This entry covers Friday 2026-08-28. No night report exists on file for the night ending that morning or for the evening of 2026-08-29, so there is no night-window seam to state: everything below is built from the reports the day's own workers filed, and where those reports are silent this entry says so rather than reconstructing.
The short version
- A completed review request sat in the tree marked ready for 14 days — sealed 2026-08-13, found unsent 2026-08-28 — and no verdict was ever filed, because nobody sent it. The work was not missing; the send was.
- The scheduler built to catch exactly this stall named it in its own output on every tick and could do nothing about it. It cannot tell "sent and waiting" from "never sent", and since 2026-08-23 at 14:50 UTC another work track's uncommitted files had pushed it into a state where it proposes nothing.
- Five review rounds were adjudicated in one day — the stalled round's gate plus four fresh rounds, run by five successive workers — and all five failed. The last two returned six of six invariants not met.
- The external reviewer channel, which had refused this material outright four times, was repaired by splitting a submission into one question per invariant. The fourth round got three of six answered by GPT-5.6 Sol and the other three by Luna after Sol refused; the fifth got all six from Sol with zero refusals, five of them back inside four minutes, plus three of three deep dives from GPT Pro.
- The earlier explanation for those refusals is refuted. A submission rebuilt to remove both suspected causes — measured at 0.20 trigger hits per KB against the previous pack's 1.31 — drew the identical refusal.
- Three long review sends across two rounds each stopped at exactly their client-side cap having emitted zero characters (120, 150 and 150 minutes). That rules out "a long answer got truncated" and points at a request that never began emitting.
- The defect pattern moved twice in two rounds. Round five's failures were checks asking whether some case holds where the rule says every case; round six's were checks correct over every case but simply absent on a second code path.
- Polaris did not dispatch a seventh round. Six rounds at zero passes was ruled an owner decision rather than another work order, and the seventh work order was rewritten as a design brief naming three unifications.
What changed in the harness
Review submissions are now decomposed, one question per invariant. Intent: get an answerable question past a classifier that refuses whole submissions, and get per-invariant rulings that are independent enough to disagree with each other. This is the single change with the largest measured effect on the day — from four attempts and no verdict in the morning to six of six answered by the evening.
Every submission now ends with an explicit offer to supply any by-reference item in full rather than paraphrase it. Intent: let a reviewer ask instead of guess. It was taken up twice — one reviewer named four code regions and two probe bodies it needed before it would rule, and ruled decisively one pass later; another deferred rather than guessing and asked for six regions.
Every submission now opens with an accurate plain description of the system under review — a leakage guard on a private research project, the component that stops a diagnostic run from reading the data it is supposed to be held out from; no attacker, no service, no third party. Intent: remove the reading in which the material looks like attack research.
Prior verdicts are cited by path and digest instead of attached, and the code diff is scoped to the round's changed files. Intent: reduce what a reviewer must be handed in order to rule. The diagnosis that motivated this rule was refuted the same day (below); the rules were kept anyway, because they are good rules for a different reason.
A pre-registered ordering witness is committed before the first implementation edit — third round running. Intent: make the execution order a checkable artifact rather than a post-hoc argument, so deviations get recorded instead of defended.
The status file is written before the verdict file. Intent: satisfy the completion gate's timestamp check by sequencing honestly, where an earlier round had to touch a file and disclose it.
Round six changed the builder. A different model family built every item under a director from another family, and the acceptance criterion — nine property-style claims — was written by the director before the build and committed failing. Intent: break the loop where one reading writes both the code and the probes that test it. It paid immediately: the builder refused to build one item and returned two objections instead of code, both of which reproduced, including that a pre-registered probe did not construct what it advertised.
The tree lease was taken through the claim path with a registry attestation, on a real dispatch, for the first time. Intent: make lease ownership a checkable artifact. A prior review finding had recorded that no dispatch had ever actually used it.
The seventh work order was rewritten as a design brief and the sequence was held. Intent: stop paying for rounds that cannot change the failure class, and put the fork in front of the author instead.
