This entry covers Thursday 2026-08-20, one calendar day, and it is built entirely from the day's leg reports. No night report was filed for the night ending on the morning of the 21st, so there is no overnight window described here and no night-report seam to state — where the record is silent, this entry is silent. It is written one day after the fact, so the check-backs at the end use what is known on the 21st and are labelled retrospective.
The short version
- Five separate complaints from the author landed on the harness in one day — reports stopping when he loses signal, a report he could not find, work routing to the wrong tab, the dictation cue missing, and dictation silently refusing — and not one of the underlying causes had ever recorded a failure anywhere.
- Report playback now survives losing service completely: the whole file downloads with byte-range resume, retries indefinitely, and switches to an on-device copy, verified with the connection physically cut for nine seconds of continuous play and zero network requests (17 of 17 end-to-end checks, 25 unit tests, 6 of 6 live checks).
- A report rewritten after he read it used to stay marked read, keep its old date and its old title, and sit about twenty-five rows down the list; an amended report now returns to unread, takes the amendment's date, says so in the row, and opens with why it was edited — in the text and in the spoken version.
- Twenty reports were in the wrong tab because a routing rule matched one exact word while the vocabulary around it had grown to eleven variants; a family match moved them, taking the count of work classed as commissioned from 190 to 210 out of 852.
- Thirty-nine of the author's last 122 headset presses produced no voice note, spread across nine days, and none could be distinguished from a deliberate cancel because the guard that refused them returned before writing its first log line.
- Nineteen of forty concurrent bookmark writes died in a replay of the real failure, and the silent half of that bug could have overwritten every saved playback position with the single one being written.
- The commission gate failed the day's largest leg for writing a delivery claim before the delivery actually happened — correctly — and the repair for that error sent the author a duplicate message.
- Asking one model for a one-million-token context window actually produces 828,400; the effective size is the smaller of 95% of what you asked for and 828,400, and the reduction is applied without comment.
What changed in the harness
Resumable whole-report buffering in the report player. Intent: a report the author starts on the road should finish, whatever the signal does. Bytes that arrive before a cut are kept and the next attempt resumes from the byte it reached; failures back off and then retry indefinitely; when the file is complete, playback moves onto an on-device copy and stops touching the network at all. The window is the report playing plus one ahead, and anything outside it is released immediately so nothing accumulates on the phone.
A fifteen-second stall watchdog on each fetch attempt. Intent: driving out of coverage usually does not fail a request — the socket stays open and the bytes simply stop, and a request waiting on that waits forever. This is the one part of the buffering work that came out of testing rather than design: without it, the first genuine offline test hung indefinitely.
A rescue path that plays what has landed. Intent: if the stream fails and more of the file is on the device than has been heard, play the partial file rather than stopping — and park two seconds short of the ragged edge rather than playing out, so the truncated file's end is never mistaken for the end of the report.
Amendment semantics for reports. Intent: a report that changes after the author has read it should say so before he presses play. The signal is authored, not inferred from a file timestamp, because a timestamp cannot distinguish a rewritten argument from a typo fix and that distinction is the whole point. Three kinds are conventional — response-driven, correction, cosmetic — and an unrecognised kind is displayed rather than swallowed.
A family match on the report classification rule. Intent: work the author commissioned should stop falling into the flood tab that the rule exists to drain. The rule now matches the leading token of the ledger's own word for what a piece of work was, instead of one literal string.
The loud dictation banner on the report-playback bar. Intent: the cue should exist on the surface he actually dictates from. The banner had been given to the notes card and the question cards; the headset double-tap during playback — his normal path — had never had it. The level indicator behind it is now one shared piece of code rather than two copies, because two copies is how the surfaces drifted apart.
A 1.2-second deadline on the pre-recording probe. Intent: the recording bar should appear on a dead link. The probe ran before the bar was built and had no timeout, so on a dead link the double-tap drew nothing at all.
A lock and per-writer temporary files on the playback-position store. Intent: concurrent bookmark writes should not lose each other, and an unreadable store should be refused rather than treated as empty.
Diagnosability on the dictation refusal path. Intent: a refused capture should record what refused it and how stale the claim was, so the next drop is investigable rather than invisible.
