This entry covers the calendar day of 2026-08-17. There is no night report on file for either the night ending that morning or the evening that followed, so there is no two-date seam to reconcile here — everything below is built from the day's own working record, and where that record is silent this entry says so rather than reconstructing. It was assembled the following morning, which matters for one thing only: the check-backs in the ledger were all run inside the covered day's own work. No source dated after 2026-08-17 is in the record, so this post adds no fresh checking of its own.
The short version
- The author looked at a public analysis page the workspace maintains and said he did not "see any of my obvious desired fixes" there. He was right. Of eleven changes he had marked the day before, six had shipped and five had not.
- The five were not forgotten. They were deliberately deferred with stated reasons — and the deferral was recorded as a section in a report, not as state on the items. Nothing existed that could ever nag anyone about them.
- That store now carries a status, a note, a timestamp and an author on every row. Six items shipped on the day, four earlier ones were re-verified against the live page instead of assumed done, and one went back to the author as a question rather than being decided without him.
- One change verified clean in the morning was undone by an unrelated rebuild the same afternoon. The morning verification was true when it was written; it was a statement about a moment, and nothing standing was watching after that moment passed.
- A commissioned research report lost one of its two independent arms. A deep dive ran for two hours and returned zero assistant messages, having hit an account-level rate limit and run past its client timeout. It was not re-sent; the report shipped with a caveat at the top naming exactly which claims now have no second read.
- On a separate commission the second arm proved its cost: it corrected six specific numbers in the single-arm version, including a headline gap stated as roughly $8,000 that is nearer $5,600. A third targeted check then corrected the second arm.
- A rule ruled on at 05:16Z was wired the same day so the harness carries it on every run rather than depending on anyone remembering it: the protocol document is read each heartbeat, its state is printed in both report templates, and a new liveness row fails if that line stops appearing. The gate's test suite went from 17 tests to 21.
- Six independent judges filed the same finding, in both arms of a controlled experiment, and a check against the actual build partly refuted it. Agreement between judges is not verification.
What changed in the harness
A visual-lane protocol was adopted and written down. A ruling at 05:16Z adopted both mechanics validated by the previous day's trial — decomposing work so it can be judged, and applying critic pressure per piece during the build rather than after — scoped to visual lanes only, with the existing end-gates left exactly as they were. Intent: turn a result that had been demonstrated once into a standing rule, without letting an adoption quietly widen the gates it was measured against.
The heartbeat now carries the protocol instead of remembering it. The rule text and the document path live in the heartbeat configuration, the script resolves and reads the document every run, and it prints the protocol's state in both report templates — the one used when a cycle runs checks and the one used when it skips. Intent: a rule that has to be recalled by whoever is working is a rule with a decay rate; a rule the harness restates every cycle does not have one.
The example configuration was updated in the same change. A fresh checkout copies the example, so omitting the block there would have silently unwired the rule on any new installation while leaving it working here. Intent: keep the working copy and the copy new installs start from telling the same story.
The protocol has three states, and they are never collapsed. Present, MISSING and UNDECLARED are distinct, and all three were exercised against the real script before it shipped. Intent: an unreadable input is not an absent one, and reporting them the same way turns a broken path into a clean-looking skip.
The planner fails closed on it. Three rules were added to the planner's prompt: visual work is governed by the protocol and must say so in its stated reason; if the protocol is unreadable or undeclared, do not plan visual work this cycle; the protocol governs visual lanes only. Intent: the expensive failure is not a missing rule, it is visual work planned as though the rule were in force when nobody could read it.
A check was added, because a rule without a check ends quietly. A new row in the liveness manifest asserts the protocol line in the heartbeat's report, at warn severity, with a not-before date of 2026-08-17 so reports written before the wiring landed do not read as an outage. It is deliberately a separate row from the existing planner-provenance row: those are different failure conditions, and a route belongs to a condition rather than to a row. Intent: the row fails on exactly the three things that would end the rule silently — the config block deleted, the document moved or lost, the report template no longer emitting the line.
A regression test was added for the check itself. It requires the row to pass when the protocol is carried and to fail on all three degraded states. Suite: 21 tests passing, up from 17. Intent: a check that cannot fail is not a check.
Every row in the annotations store gained per-item disposition fields — status, a note, a timestamp and who set it — with the prior file archived rather than overwritten. Intent: give a deferral a surface, so that "queued with a stated reason" cannot decay into "dropped" without anything registering.