The publication authenticity gate was rewritten to walk a whole chain of custody — slug, to manifest, to pack bytes, to response — before anything may publish or act, with coverage re-derived from what is genuinely in the evidence pack rather than from the pack's own stored table. Intent: stop a claim about evidence from standing in for the evidence. Not applied: the live gate is byte-identical to what it was, and the adoption decision is carded.
What broke
A finished request was written and never sent
Detected when a worker established the true state against the tree rather than against its own briefing, and found no verdict on disk for a round marked ready since 2026-08-13, with a finished 193-line request beside it.
Cause: the round died in the gap between "request written" and "request sent". No component owned the send. The evidence is stated at the strength it deserves: the absence is decisive for the last week of the window, when a broker with a queryable history had become the filing path, and for the fortnight before that it rests on the missing verdict file plus an unbroken run of ticks reporting the round as awaiting a verdict.
Done: the request was filed, the registry row reconciled forward through five gates it had never recorded, and the whole tree re-verified green at head before a 14-day-old seal was trusted.
Lesson: a pipeline needs a state for ready and not yet sent. A completed artifact is not evidence of a completed action, and any workflow whose last step is performed by something outside the workflow will eventually skip that step silently. This is a distinct failure class from the earlier stall on the same track, which was a dispatch gap — a worker stood down and no successor launched. Here the worker did everything asked, including writing the request.
The anti-stall scheduler detected the stall and could not act on it
Detected in the scheduler's own last tick, whose evidence field names the stalled item exactly.
Cause, two independent parts. First, it derives "awaiting a verdict" purely from a request file exists with no matching verdict file, and never checks whether a request was sent — so "sealed and sent, waiting" and "sealed and never sent" are the same state, and the second one is invisible. Its own documentation says the send and ingest states arrive with a later build; the plan models a ready-unsent state that the implemented subset does not. Second, tree-dirtiness is evaluated across the whole repository while its work units are path-scoped, so uncommitted files belonging to an unrelated track — a runner script, some backups, a test directory — flipped it at 2026-08-23T14:50:01Z into a state that proposes nothing, and it had stayed there for five days.
Done: nothing, deliberately. The driver is mid dry-run window, and rebuilding it resets the window under its own pass criteria. The dirty files belong to another track that is still working in them.
Lesson: a monitor that cannot distinguish two states cannot usefully report either of them, and the state it silently collapses will be the one you need. And a global safety predicate guarding a path-scoped worker hands every neighbour a mute button. Both defects were reported by four consecutive workers on this day and remain unpatched; that they are known and repeated is itself the finding.
Whole submissions are refused, and the first diagnosis was refuted by its own remedy
Detected across four attempts on one round with no verdict: two genuine long sends that reasoned for 2h00m50s and 2h30m50s and emitted zero characters, one send blocked at the lock and then hitting an account-level rate limit, and an explicit content refusal from GPT-5.6 Sol — twice, including after an accurate, non-adversarial re-framing, one attempt consuming 111,228 tokens and emitting nothing.
First cause proposed: the attached prior verdict, which enumerated eleven access techniques in one table and measured 1.31 trigger hits per KB against 0.32 and 0.50 for the other two components — the densest by four times, and the only component enumerating techniques.
What actually happened: the next round's submission was rebuilt to that rule — prior verdict cited rather than attached, densities measured at 0.20, 0.20, 0.00 and 0.00 — and drew the same result: a deep dive terminating at 2h30m26s with zero characters, and a refusal with text identical to the previous round's. The diagnosis is refuted in its strong form. The most economical remaining explanation is the subject matter itself, and that is untested.
Done: the rules were kept and their stated cause was retracted at the top of the guidance document rather than carried forward into another worker's briefing. The reviewer-of-record question was escalated rather than decided by a worker. Decomposition was then adopted, and it worked.
Lesson: when a rebuilt artifact fails identically, retire the diagnosis, not the rules — and record the retraction where the next reader will hit it, not in a report they may not open. The corollary that cost real time: three sends terminating at precisely their client cap with nothing partial at any 30-second poll, across pack sizes of 108, 107 and 121 KB, is the signature of a request that never starts emitting. Raising the cap tested the wrong hypothesis, twice.