Self-triage in the shared end-to-end test harness. Intent: test runs that create real voice notes in the author's inbox should file their own triage row at the moment the note exists, instead of depending on whoever ran the test remembering afterwards.
A written narration convention for report audio. Intent: a report's spoken version is a listening layer, not the document read aloud. One report's first cut was its own markdown narrated — 21.6 minutes of tables and file paths — and was re-recorded as a hand-written spoken retelling at 9.0 minutes. The rule now lives in the shared narration prompt that every leg staging audio inherits.
The corrected context-window setting for long agent runs. Intent: stop the model compacting its own context mid-job. The setting is adopted at 872,000 rather than the 1,000,000 originally written down, because both produce the same result and the smaller number states the real ceiling instead of implying one the host will not give.
A standing limit relaxed for one project, with its guard held. Intent: an explicit instruction to test a local fine-tune superseded the standing document-only rule on model weights for that project alone. The storage guard was not relaxed: free space was checked before the download, after it, and after every checkpoint, and never fell below 72 GB against a 60 GB floor.
What broke
The report that was there, and could not be found
Detected by the author: he could not find a report containing his own replies, and said so directly. Caused by four things compounding, none of which raised anything. The read mark never compared his read timestamp against the file's modification time, so a report rewritten after he read it stayed marked read all day. The row's date came from the filename, so a report substantially rewritten that morning sorted under the previous day, below roughly twenty-five newer rows. The title never changed, so the row did not claim to be the thing he was scanning for. And his saved position, written against the shorter earlier version, landed mid-sentence inside an argument he had never heard the start of.
The finding the leg was dispatched on — that the audio was stale — was itself wrong, and checking it was the first thing done: three slices of the file transcribed locally showed both replies spoken at the front, and the file's length could not have been filled by the older text. The apparent staleness came from reading a local-time file listing against messages stamped in UTC; the file was nine minutes newer than the note it answered, not seven hours older.
Done: all four causes fixed structurally, for every report, by the amendment semantics above.
Lesson: a surface that lets an artifact change underneath a reader without announcing it does not merely inconvenience him — it makes the artifact unfindable, because every handle he would search by still describes the old version. And before inferring from two timestamps, normalise them; a local-time reading against a UTC stamp inverted the sign of a seven-hour gap.
Twenty reports in the wrong tab
Detected by the author's broader complaint that things were routing to the wrong sections. Caused by a rule that read the delivery ledger's own word for what a piece of work was and matched it as one literal string. The fleet's vocabulary then grew ten more nouns for the same fact — builds, incorporations, posts, measurements, plans, inventories, revisions and so on — and every one of them was first written after the ruling that set the boundary. None matched. All fell into the flood tab.
Done: family match on the leading token, pinned by 38 tests in both directions. Blast radius measured before and after: 190 to 210 classed as commissioned, out of 852 — against roughly 214 of 545 that the wider alternative the author had explicitly refused would have caused.
Lesson: a rule implemented as an exact-string match silently narrows every time its vocabulary grows, and the narrowing is indistinguishable from the rule working. This one had quietly shipped the narrower version of a boundary that had been considered and rejected. Any rule that keys off a controlled vocabulary needs a test that fails when the vocabulary grows past it.
The dictation cue that was never on that surface
Detected by the author ninety minutes after the buffering work shipped: the indicator was gone and he was dictating blind. The escalation named the buffering change, or a stale client, as the likely cause. Both were wrong, and checking them came first: his phone carried fourteen buffer-swap records and on-device playback sources in the log, so it was running the new client; and the banner's code and styling were byte-identical to the pre-change archives.
Caused by an inconsistency older than either change. The loud banner had been added to one dictation surface the day before; the way he actually dictates while a report plays is a different code path, reached by the headset double-tap, and it had never received the banner. The day after being shown the new cue, he used his normal path and it was not there. Underneath that, the pre-recording probe blocked the bar's construction with no timeout, so on a dead link the double-tap drew nothing at all: two of his taps have no matching request on the server and no capture followed; a third, a minute later, worked.
Done: the shared banner on the playback bar, and a 1.2-second deadline on the probe. Measured against the archived pre-fix client: cue never appears, to cue in 0.01 seconds.
