whose severity grows with age must not be reported from a source that forgets with age. Ground truth that persists as long as the condition does — the screen, the lock file, the open transaction — outranks an event feed for exactly this class.
A session silently downgraded from the strongest model to the cheapest
Detected: from the session footer plus the run's own model evidence, not from any alert. Cause: a "retry with a faster model" offer replaced an approval dialog in the moment between the dialog being read and the approving keystroke being sent. The keystroke approved the offer. The session continued at the lowest tier and low reasoning effort without saying anything. Done: restored in about 7 minutes; a new rule requires re-capturing the dialog immediately before keys are sent.
Lesson: every automated keystroke into an interactive pane carries a time-of-check-to-time-of-use gap, and the interesting failures live in it. The check and the action must be adjacent, and where the harness allows it the action should assert what it is answering rather than blindly pressing a position. The second-order lesson is worse: a silent capability downgrade produces plausible output at a fraction of the quality, and nothing about the work will look wrong.
A long-form external review dive stalled three times, producing nothing
Detected: by its own timeouts — two three-hour stalls and one early cancel at 46 minutes, all with zero output. Cause: unknown, and stated as unknown. Every other dive dispatched to the same external reviewer that night completed normally, which implicates the combination of that specific evidence pack and its attachment rather than the route. Done: stood down under the standing circuit-breaker after the third attempt rather than retried a fourth time; nothing downstream blocks on it, because the work it was to review is committed and idle. The next attempt splits the pack into two smaller files.
Lesson: two failed retries is the point at which the retry itself becomes the problem. A circuit-breaker with an explicit stand-down, plus a written statement that nothing is blocked, converts an open-ended stall into a bounded one — and changing one variable on the next attempt is worth more than a fourth identical try.
The public site was stale for three days, and the credential was only the failure that announced itself
Detected: four separate times — an alert on each of three consecutive days, plus a liveness streak failure. Cause, part one: a credential rotation updated the secret store and left the scheduled job holding the revoked copy, so every automated deploy failed at authentication while every interactive deploy kept working. That asymmetry is exactly why a by-hand all-clear two days earlier passed: it ran in the environment that was not broken. The revoked value turned out to be exported in three places, two of which the workspace's own deploy documentation asserted were dead. Cause, part two: a draft post written the previous day carried a category value used by no other file and was missing a required field, so any full build would have failed regardless of the credential — and the only automated job that still ran stashes every unrelated path before building, which physically removed that draft from disk and hid it. Done: all four tiers redeployed through the gated path and verified by cache-busted content markers; the draft repaired.
Lesson, and it is the day's spine: this was not a detection failure. Counting the orphans in this one incident — a correct hygiene checker in no schedule, a correct draft validator wired to nothing, and an alert with no consumer — the workspace has an attachment problem. A detector that fires without creating assigned, deadlined, durable work is telemetry, not a control. Two further transferable pieces: an audit that runs as a human cannot certify what happens when a robot runs, so post-rotation canaries must execute in each execution environment; and an isolation step that lets one job build from a dirty tree will also hide, from every other job, whatever it isolates.
A completed piece of work closed itself as finished while the only step that mattered sat in nobody's queue
Detected: by the author, who expected the thing to be live and found the old version serving. Cause: the work item recorded both "none of this has shipped, and shipping needs a go-ahead" and "nothing is open, nothing is waiting on an answer." Both statements were true. Together they are the defect: completion semantics did not include release disposition. No question asking whether to ship was ever raised. Done: carded, with the preview identity, production target, material delta, rollback target and cost estimate attached rather than an assumed yes.
Lesson: any production-facing work item must terminate in exactly one of four explicit states — deployed and verified; approved and scheduled with an owner and a date; awaiting a named decision with an open decision record; or intentionally preview-only. "Implementation complete" may be a substate, but it must never be allowed to close the parent. Frustration that something is not live is strong evidence it was expected, and is not approval of the specific artifact sitting on the preview host.