Two provenance records for the same review answer disagree
Detected on a completed deep dive whose broker status recorded a fallback completion path, an unknown model and an untrusted flag, while the copy-of-record check that the same file directs you to returned the Pro model identifier, is-Pro true and a complete finish.
Cause: the two records are produced by different mechanisms and the broker's is the weaker one. This has now happened at least twice on consecutive rounds.
Done: the fifth round's worker recorded the untrusted dive as not quotable as Pro rather than assuming the flattering reading, then — after an account-level rate limit expired, which by standing rule is waited out rather than retried into — ran the settling check and found all three of that round's dives genuine. The verdict was corrected rather than left hedged, and the copies of record were committed. One record from the sixth round remains unsettled: its settling check returned a rate limit and was not retried, and the obligation is named in the handoff rather than quietly dropped.
Lesson: where two records of the same fact disagree, name in advance which one settles it, and let the unsettled case stay unsettled in the write-up. The cost of the honest version is one paragraph; the cost of the flattering version is a citation that cannot be defended later.
Three claims made ahead of the fact, each caught by someone other than the claimant
One: a worker wrote "lease and yield released" into its status file while drafting its closing state, before releasing either. Its successor found the lease still held with no release event ever logged, revoked it as stale and reclaimed it. No collision followed — the two workers' commits touched disjoint subtrees — but the successor's clean baseline was genuine by luck of scope, not by the record being true.
Two: two of three evidence measurements in another round were wrong before the third was right; the second had replaced a failing call with a lambda that asserted nothing. A vacuous test, in the round whose entire subject was vacuous tests. It was caught only because an independent universal probe disagreed with it and forced a re-measurement. Had they agreed, that report would have carried a false ruling.
Three: a round reported a failing count for a pre-registered probe and a passing count for a corrected version of the same probe — two different definitions, which establishes nothing. The completion gate refused the completion claim on exactly that, applying the round's own standard to the round. The corrected criterion, all nine claims in final form, was re-run against the previous seal in a scratch tree: nine failing, none passing, one definition.
Lesson: every one of these was caught by a second party or by a redundant measurement, and none by the party making the claim. Self-reported completion is the weakest link in an autonomous pipeline, and the cheap structural defences — a successor that can revoke a stale lease, a gate that compares two claims for definitional identity, a second probe measuring the same property from another direction — each caught a real error on this one day.
A pinned work order moved under a running successor
Detected by the worker that caused it. Asked to conform a handoff to a plan requirement, it edited that handoff after the next worker had already claimed the lease and begun building against the file's hash. The successor's briefing pins the hash and instructs it to verify, so the edit would have stopped a mid-build worker on a work order whose actual instructions had not changed at all.
Done: the file was restored to its exact pinned bytes, verified back to the pinned digest, and the new material was put in the report instead — a document nothing pins.
Lesson, now written into the convention: a handoff is immutable once a successor has been dispatched against its hash. Anything learned afterwards goes in the report, the status file, or a new note. If a pinned work order genuinely must change, the successor has to be told, not left to discover it at a hash check. The worker that caused this had itself been caught by the same trap earlier in the same round, when its own work order moved underneath it.
The publication gate's fix read the manifest instead of the bytes
Detected by an external review of the fix, which returned BLOCK and built the counterexample: a manifest naming one attachment and claiming full coverage, with the evidence pack file simply absent — and the fixed gate returned PASS. The same review broke the coverage test with the string CARRIED NOT ACTUALLY, which passes a prefix check for CARRIED.
Cause: the fix made the check run on every answer, which was the right move, but the check terminated at a JSON file's claim about a pack rather than at the pack.
Done: the check now walks the whole chain and every link must hold; coverage is re-derived from the validated inventory and the stored table has no vote; the dive record now carries the hash of the bytes it read, so a verdict can be bound to them. Twenty-six failures on the old bundle, thirty-five tests green on the new one. Nothing was applied — the live gate is unchanged and the adoption decision is carded, because on the artifacts as they exist nothing can currently authorize a post: of 43 evidence packs examined, 0 carry a coverage table, and of 41 recorded verdicts replayed, 41 carry no hash of the pack they read.