Lesson: when an escalation names your own change, check the accusation first and check it with evidence capable of exonerating it — but do not stop at "not my fault". The buffering work is a plausible aggravator of exactly this bug: whole 10–20 MB downloads plus one ahead, retrying indefinitely, compete for the same thin link the failure needs. That is said here rather than hedged away, and throttling is on the decision surface as an option rather than taken unilaterally, because throttling trades away what was asked for in the first place.
Thirty-nine presses that produced nothing
Detected by the author: "it just stops taking messages sometimes, and then I have to refresh the page, restart the listening, and then double-click to get it to take a voice message." Measured before it was touched, from the app's own instrumentation: across the whole playback log, 122 headset presses, of which 39 produced no voice note within twelve minutes — 32%, spread across nine days. Some of those are deliberate silent cancels, discarded by design. None of them could be told apart, because the guard returned before the first log line.
Caused by ordering: the single-recorder claim is taken before the microphone is acquired, and the timer that would eventually end a capture is armed on the last line of the function. If acquisition never settles — which is what backgrounding a tab does to a pending microphone request, and pocketing a phone is backgrounding — the claim is stranded with no timer and no visibility hook, and every later double-tap is refused silently until the page is reloaded. His symptom and his remedy, both sitting in the code.
Done: the reclaim itself was already in flight from another leg and was left alone rather than duplicated; the gaps it did not cover were patched around it — every refusal now records what refused it and how stale the claim was, and a composer dictation whose recorder has already gone inactive no longer blocks the headset path permanently. Verified with a test that backgrounds the page, returns, and dictates without a refresh, driving the real visibility path rather than simulating around it.
Lesson: a guard that refuses without logging makes its own failure rate unmeasurable, which is the real reason this survived a fortnight of being lived with. Instrument the refusal path, not just the success path. The corollary held too: the instrumentation added earlier for a different open question answered it cleanly — 122 presses, none of them arriving at a dead element — so the mechanism people had suspected was ruled out by data rather than argued about.
The bookmark writes that raced
Detected in the service journal: bursts of failures on the endpoint that stores playback position — three in one minute, eight in another. Caused by a read-modify-write through a shared, fixed temporary filename with no lock, on a threading server. It had been rare; the buffering work made it common, because the new code sends position updates for the item playing and the one ahead. Replaying the exact sequence forty writers wide: 19 of 40 writes died, and one reader parsed a half-written file.
The visible half was the error. The dangerous half was silent: an unparseable read fell through to "start a fresh file", so a burst could have replaced every saved position with the single one being written.
Done: a lock, per-writer temporary names, and an unreadable store now refused rather than overwritten. Six tests, including a forty-wide burst that must lose nothing. No further failures on that endpoint after the restart.
Lesson: a change in one part of the harness converts rare races into common ones elsewhere; the blast radius of a performance change includes every writer whose frequency it multiplies. And a fallback that reads "cannot parse" as "empty" is a data-destruction path wearing a robustness costume.
The gate caught a claim written before its delivery — and the repair sent a duplicate
Detected by the completion gate's second-layer adjudication, which returned a fail with two objections. Both were right. A deliveries row was written at 15:55:52Z describing a message to the author; the message was not sent until 16:01:33Z. The evaluator checked the served history four seconds after the row was written, found nothing, and failed the clause closed — which is exactly correct. The second objection: a four-item run filed status notes for three items, on the reasoning that "no bounded work remains here" is not a worked item. That reasoning was wrong — it is the item's result, it took real verification to establish, and leaving it unrecorded makes the row look untouched.
A second error surfaced while fixing the first, and it reached the author. The original delivery was recorded as successful, but the command read its exit status after piping into another program, so the status belonged to the pipe's last stage, not the sending script — meaning there was no real evidence of delivery at all. Re-running it to capture a true exit status sent the author a duplicate message, two copies about a minute apart. No third attempt was made; delivery was evidenced from the notices feed rather than re-tested, precisely to avoid another copy.
Lesson: submit-once-and-verify-by-receipt is not a rule about printers or payments, it is a rule about anything that reaches another person, and it applies to messages sent in the course of fixing a message. Separately: an exit status read after a pipe is the pipe's, and treating it as the command's manufactures evidence you do not have.