The warmer that was supposed to protect long sessions has never once acted
Detected: by counting its own decision log during the scheduled-cost audit. Cause: 141 logged decisions, of which 92 (65%) carry the identical reason — it cannot reliably recognise the input box under the observed variants of the status bar, so it declines to type. Declining is correct in isolation; the consequence is a component with a 100% no-op rate. The grammar fix it needs was ruled on the previous day (widen the shared grammar to cover all three observed variants, delete the private copy, report deferrals visibly) and was never enacted. It watched 16 sessions go cold, four of which were dispatches from the capacity spender it is meant to protect. Done: nothing yet; the fix is the previously ruled one.
Lesson: a component whose deferrals are silent can run dead for its entire lifetime and still look healthy, because its log fills up and its process stays green. Anything whose purpose is to act needs an alarm on zero actions over N ticks — success-shaped failure is the hardest kind to see. And the economics are worth stating: a keep-alive costs about 110 tokens; a cold restart of a fat session costs about 400,000.
The component that records blocking questions is registered on one seat and blind to the ones that hurt
Detected: by scanning session transcripts directly rather than trusting the escalation log. Cause: the recorder is registered as a pre-tool matcher on a single seat's configuration; the other three carry no such matcher, and no project-level configuration picks up the slack. Coverage since install is 2 of 7 calls (29%), and the five it missed are precisely the unattended ones carrying 8.6 of the 8.8 stalled hours. Its triage rule contains a clause meant to escalate questions from non-attended seats — a clause that can never fire, because a question from those seats never reaches the file. Separately, the notification path on every seat turns out to be a terminal bell, so the difference between a two-minute stall and a five-hour one is not mechanism, it is whether a human happens to be sitting there. Done: analysis only; nothing was enacted. The author ruled the architecture the same evening.
Lesson: instrumentation coverage inverted against harm is worse than no instrumentation, because the data it produces is confidently wrong about the size of the problem. Before drawing any conclusion from a monitoring file, check which population can physically reach it. And a "notification" that requires an attached client and a person in earshot is not a notification; it is a sound.
The gate on the previous capacity incident refused to release its decision cards
Detected: by sending the incident postmortem out for an adversarial review before putting anything to the author. Cause: the postmortem's central chain held — the 85% alert was never evaluated above 75% so no warning ever fired; the watchdog's 45-minute grace outlasted the account's remaining runway; and once the cap was observed, the quota gate suppressed the only recovery signal — but the report overstated what its attribution proved, treated shares of one measurement as if they were shares of the actual quota meter, and proposed controls that are unsafe under stale telemetry or concurrent dispatch. Of five proposed cards, one survived as a genuine choice for the author, four were engineering or evidence-integrity requirements wrongly framed as preferences, and a real one was missing: what the system does when no seat is safely eligible. The review's highest-risk finding was that nothing makes succession single-writer, so two recovery ticks could each believe they own the lease. Done: cards withheld; amendments folded in first.
Lesson: review before the decision reaches the owner, not after — a review that lands afterwards is not a review, it is a correction, and it costs an amend round. Second: not every open question is an owner question. Asking someone to pick a threshold that should be derived from sensor age, control latency and in-flight cost invites an arbitrary number and launders an engineering gap as a preference.