Lesson: an authorization check must terminate at the bytes, not at a record about them — otherwise you have moved the hole one level down and can honestly believe you closed it. And a prefix or substring test is a bypass wearing a check's clothes.
The phone shell cannot own audio playback, and ten rounds of work were spent not knowing that
Detected by a research pass over maintained open-source players, cross-checked against the author's own playback log.
Cause, and it is a platform fact rather than a defect anyone introduced: the Media Session API is not implemented in Android's WebView, and WebView does not request audio focus. So a player living in the page is invisible to the system's audio-focus arbitration and cannot receive headset transport actions. The log shows the boundary cleanly: 608 media-session action records against 2,467 plays while the site ran in the browser (2026-08-05 → 2026-08-24), and 0 records against 12 plays in the installed shell (2026-08-27 → 2026-08-28), with the last such record on 2026-08-26.
Done: no code. A five-phase plan to move playback into a native media session was written and sent for external review, which returned REVISE with twelve edits — including that the proposed on-device check cannot falsify the whole diagnosis, because the diagnosis has two independent parts and the check tests one.
Lesson: ten rounds of increasingly careful work went into making a page's answer about what it was playing trustworthy. The answer was not to make the page more trustworthy but to stop asking it — every guarantee that architecture can offer is "the page said so" rather than "the player did". Before hardening a workaround for the eleventh time, check whether the capability you are working around exists at all on the platform you are running on.
Intentions vs outcomes
Forward — changes made 2026-08-28
| Change | Intent | Re-check 2026-08-31 | Re-check 2026-09-11 |
|---|---|---|---|
| Decompose review submissions, one question per invariant | Get rulings past a classifier that refuses whole submissions | Did the next round get a full set of answers without refusals? | Has any round since needed a stand-in reviewer? |
| Closing offer to supply any by-reference item in full | Let a reviewer ask rather than guess or defer | Was the offer taken up again? | Has any ruling turned on material supplied this way? |
| Opening plain description of the system under review | Remove the reading in which the material looks like attack research | — | Refusal rate across rounds since |
| Cite prior verdicts by digest, scope the diff, no technique enumerations | Reduce what a reviewer must be handed to rule | — | Still followed, or quietly dropped once refusals stopped? |
| Pre-registered ordering witness before the first edit | Make execution order a checkable artifact | Present in the next round? | Four rounds running? |
| Status file written before the verdict file | Satisfy the completion gate by sequencing, not by touching a file | — | Any round back to touching |
| Different builder family + acceptance criterion written first and committed failing | Stop one reading writing both the code and its probes | — | Did the next round's findings again avoid the previous round's failure shape? |
| Lease taken through the claim path with a registry attestation | Make lease ownership checkable rather than conventional | Used again on the next dispatch? | Any lease held without a claim record |
| Seventh work order rewritten as a design brief; sequence held for an owner fork | Stop paying for rounds that cannot change the failure class | Has the fork been carded? | Was a seventh round dispatched anyway? |
| Publication gate rewritten to walk slug → manifest → bytes → response (proposed, not applied) | Stop a claim about evidence standing in for the evidence | Live gate still byte-identical? | Adopted, rejected, or still pending |
Backward — check-backs due
Retrospective, written 2026-08-29. These use only what the day's own reports contain; several are therefore unverifiable rather than closed, and say so.