The evaluator added one observation worth carrying: the two frozen executable checks for that commission are "trivially gameable with two non-empty placeholder files and one string" — and it went and read the substantive reports and the underlying session records anyway before crediting the work. That gate passed on judgment, not on construction. Lesson: if a frozen completion criterion can be satisfied by an artifact's existence rather than its content, it is a criterion about filenames.
A secret printed into a session transcript
Detected during the run itself and disclosed in the leg's own report. Reading a configuration file to find the default model settings printed a third-party API key into the session transcript, against the standing rule that a secret never enters a transcript. Nothing was sent off the machine and nothing was written, but transcripts are archived nightly and replicate off-host, which is the entire reason the rule exists. Rotation was flagged as the author's call.
Lesson: the never-print-a-secret rule has to cover incidental reads, not just deliberate ones. A configuration file read for an unrelated field is the ordinary way this happens, and "I only wanted line 3" is not a control. Tooling that extracts one key from a config, rather than displaying the file, is the fix; a habit is not.
Two legs in the same function, two minutes apart
Detected by one of the two legs while verifying its own edit. Two independent pieces of work were editing the same function within two minutes of each other. The second edit landed on top of the first and preserved it — but the client's shell revision had been re-baselined between them, so that revision would have shipped only half the fix. It was bumped again to cover both.
Done: verified both changes present, file parsing, revision advanced. Lesson: the only reason no work was lost is that the two writes did not land at the same instant. There is no mechanism preventing this — it is currently luck, and it is worth naming as luck rather than filing as a near-miss that resolved itself.
The test that passed the cut and proved nothing
Detected by the leg writing it: the first three runs of the offline test "passed" and were worthless. The browser's built-in network throttling meters delivery to the page, not to the socket. For a file of this size the browser's network layer has already pulled the entire body off the wire, so switching the connection to "offline" released the remaining bytes instead of cutting them — the test proved that a fully-downloaded file continues to play.
Done: the test now runs the real app behind a rate-limited network relay it can genuinely sever, so cutting the link cuts the bytes. Seventeen assertions, including the resume from the exact byte reached and nine seconds of continuous playback with the link cut.
Lesson: an emulated failure that happens above the layer you are testing is not a test of that layer, and it fails upward — it passes, confidently. If a test claims a network property, cut the network, not the abstraction over it.
A report that named five things to do and carded none of them
Detected by the author, as a pattern rather than an instance: "why do reports say, oh, you should do this, and then they don't card anything?" One of the day's own reports did exactly that — filed five findings, declared no decisions needed. A second report, later the same day, had already caught itself doing a version of it and put the fork on the decision surface with four options and a recommendation, saying so in the body rather than leaving it implicit.
Done: the no-decisions declaration on the first report is superseded by a card. Lesson: a finding that requires the author to act, described in prose and not placed on the decision surface, is not a finding he has. The convention of declaring "no decisions" is correct for work that merely enacts an already-answered decision, and it is wrong the moment the report also proposes something.
A lane reported idle that had three users on it
The day's quota-burn work was briefed with the state "the lane has been idle since early afternoon." That was already false when it was picked up: three separate pieces of work were using the one shared model seat at that moment. There is no cross-leg lock on that lane — the convention of serializing the expensive model is enforced only inside each leg, not across them. Lesson: a coordination convention that lives in each participant's own instructions is not coordination; it is a shared assumption, and its failure mode is invisible until two legs collide.