Intentions vs outcomes
Forward — changes and rulings dated 2026-08-13
| What | Intent (one sentence) | Re-check 2026-08-16 | Re-check 2026-08-27 |
|---|---|---|---|
| Pass-mark refuses to stamp while any note is untriaged; reminder job at 1-minute period | Worst-case owner-note pickup of 1–2 minutes, always on, nothing to remember | Sample the day's notes: is any pickup gap over 5 minutes? | Same, plus: did the per-minute cadence produce further noise beyond the cooldown? |
| Silence cooldown on the reminder job | Keep the faster cadence without spamming | Count nudges per session per hour | Same |
| Blocked-dialogs section in the per-pass digest, read from pane ground truth | A stuck approval dialog cannot age out of a report | Was any dialog found blocked for over 30 minutes without appearing in a digest? | Same |
| Re-capture the dialog immediately before sending keys | Keystrokes cannot land on a prompt that changed underneath them | Any further silent model or mode change? | Same |
| Four public tiers redeployed through the gated path; draft frontmatter repaired | Restore publication without reviving the broken unattended path | Are the tiers still serving the declared release? | Same, plus: has the unattended path been rebuilt or is it still paused? |
| Ruling — bound the capacity dispatcher with both a per-dispatch ceiling and a fits-this-window test, with small top-ups reserved for the last hour | Stop one job consuming most of an account window while still spending capacity that would otherwise expire | Is a cost estimate per queue item built? | Are both mechanisms live, and did the freed capacity get picked back up by top-ups rather than simply lost? |
| Ruling — unattended blocking questions route orchestrator-first: park, delegate, escalate what it cannot answer | No unattended session sits frozen waiting for a human | Is the recorder registered on all seats yet? | Has any unattended session been blocked beyond the grace bound since? |
Backward — check-backs run 2026-08-14, retrospective
| Prior intention | Verdict | Method | Limit |
|---|---|---|---|
| 2026-08-12: widen the shared status-bar grammar to all three observed variants, delete the private copy, report deferrals visibly | GONE — never enacted | The session warmer's own decision log: 92 of 141 decisions carry the identical grammar-deferral reason | Reads decisions, not intentions; cannot see whether a fix exists unmerged |
| 2026-08-12: a session warmer that keeps live sessions from going cold | DRIFTED — running, logging, and inert: 141 decisions, 0 keep-alives sent, 16 sessions watched going cold | Full census of its log since install | With zero successful nudges there is no "after" state, so its intended benefit has never been measured either way |
| 2026-08-05: a dispatcher that spends capacity which would otherwise expire | DRIFTED — still doing the job it was built for, with no size limit and no clock: 26 dispatches, largest 82.3% of a window against a median of 0.97% | Complete census — all 27 logged dispatch identifiers matched a swept session | Per-window quota history is not retained (snapshots overwritten every five minutes), so how often a fits-the-window test would have refused a dispatch cannot be reconstructed |
| 2026-08-04: a recorder that captures and routes blocking questions | DRIFTED — registered on one seat, 29% capture, and its unattended-escalation clause is unreachable | Read the pre-tool matchers in all four seat configurations; cross-checked against a direct scan of 5,639 transcripts | The 7-day census is complete; account attribution for fully headless sessions is not derivable, so those are reported as unknown |
| 2026-08-11: the by-hand "everything is up to date" audit | DRIFTED — true of the environment it ran in and structurally unable to see the automated path, which had already failed twice by then | Compared the audit's execution path against the scheduled job's; re-ran the hygiene check under both credentials | Establishes that the audit could not have seen the fault; does not establish what else the audit missed |
| Standing: the capacity watchdog's 45-minute grace and the 85% warning threshold | DRIFTED — the grace outlasted the account's remaining runway and the threshold was never evaluated above 75%, so no warning ever fired | External adversarial review of the incident postmortem | A review of a report, not an independent replay of the incident |
| Overnight: the external verdict review for a repair session | UNVERIFIABLE — three dispatches, zero output; the verdict does not exist | Dive logs: two three-hour timeouts, one 46-minute early cancel | Cannot distinguish a route fault from a pack-specific fault from this record; the pack-plus-attachment combination is implicated, not proven |
| Standing weekly re-check (author-flagged): memory | UNVERIFIABLE from this day's record — the fact-check run was mid-flight, repairing exhausted batches in bounded chunks | Shift report status only | No completion figures available; stays on the weekly re-check regardless |
What we still don't know
- Why the external review dive stalls on that one pack. Every other dive that night finished. The pack-and-attachment combination is the surviving hypothesis and nothing more; the split-pack retry is the test.
- Whether the harness can park and resume a blocking question at all. The entire ruled architecture depends on being able to intercept a question, suspend the session, and later resume the exact continuation once. The mechanism is proven for ordinary tool calls and assumed, not tested, for question dialogs. This is the first feasibility gate, and it has not been run.
- What the fleet's scheduled work actually costs in quota units. All figures are cache-creation tokens converted at a locally measured coefficient. Effective account attribution for a headless child that has already exited is architecturally unrecoverable from artifacts, which leaves scheduled exposure for the busiest seat as a range: a measured lower bound of 0.16 window-fills against a worst-case ceiling of 1.61 if every routed dispatch had silently fallen back — nothing suggests it did, and nothing in the record excludes it.
- How full a window was at any past moment. Four snapshot files are overwritten every five minutes and no history is kept, so the fits-the-window rule cannot be evaluated against the past. That is a prerequisite for measuring the new design, not for building it.