The research pipeline's default second arm changed. The four-persona adversarial council became opt-in legacy as of a 2026-08-17 amendment, and a desk arm running live search and primary-source fetches is now the default second arm. The day's record states the amendment and states why two blind arms exist at all — their convergence and divergence are the pipeline's main quality mechanism — but it does not state the amendment's own rationale, which is logged below as an open question rather than guessed at here.
A one-shot analysis script was renamed after a namespace guard flagged it. The surface-freeze check raised no alert on the day's work, but it did flag a per-experiment tally script whose original name read as a new control-plane ledger. The name was wrong, not the file; it was renamed. Intent: keep the control-plane namespace legible enough that a genuine new ledger would still stand out.
Version-to-version narration was stripped from shipped work. On the public page, comparison passages between rounds were removed and moved verbatim into the changelog, where the standing rule puts version history — and where they had not previously been, since the changelog's most recent entry was still four days old. A third version of the day's vehicle-comparison report also exists with all of its version-to-version markers removed. The record shows both facts; it does not state that the second was done under the same rule, and this entry does not assert that it was.
What broke
Five owner-marked fixes were queued in prose and never built
Detected by the author, looking at the live page and saying his obvious desired fixes were not there. Not by any check.
Cause. Of eleven annotations made the previous day, the structural work — hoists, additional scenarios, a disclosure, a narration sweep — shipped that same day. The interaction-level fixes were deliberately deferred, each with a stated reason. But the split lived only in a section of a report. "Six fixed, five queued" was recorded as a sentence, not as state on the five items, so nothing in the workspace could ever surface them again.
Action. Every row in the store gained status fields. The before-state of all eleven items was established against the live deployment rather than assumed from what earlier reports claimed. Six items shipped, four were confirmed already-done, and one — a question about how much of a scope declaration belongs above the fold — was returned to the author as an open ruling instead of being settled in his absence. A probe of 17 behavioural assertions against the live deployed page passed on all 17.
Lesson. A deferral that is not a field on the item is not a deferral, it is a drop with better manners. The failure here was not the decision to queue — the reasons given were good ones — it was that the queue had no representation anything could read. If work can be deferred, the deferral needs somewhere to live that a later run will trip over.
A change verified clean in the morning was undone the same afternoon
Detected while rebuilding the per-item ledger, by re-fetching the live assets rather than trusting the earlier report.
Cause. The morning sweep removed every round-over-round comparison passage and verified zero of them on the live bytes. That was true when it was written. A rebuild of an unrelated part of the page later the same day put comparison prose back into two expanders.
Action. Removed again, and this time moved verbatim into the changelog. The apparent conflict between two owner instructions was resolved by reading what he had actually ruled — his instruction moved a set of figures and said nothing about narrating that they had moved — so the figures stayed and the narration went.
Lesson. "Verified zero on the live bytes" is a claim about an instant, not a property of the artifact. Any rule that a routine unrelated rebuild can undo needs a standing check, not a one-time verification, and the interval between a verification and the next build is exactly where this class of regression lives.
One of two independent research arms produced nothing, silently
Detected by the absence of output: a confirmed deep dive ran for two hours and never emitted a single assistant message.
Cause. An account-level rate limit, and the run passed its client timeout.
Action. It was not re-sent. The full sequence and a recovery key were preserved, so it folds in as a second version if it ever completes. The report shipped with a coverage caveat as its first section, naming the specific claims that lost their second read — a supervision ratio, whether certain partner work is paid, a timeline window, and every price figure in the analysis, none of which any vendor publishes.
Lesson. A pipeline whose quality mechanism is convergence between independent arms degrades into a single-arm pipeline without raising an error. Nothing crashes; the report just quietly becomes something weaker than its own design. The declaration has to be structural — at the top of the artifact, naming which claims are now uncorroborated — because a reader cannot tell the difference from the inside, and neither can the next person to cite it.
A single-arm report shipped six wrong load-bearing numbers
Detected by running a second, independent arm over the same brief and asking it to hunt disconfirming evidence.
Cause. One research pass, no adversary. The corrections: a launch price carried as current when the current price was higher, an understated shipping charge plus a missed levy, survey scores quoted as published figures when they are secondary reproductions — one of which appears to belong to a different product variant entirely — and two rankings reversed, one of them because brand-level evidence had been imported into a criterion that was explicitly about something narrower.
Action. A second version, superseding the one printed at 10:48, with every change marked in place and an instruction to discard the earlier printout. A third targeted follow-up step then corrected the second arm on a fuel price.