Intentions vs outcomes
Forward — changes made 2026-08-20
| Change | Intent | Re-check +3 (2026-08-23) | Re-check +14 (2026-09-03) |
|---|---|---|---|
| Resumable whole-report buffering with on-device playback | A report started on the road finishes regardless of signal | Did any report stop mid-listen in the field? | Is buffering still on the item playing plus one, with nothing accumulating? |
| Fifteen-second stall watchdog | A socket that goes quiet cannot hang the fill forever | Any fill stuck with no retry? | Is 15s still the right dead-air threshold in real use? |
| Amendment semantics for reports | A rewritten report announces itself before he presses play | Has any amended report been authored, and did the row and the audio both say so? | Are authors actually declaring amendments, or has the field gone unused? |
| Family match on report classification | Commissioned work stops falling into the flood tab | Have new ledger words appeared that the family match misses? | Is the commissioned count still tracking, or has it re-flooded? |
| Shared dictation banner on the playback bar | The cue exists on the surface actually used | Has he dictated blind since? | Have the two surfaces drifted apart again? |
| 1.2-second probe deadline | The bar appears even on a dead link | Any taps with no bar? | Any taps with no matching server request? |
| Lock and per-writer temps on the position store | No lost bookmarks under concurrent writes | Any failures on that endpoint? | Any bookmark that jumped to a position he never reached? |
| Self-triaging test harness | Test-created voice notes never land untriaged in his inbox | Any untriaged test note in the inbox? | Same, over a fortnight of runs |
| Hand-written spoken retelling for report audio | A report's audio is a listening layer, not a document read aloud | Did the next report's audio follow it? | Is the convention being inherited by legs that did not read this report? |
| Context window set at 872,000 for long agent runs | Eliminate mid-job context compaction | Any compaction events on a long run? | Does it still hold on a newer version of the tool? |
Backward — check-backs, all retrospective (written 2026-08-21 about work whose intent predates 2026-08-20)
The next-report precache, shipped 2026-07-27. Intent: the reports ahead in the queue are on the device before he reaches them. Verdict: DRIFTED. Method: the buffering leg read the code against the complaint — the shape was right and the fetch was wrong. It made one attempt per URL, discarded everything on a cut because it required a complete body, and swallowed its own failure, so every window of service was spent restarting from zero. Limit: the check cannot see how often the precache ever succeeded before today, because the failure path wrote nothing — the historical success rate is unrecoverable, not merely unmeasured.
The instrumentation added to settle whether the headset key stops reaching the page after a rollover. Intent: answer an open question with data instead of argument. Verdict: HOLDS. Method: the playback log over its full history — 122 presses, every one arriving at a live element, none needing to be re-pointed. The question is answered and the answer is no. Limit: it says nothing about the 39 presses that produced no note; that is a different failure on the same button, and the same log could not see it until the refusal path was instrumented on the 20th.
The report-class boundary set by ruling on 2026-08-11. Intent: the ledger clause decides only what the ledger itself says was commissioned — the narrower reading, which dropped work ordered by ruling, was explicitly declined. Verdict: DRIFTED. Method: the implementation was read and the population measured before and after — a literal-string match had shipped precisely the declined narrower rule by accident, and the repair moved 20 reports without admitting any new signal. Limit: only the ledger clause was checked and repaired. The header clause of the same rule has a sharper version of the same defect, 40 reports currently sit misfiled under it, and the fix is not mechanically safe — that one is on the decision surface, unresolved.
The guard that exists to catch a route added without its protections. Intent: catch such a route on the day it is added. Verdict: HOLDS as a detector; the workflow around it DRIFTED. Method: the failing test's own history — it went red on the 19th, the day the route shipped, and correctly. Nobody closed it until a leg on the 20th needed a green suite. Limit: this says nothing about whether other guards are currently red and unattended; no sweep of the red set was done, and three unrelated reds were filed as pre-existing rather than fixed.
The corrected citations in two review-agent descriptions. Intent: stop a comparison claim resting on a study that could not support it. Verdict: HOLDS. Method: both descriptions read directly on the 20th; both now carry corrected pointers naming the evidence that actually compares the two models, including the confound in the older result. Limit: the clean comparison run itself is still not scheduled. Only one side's instrumentation contract was re-validated against the current tool; the other side's — where the original mechanism failed, a settings file silently reverting inside an isolated run — is untouched.
The frozen-commission completion gate. Intent: a leg cannot declare itself done on its own say-so. Verdict: HOLDS. Method: it failed the day's largest leg with two objections, both of which were correct and neither of which the leg had noticed. Limit: it held on the evaluator's judgment rather than on the frozen criteria, which the evaluator itself described as satisfiable by two placeholder files and one string. A gate that passes because the reviewer went beyond it has not been tested as a gate.
The convention that a leg enacting an already-answered decision declares no new decisions. Intent: avoid manufacturing forks where the author has already ruled. Verdict: DRIFTED in application. Method: three reports declared it on the 20th; two correctly, one while filing five findings that needed his attention. That third declaration is superseded by a card. Limit: only the three reports in this record were checked; how often the same pattern occurred on days not covered here is unknown.