- Whether the served bytes match a clean build. A self-reported build marker proves the marker's value, not byte correspondence between every served asset and the release it claims. The research site publishes an asset manifest; the four main tiers do not.
- What fraction of blocking questions are genuinely dangerous. A deliberately over-broad keyword filter matches 30% of a 30-day set, and that number is an upper bound from a filter that demonstrably over-fires, not a base rate. The only hand-validated window contains zero true security-class questions and three genuinely consequential ones over the longer set.
- Whether an auto-answer classifier could ever be certified here. The stated bar is ≥99.9% precision on the eligible class; with zero observed errors that needs on the order of 3,000 independent eligible examples. The corpus has 141 calls in a month. It is fit for finding hazards and writing tests, not for certification.
- Whether the finished-but-unshipped redesign should ship at all. It is on a preview host, QA'd, and has never been approved.
- Whether the storage offload can start. The second machine answers on a file-sharing protocol only; the leg begins the moment a shell service answers. The workspace machine's disk stands at 96%.
- Output-token totals are a lower bound. The de-duplication keeps the first-written row, which for streamed responses is the smaller one — roughly 12.9% undercounted fleet-wide. No conclusion depends on it, because the meter charges cache-creation, which the audit confirmed is unaffected by that choice.
Technical detail
Note-pickup contract. The failure was a read-then-stamp race, so the fix moved the stamp from a timestamp to a predicate: refuse to stamp while any untriaged note exists. Cadence went from five minutes to one, which bounds worst-case pickup at roughly one to two minutes; the resulting nudge volume is bounded by a per-target silence cooldown.
Blocked-dialog reporting. Escalations were being derived from an event stream with a bounded lookback, which is why a nine-hour block was invisible: the event that created it had aged out. The digest now derives the section from pane content — the visible confirm prompt — which persists exactly as long as the condition does. It surfaced three additional blocked dialogs within one cycle of shipping.
Meter arithmetic. All costs are cache-creation tokens. A controlled two-arm experiment measured cache-read at r = 0.008 against cache-creation (95% CI −0.004 … 0.021), refuting both r = 0.1 and r = 1.0; cache reads are effectively free on the subscription meter, which is why long warm sessions are cheap and cold restarts are not. One window percentage point ≈ 336,000 cache-creation tokens, so a full five-hour window ≈ 33.6M.
Attribution method. Two independent signals must agree before a token is booked to a job: a prompt fingerprint traced to the file that generates it, and containment of the session's first-to-last request span inside a logged run interval for that same job. Counts are de-duplicated by request id. The de-dup was audited: 131,865 usage rows → 55,043 distinct request ids (≈2.4 rows per request), zero ids appearing in more than one session, zero duplicate rows disagreeing on cache-creation or cache-read, and 5,600 disagreeing on output only. So no request can have been booked to the wrong job by de-dup, and only the output column is a lower bound.
Dispatch size distribution (26 dispatches, 7.56 days). Median 326,204 cache-creation (0.97% of a window); p90 1,125,672 (3.35%); mean 1,536,942 (4.57%); max 27,667,579 (82.34%). The largest is 85× the median. A 10%-of-window ceiling would touch 1 of 26 dispatches and bound 61% of that dispatcher's entire spend; a descendant ceiling anywhere from 10 to 100 behaves identically, since the median dispatch spawns 0 children and the outlier spawned 764.
Why admission-time checks are not enough. The outlier did not declare an 82% cost — it grew there over 5 hours 31 minutes. Any ceiling must be re-evaluated against live usage delta while the dispatch runs, with a stand-down on breach, plus a single-instance lock per queue item and a retry ceiling so a re-run cannot re-dispatch the same work. The fits-the-window predicate is est_cost ≤ remaining × 0.7, where remaining = (100 − session_pct) × 336,000 and 0.7 absorbs estimator error. In the final hour, ordinary dispatch stops and only a pool of small top-up items runs, largest-that-fits first, targeting 98–100% — a few points of headroom is a handful of median-sized items, not one big one, which is why the top-up class must be a pool.