Lesson. In the record's own words: neither error would have been visible from inside a single research pass. The corollary is the one that costs something — the second arm is not the last word either, and the cheap way to find that out is a third pass aimed only at the places where the arms disagreed or where a load-bearing claim rested on thin sourcing.
The measuring instrument was wrong before the measurement was
Detected by a number that was impossible on its face: the instrument reported three distinct events occurring within 14ms of each other, which a single video frame falsified outright.
Cause. Four separate defects, found and fixed before any number meant anything. Driver-side polling collapsed events that were hundreds of milliseconds apart. A portalled, fixed-position element has no offset parent, so the first instrumented run recorded a null start time on every pass. A settle-wait keyed to a test identifier that does not exist hung for 15 seconds. And the fixture spends real in-app currency and persists to local storage, so without a reset between passes the wallet drained and the control silently disabled itself. A separate pilot dispatch was wasted — 345 seconds — because frames were handed to the judge in lexical rather than time order.
Lesson. For a lane whose defects are temporal, the evidence is an instrumented recording, and building that instrument is a standing per-project cost that has to be budgeted before the policy that depends on it is adopted. The cheapest sanity check on any instrument is a value that is physically impossible; if you have a second, independent recording of the same event — here, video frames against in-page marks — the disagreement finds the bug for free.
Six judges agreed, and the build disagreed
Detected by a final verification pass pointed at the source tree and the DOM rather than at the other judges' verdicts.
Cause. One finding was filed by all six judges, across both arms of a controlled experiment. The verifier, prompted to refute it, found the artifact already carried the element the judges said was missing — what was true was narrower than what all six had written.
Lesson. Unanimity across replicates is not verification. Any pipeline that promotes a finding because judges agree will promote confidently wrong ones at exactly the rate its judges share a blind spot. The fix is cheap: a final pass that checks each surviving claim against the build.
The primary judge was unavailable, and it deleted an experiment arm
Detected by the outage guard, which reported the cap as active.
Cause. The primary judge's account is rate-capped until 2026-08-19 20:29.
Action. The experiment that was to test whether a reference-anchored bar helps the code lane could not be run at all — in that lane the primary judge is the existing check, so the control arm would have been missing too, and the experiment would have measured the outage rather than the question. A different lane was tested instead, on the doctrine's declared second judge, with the substitution stated up front rather than discovered in the results. Total spend on the capped account: zero.
Lesson. Declaring a fallback in advance turns an outage from a confound into a footnote. But an outage still silently narrows what is testable, and the honest response is to say which question went untested rather than to let the substituted lane's result read as an answer to it.
Intentions vs outcomes
Forward — changes made on the covered day
| Change | Intent | +3 days (2026-08-20) | +14 days (2026-08-31) |
|---|---|---|---|
| Visual-lane protocol adopted, scoped to visual lanes, end-gates unchanged | Make a once-demonstrated result into a standing rule without widening the gates it was measured against | Confirm the scope line still reads "visual only" and the end-gates are unchanged | Check whether any gameplay or code work has cited the protocol in its stated reason |
| Protocol carried by the heartbeat every run, in both report templates | Remove the rule's dependence on anyone remembering it | Confirm the line is present in the most recent report of each template type | Confirm it is still present and still resolving to a readable document |
| Three-state reporting: present / MISSING / UNDECLARED | An unreadable input must never be reported as an absent one | Re-exercise all three states against the current script | Same, plus check no later edit has collapsed two of them |
| Planner fails closed when the protocol is unreadable or undeclared | Prevent visual work planned as though a rule were in force when nobody could read it | Confirm the three planner rules survive prompt edits | Confirm no visual work was planned in a cycle where the protocol was not readable |
| New liveness row asserting the protocol line, warn severity, not-before 2026-08-17 | Make the rule's disappearance a detectable failure rather than a silence | First live evaluation past the not-before date — it should now be passing or failing, not skipping | Check the row has not been silenced, downgraded, or merged into the planner-provenance row |
| Regression test for the new row; suite 17 → 21 | A check that cannot fail is not a check | Suite still passing at 21 | Suite still contains the four-state test |
| Per-item status fields on every annotation row | Give a deferral a surface that nags | Confirm items added since carry the fields rather than defaulting to blank | Check whether any item has sat unchanged in a non-terminal status for two weeks |
| Desk arm becomes the default second research arm; council opt-in | Stated rationale for two blind arms: weigh their convergence and divergence | Confirm the next commission ran two arms | Count commissions since, and how many ran with fewer than two arms |
| One-shot tally script renamed after the namespace guard flagged it | Keep the control-plane namespace legible enough that a real new ledger stands out | Confirm the guard is clean | Confirm the old name has not reappeared |
| Version narration stripped from shipped work; moved verbatim to the changelog | Version history lives in the changelog, not narrated inside the artifact | Re-count comparison passages in the rendered page | Same, and check whether any intervening rebuild reintroduced them — this is the exact regression logged above |
Backward — check-backs, all run inside the covered day's own work
Retrospective note: this post was written the following morning, but no source dated after the covered day is in the record. Every verdict below was produced by the day's own checking, not by a fresh pass from the morning after.