The delivery doctrine that reports go to the web surface and are not pushed to the phone. Intent: one place to look, no duplicate delivery. Verdict: HOLDS. Method: both reports that staged audio on the 20th state the doctrine and say nothing was pushed. Limit: this covers only legs that filed a report; a leg that pushed without reporting would not appear in this record at all.
The standing weekly re-check on rows the author has personally flagged as doubtful (memory). Verdict: UNVERIFIABLE. Method: none available — the source pack for this day contains no memory-system material. Limit: absence from this pack is not evidence the check was skipped, and it is not evidence it ran. The row stays on the weekly schedule regardless.
What we still don't know
- Whether the buffering works on the author's actual phone. Everything proven above was measured in a desktop browser on the workspace machine. A phone's media stack backgrounds differently. The one thing an on-device copy genuinely changes — no network during playback — should make backgrounding easier rather than harder, but that is an inference, not a measurement, until he drives with it.
- Whether on-device copies survive memory pressure on a phone. Two whole reports of the 10–20 MB class is the design point and the cap enforces it, but a device under pressure can discard them. If that happens the fallback is the network source, which is the previous behaviour rather than a worse one — that much is known; the frequency is not.
- Whether the buffering is making the dictation drops worse in the field. It is named as a plausible aggravator, not dismissed. Throttling would help and would trade away exactly what was asked for, so it sits on the decision surface rather than being taken.
- How much of the 32% is genuine failure. Some of those 39 presses are deliberate silent cancels. Until the 20th the two were indistinguishable by construction; from now on they are separable, but the historical split is not recoverable.
- The other half of the report-routing rule. Forty reports have a header line that names an owner instruction and are still in the flood tab. Relaxing that rule is not mechanically safe — some of those lines name a request from the author, others name the ancestry of a dispatched leg, and the routine output of dispatched work is the definition of the tab they are already in. Unresolved, on his tab.
- Whether the buffering change survives independent review. No second-model review has run on that diff. The completion gate's second-layer adjudication for it is the next step, not a step already taken.
- Three red tests filed rather than fixed, none of them caused by the day's work: an approvals fixture that never seeds its store, an assertion that still forbids a control shipped the day before, and a proximity check whose search window no longer reaches the marker it looks for in a file that has grown. Each is somebody's, and none of them is nobody's.
- Whether the larger context window pays off generally. Compaction went from four events to zero across matched pairs, but only two of the three default-window runs genuinely stressed the window; the third batched its reading and never approached the ceiling. The honest denominator is two of three, not three of three, and one dropped file across three pairs is a directional signal rather than a quality verdict.
- Whether the exposed key should be rotated. Disclosed, not decided.
- How many existing reports would benefit from a retroactive amendment line. None were added. Declaring an amendment on someone else's report after the fact would be guessing at what changed and why.
- The overnight window. No night report is on file for the night ending 2026-08-21. Nothing in this entry describes it, and its absence is a gap in the record rather than a quiet night.
Technical detail
Resume mechanics. Each response is read through a streaming reader and appended chunk by chunk, so bytes that land before a cut are retained; the next attempt sends a range request starting at the count received. Backoff runs 1, 2, 4, 8, 15 seconds and then continues at 15 for as long as the tab lives. A connectivity event shortens the wait so a returning signal is spent immediately, but the timer is what guarantees the next attempt — the connectivity event is unreliable on a phone, where the operating system will report a live interface with no route.
Protocol edges, each handled explicitly and tested. A 200 answer to a ranged request carries the whole file whatever was asked for, so it restarts cleanly rather than being appended, which would corrupt the audio. An overlapping partial response is de-duplicated by skipping bytes already held. A 416 means the file is already complete. The server side needed no change: the audio route has answered partial content, content-range and accept-ranges headers — and 416 on an out-of-range request — since an earlier change, and that was verified live against the running service rather than read off the source.
Blob-swap ordering constraint. Switching the playing element onto an on-device copy pauses it, zeroes its position, and fires abort and empty events. Four existing listeners treat exactly those as faults, including the one that persists the playback bookmark — which would have written position zero over a real bookmark. A short-lived marker suppresses all four for the few hundred milliseconds of a swap. Playback deliberately starts on the network source and swaps when the file is whole: waiting for 10–20 MB before the first sound would make a bad link worse.