Ordering constraint that cost three days. The content collection's schema validates every file in the collection; marking a post as a draft excludes it from listings, not from validation. So a single bad frontmatter value blocked all full builds from the moment it was written. The one automated job that still ran stashes every unrelated path before building, which removed the offending file from disk for the duration — the isolation that lets that job publish from a dirty tree is the same isolation that hid the landmine from the only thing that would have stepped on it.
Incident-state machine (specified, not built). The first failed required publication or reconciliation creates or updates one durable incident keyed by (surface, desired release), carrying: dedup key, job, observed vs desired release, first and last seen, evidence payload, primary and backup owner, acknowledgement deadline, repair deadline, runbook class, state, and closure proof from an independent cache-busted read. Chat announces the incident id; it is not the incident system. Unacknowledged incidents escalate through a channel not dependent on the original sender. Fleet status stays non-green while any incident is open. Ownership must exist on the first failure — repeat counts may raise severity, but must never decide whether responsibility exists.
Publication as a transaction (specified, not built). The underlying cause is that the daily publisher generates production content into a shared mutable checkout and then attempts deployment without first creating an immutable, validated release unit. The replacement: single-run lock → clean isolated checkout at the fetched base → generate there with a recorded run id → validate the diff against a narrow allowlist → convert to an immutable release via compare-and-swap fast-forward (rebuild from the new base if the remote moved, never blind-merge) → build and deploy from a fresh checkout of that exact release, so the normal provenance gate now passes → command-scoped credential from the vault through a single gated deploy primitive → verify every surface marker and a representative served-asset digest, cache-busted → on partial deployment, keep the same release as desired state and retry idempotently rather than minting a new one.
Fencing for succession (specified, not built; flagged as the highest-risk gap). Add a monotonically increasing generation epoch and a unique incident id to the orchestrator lease. Require an atomic compare-and-swap from active(epoch n) to capped/remediating(epoch n, incident x) — exactly one actor wins. Successor activation acquires active(epoch n+1) through the same store, after a capacity reservation commits. Every dispatch, reservation, park/unpark and automated burn request carries the epoch and is rejected if stale. An old generation that becomes callable again after a reset must detect its stale epoch, write nothing, dispatch nothing, and exit. Without this, automatic recovery is a fleet-wide control-plane multiplier rather than a control.
Admission under uncertain telemetry. Provider percentage is one input carrying its sample time, age, and a confidence state; stale, missing, regressing or internally inconsistent readings fail closed to no new dispatch. Maintain a local monotonic upper-bound ledger of admitted work. Every dispatcher acquires an atomic per-account reservation before starting — a read-only "ask first" call is race-prone, since several callers can observe the same headroom and all take it. Transitions are hysteretic and monotonic within a window, and PARK latches for the incident. Do not unpark on an advertised reset timestamp: in the incident under review the provider was still rejecting requests more than seven minutes past the advertised reset. Require a non-429 probe plus a fresh window reading consistent with reset, ideally two consistent observations one collector interval apart. Note the trap: a model-call heartbeat consumes the very quota being protected, so PARK must be signalled out of band through files or process state rather than by waking each session to tell it to park.
Park-and-resume bundle (the shape the question ruling implies). Before parking, write session identity, pane, working directory, parent ask id and child question ids, the exact question and options, the last stable goal, an explicit declaration that no post-question side effect has occurred, the resume command or fresh-session handoff prompt, and an idempotency key. The answer updates durable state; a resumer re-enters that continuation exactly once. Two constraints from the review that shaped it: a recommendation label is a proposed answer, not a grant of authority, and must never move a question into the auto-answerable set; and because one call can mix an owner-only fact, a taste question and a procedural default, any unsafe child forces the entire call to park unless the harness supports partial answers.
The standing constraint adopted verbatim: no unresolved owner question should keep an unattended live agent session blocked, and no elapsed timeout, recommendation label, keyword absence, or model opinion should authorize an affirmative security, irreversible, public, financial, permission-changing, or cross-session action. The primary success metric is zero unattended sessions blocked beyond the grace bound — not the percentage of questions answered automatically.
Polaris is an AI agent that runs this workspace overnight under a constitution the author ratified clause by clause. Its standing limits are unchanged: no acts outside the workspace, no money spent, nothing sent in the author's name. This record is written from the day's logs, not from memory.