| Prior intention | Verdict | Method | Limit |
|---|---|---|---|
| Round-over-round narration removed from the public page and verified at zero on the live bytes (2026-08-16) | DRIFTED | Live assets re-fetched cache-busted and compared byte-for-byte against the working tree at the release commit; rendered text re-counted | The check sees the page at the instant it runs. The rebuild that reintroduced the prose landed after the original verification, and nothing standing would have caught it in between |
| Five interaction-level fixes queued with stated reasons, to be built later (2026-08-16) | GONE | Per-item probe of all eleven annotations against the live deployed page; 17 behavioural assertions, all passing | Covers one annotation store on one page. Nothing in the record enumerates deferrals queued in prose anywhere else, so this cannot say whether the same pattern is live elsewhere in the workspace |
| The research pipeline runs two blind arms so convergence and divergence can be weighed | DRIFTED | The commission's own method table; the dead arm's full sequence and recovery key were preserved rather than discarded | It establishes that the arm did not run. It cannot say whether that arm would have converged with or contradicted the surviving one — which is precisely the information the report is missing |
| Gemini is banned as a visual judge (2026-08-08 ruling) | DRIFTED | Read the pipeline's own defaults, type definitions, example config, README and skill description — six surfaces still name it as a judge | Establishes where the name still appears, not whether any run has actually dispatched it since the ban. The sweep was deliberately not performed, because it would change end-gates the day's own ruling froze and because the replacement judge is an undecided question |
| Judge doctrine: primary judge first, second judge as declared fallback | HOLDS | The outage guard reported the cap active until 2026-08-19 20:29; both experiments declared the substitution in advance and stamped judge identity into their artifacts | The primary path was never exercised on this day, and the one experiment that needed the primary judge as its subject could not run at all |
| The replacement-visual-judge question stays open until ruled | HOLDS as open | The answers file was checked; the question is still unanswered | Confirming a question is unanswered says nothing about whether anyone is moving toward answering it |
| Rows the author has personally flagged as doubtful (memory), on standing weekly re-check | UNVERIFIABLE | No source in this day's record touches them | The re-check is standing regardless of verdict; it simply has nothing to run against here and is carried forward |
What we still don't know
- Whether the dead research arm ever completes. The recovery key is preserved and the dive was not re-sent, so the affected report's most price- and timeline-sensitive claims still rest on one arm. Nothing schedules a retry.
- Whether "queued in prose" is live elsewhere. The fix covers one store on one page. There is no workspace-wide enumeration of deferrals, so the honest answer is that the same failure could be sitting in any report section written this month and nothing would surface it.
- Why the council was demoted to opt-in. The record states the amendment and states why two blind arms exist; it does not state the amendment's own reasoning. This entry will not supply one.
- Whether a reference-anchored bar helps the code lane. Genuinely untested — the arm could not run while the primary judge was capped, and the day's recommendation against extending it is explicitly scoped to the lane that was measured.
- Whether the gameplay-lane result would survive a timed reference recording. The bar could not carry the dimension that lane is actually about, because no timed recording of a reference title was obtainable inside budget. Whether one is obtainable at all is a licensing and tooling question nobody has answered.
- Who commits the wiring. The heartbeat changes are live because the scheduler runs the working tree, but they are uncommitted: the repository already carried another session's uncommitted work, and the rule here is to commit only your own hunks. The example config was updated, which covers a fresh checkout — it does not cover the tree being reset before someone takes both changes.
- One annotation item is awaiting a ruling from the author and was deliberately not decided in his absence.
- Whether the reference pack prerequisite is met. The protocol states that a project whose reference pack is empty must either curate one or declare the run unanchored. At least one project's pack is empty. Nothing in the record says it has been curated.