Rescue parking. A truncated audio file is a valid, shorter audio file, so the rescue path can play what landed — but its natural end would reach the autoplay chain and be read as the end of the report, silently skipping the rest. It parks two seconds short instead, reusing the existing user-paused mechanism rather than inventing a bypass. The park point is estimated proportionally, which is exact for constant-bitrate audio and approximate otherwise; parking early absorbs the error. The rescue path never preempts a stream that is working, and there is a test named for exactly that.
Two things the test harness had to learn. First, the browser's network-conditions emulation throttles delivery to the page, not the socket; for a file this size the browser has already taken the whole body off the wire, so going "offline" released the remaining bytes rather than cutting them, and three runs passed a cut that never happened. A real rate-limited relay was required. Second, a registered service worker fetches on a target the page's debug session does not cover, which silently disabled throttling — so the run blocks service workers, which also places it on the weaker of the two origins, where no offline fallback exists at all. What passes there passes on both.
Amendment predicate. The date moves forward only; a stale or mistyped older date is ignored rather than used to bury the row further. The stored read mark is never rewritten — he really did read the earlier version and the ledger still says so — only the surface state flips, and reading the amended version settles it again with no special case. The row carries the amendment date and kind so the decision to press play is informed before playing.
Classification. The match is on the leading token of the ledger's kind field, so qualifier forms written after the noun are absorbed and the dispatch-marker kind and free text in the kind slot stay out. Both directions are pinned by tests.
Position store. A lock plus per-writer temporary names replaces a shared fixed temporary filename; an unreadable store is refused rather than reinitialised. The regression test drives forty concurrent writers and must lose nothing.
Shell revisions. The client shell was bumped three times in one day by three different pieces of work, ending at revision 36. Revision 35 would have carried only half of one fix, because a re-baseline landed between two edits to the same function two minutes apart. A restart of the service does not refresh an open client: the shell is network-first with a two-and-a-half second timeout, so a fresh open picks up the new revision by itself, while a session left open all day does not.
Restart discipline. No restart was functionally required for the buffering work — only static assets changed, the served bytes were already identical to the files on disk, and there is no import-time read of them. It was performed anyway because the frozen completion criterion named it. It waited for a genuine 45-second gap in the author's listening, found by polling the service log, minutes after a connection reset mid-stream showed his dead-zone problem happening live. The full test set was green before the restart and the read-only live check was re-run after it.
Context-window resolution. The effective window is the smaller of 95% of the requested value and 828,400, confirmed to the token at the boundary: 871,000 resolves to 827,450, and 872,000 resolves to 828,400, as does anything larger. The default on this host is 258,400. The compaction-limit setting makes no difference to it. A malformed value is rejected outright, so the silent part is not type-checking — it is the 5% haircut and the ceiling, applied without comment. The strict-config flag validates the configuration file, not command-line overrides: a plainly bogus override key exits successfully, so anyone using that flag to credit an experiment arm is crediting nothing. The value that actually resolved is recorded in each session's own rollout record. Separately, a single turn's input is capped at 1,048,576 characters regardless of the window, so a one-shot prompt of that size is impossible; the larger window only pays on runs that accumulate context across turns.
Compaction result. Three matched pairs of long reading jobs, identical file lists, one variable. Default window: four compaction events across the set, peak live context pinned just under the ceiling at 175k–245k, one file dropped from one run's output. Larger window: zero compactions, peak live context 351k–470k — which is only possible if the setting is genuinely in force, and is independent confirmation from behaviour rather than from a session header. One larger-window run reported hitting a limit that turned out to be a tool-output size ceiling with the affected files re-read in ranges, not context loss; it would have been easy to score that as a defect of the arm and it is not one.
Quota. The weekly window on that seat moved from 6% used in the early afternoon to 8% by the last call of the day — the whole fleet, every leg, two percentage points, with six and a half days left before it resets on 2026-08-27. The constraint on burning it is not willingness; it is that the queue does not hold enough of the right shape of work to absorb it. That is a scheduling problem, not an effort problem.
Polaris is an AI agent that runs this workspace overnight, under a constitution the author ratified clause by clause. Its standing limits are unchanged: it takes no action outside the workspace, spends no money, and sends nothing in the author's name. This record is written from the day's logs rather than from memory, and where the logs are silent, so is the record.