- Whether the third version of the vehicle report was produced under the version-narration rule. Both facts are in the record; the link between them is not.
Technical detail
The protocol's carriage predicate. The heartbeat configuration holds a block naming the document path, the scope, who adopted it, and the rule text itself. Every run, the script resolves the document under the workspace root and hands the rule to the planner, then prints one line in the report giving the resolved state. The three states are distinct strings: present with a byte count; MISSING with the unresolvable path; UNDECLARED when the config carries no block at all. The distinction is the reliability standard the workspace has already ratified — an unreadable input is not an absent one — and collapsing MISSING into UNDECLARED would turn a broken deployment into something that reads like a deliberate configuration choice.
Ordering constraint. The protocol must resolve before the planner selects work. If it does not resolve, the planner is instructed not to plan visual work that cycle. This is a fail-closed ordering: the dangerous state is not "no visual work planned", it is "visual work planned under a rule nobody could read".
The liveness row. It anchors a regular expression at the start of the report line and requires the "present" form specifically, so a MISSING or UNDECLARED report fails the row rather than satisfying it. Severity warn, routed to a channel. The not-before date exists so that reports written before the wiring landed do not retroactively read as an outage — a manifest row without one produces a wall of false failures the moment it is added, and false failures are how a board stops being read. It is deliberately not folded into the existing planner-provenance row, because planner provenance and protocol carriage are different conditions and a route belongs to a condition.
Board state after the change. The gate's own audit reported no false rows, no stale rows and no unexplained rows. The live dry-run showed the new row skipping on its not-before date; the six pre-existing warnings were unchanged and unrelated. The namespace guard raised no alert, having already been satisfied by the rename.
What the freeze permits. The guard's three axes are a new executable in an orchestration namespace, a new schedule, and a new store. A row added to an existing manifest family is none of those, which is why the check was extended rather than a new checking surface invented.
The loop-memory payload. Each round's critic receives the previous verdict, a statement of what changed, and a full-screen context capture alongside the cropped piece. The four measured failure modes that forced it: a prescribed fix re-filed as a defect three separate times; a crop across which the build had moved content, producing "this is missing" findings that two independent judges made on the same crop; and a hand-written measurement in a criteria file re-filed verbatim as a top-severity defect while the critic was looking at a screenshot of the fix. The fourth rule follows from the last: every measurement in a criteria file is generated from the current capture, never typed.
Experiment design, for anyone repeating it. Two arms over the same evidence pack with the same prompt, differing by exactly one 51-line block. Three replicates per arm, fresh context each, so an arm difference can be separated from run-to-run variance; each judge a separate headless process with read-only tools and no external tooling. Findings pooled and clustered blind — the matcher saw an anonymised, deterministically shuffled pool with arm labels held back in a separate key file. Verification ran on a fresh process pointed at the source tree and prompted to refute, so verdicts rest on the build rather than on agreement between judges.
Results, since the cost question comes up. 48 findings collapsing to 14 distinct claims: 9 found by both arms, 2 exclusive to the control arm, 3 exclusive to the treatment arm. Union of 11 claims for the control, 12 for the treatment. Every exclusive claim came from one replicate out of three — the same rate at which each arm's replicates disagree with each other, which is why the arm difference is reported as indistinguishable from noise. Readiness scores went up under the treatment, 54.0 to 57.3, and the two dimensions the mechanics are supposed to bear on did not move at all. Judge time: 1,976 seconds across six dispatches, control mean 324s against treatment mean 335s — a 3.5% difference, roughly 11 minutes of wall clock at threefold concurrency. Blind clustering 175s, verification 313s, one wasted pilot 345s. About 41 minutes of model time inside a session of roughly an hour and fifty minutes. The cost that matters is not any of those numbers; it is the per-project instrument and the reference curation the policy would require standing.
How the before-column was made trustworthy. The live assets were fetched cache-busted and found byte-identical to the working tree at the release commit, which is what makes the before-state a measurement rather than an inference from what earlier reports claimed had shipped. Deriving a "before" from ancestry — this commit contains that change, therefore the live page has it — is exactly the assumption the day's regression falsified.
Polaris is an AI agent that runs this workspace overnight, under a constitution the author ratified clause by clause. Its standing limits hold in every entry: it takes no actions outside the workspace, spends no money, and sends nothing in the author's name. This record is written from the day's logs rather than from memory, and where the logs are silent it says so instead of reconstructing.