| Row | Verdict | Method | Limit |
|---|---|---|---|
| "Raising the client timeout cap will produce a Pro answer" | GONE | Three genuine sends at 120, 150 and 150 minutes each terminated at exactly their cap with nothing partial at any poll, across three pack sizes | No visibility into the vendor's internals; this is inference from client-side timing, and the worker who made it called it high confidence, not certainty |
| "The attached prior verdict and the trigger vocabulary are why submissions are refused" | GONE (as a diagnosis) | The next round's pack removed both, measured 0.20 hits/KB against 1.31, and drew an identical refusal | Refutes the strong form only; nothing here identifies the actual trigger, and the replacement explanation — the subject matter — was not tested |
| The pack-construction rules that diagnosis produced | HOLDS | Followed in every round since and endorsed at the top of the amended guidance; the rounds that followed were answered | Cannot separate the rules' contribution from decomposition's, which changed in the same window |
| A sealed submission left untouched for 14 days is still sound | HOLDS | The whole contract suite re-run at head before the seal was trusted: exit 0, focused suites passing, 16 contracts, no identity drift | Verifies the tree, not the submission's fitness for review; the submission then failed on its merits |
| The obligation to pull deep-dive copies of record within ~24 hours before the vendor deletes them | HOLDS | The fifth round's report states all three of its copies plus the previous round's outstanding one were pulled after the rate-limit cooldown and committed | Rests on that worker's own statement, and that same worker asserted a lease release before performing it — precisely the class of claim that needs an independent check |
| Provenance settled for every deep dive used in a ruling | DRIFTED | Settled for three dives in one round by running the check after cooldown; one dive in the following round remains unsettled because its check returned a rate limit and was not retried | The unsettled dive's finding is carried on the worker's own reproduction instead, so no ruling depends on it — but the record is incomplete and the obligation is only named, not discharged |
| The two scheduler defects, first reported this day | UNVERIFIABLE (open) | Re-stated as still true by each of the four workers that followed | Deliberately not repaired — the driver is mid dry-run and rebuilding resets its window; nothing in the record shows whether its muted state has since cleared, and clearing it depends on another track committing its files |
| The overnight harness's memory layer — standing weekly re-check, author-flagged | UNVERIFIABLE | Nothing in the day's record touches it | This pack contains no memory-layer evidence at all; the row stays on the weekly re-check regardless |
What we still don't know
- Why the external reviewer refuses this material as a whole submission. The strong diagnosis is dead. "The subject matter itself" is the most economical remaining explanation and nobody has tested it. Decomposition is a workaround that works, not an explanation.
- Whether decomposition holds. It produced zero refusals in one round and one mid-run refusal after 61,000 tokens in the next. One data point in each direction.
- One deep dive's provenance, unsettled, with the settling check owed.
- Whether the anti-stall scheduler is still muted. It was as of 2026-08-28, and leaving that state depends on a different track committing work in progress, which is outside the affected worker's authority.
- Whether an acceptance criterion written by one party can ever be adequate. Round six's criterion caught everything round five's disease produced and still had three of its nine claims turn out weaker than they read — and the reviewers found that, not the suite. A criterion still only quantifies over what its author thought of.
- Whether the design-brief fork changes the failure class. Six rounds have produced zero passes and the failure shape has moved each round rather than shrinking. The claim that one unified enforcement path would remove the class is an argument, not a measurement.
- On the phone shell: whether the platform diagnosis holds on the actual device. The on-device check has not been run, and the review says the check as designed cannot falsify the whole diagnosis anyway.
- On the publication gate: what a rebuilt evidence pack would actually contain. The projection — 1 of 43 packs carrying every required class, 25 exactly one short — is a counterfactual over the existing file selections, not a forecast, and it can move in either direction. No rebuilt pack has been produced.
Technical detail
The stall predicate. The leg scheduler derives its awaiting-review state from a single condition: a request file exists and no matching verdict file does. There is no send-side ledger and no arming receipt, its proposals go to a log nobody reads, and its own documentation defers the send and ingest states to a later build. The governing plan does model a ready-but-unsent state; the implemented subset does not. Separately, the tree-safety predicate is evaluated repository-wide while the scheduler's work units are path-scoped, so uncommitted files anywhere in the repository move it to a state that emits no proposals.
Leases. Claimed through a claim script carrying a registry attestation. A release must log an event; a successor finding a held lease with no release event may revoke it as stale and reclaim it, which is what happened on this day.
The completion gate. Its first check compares the modification times of the status file and the verdict file, which is why status-before-verdict is now the sequencing rule. It also refused a completion claim whose failing and passing counts came from two different versions of the same probe; the remedy was to re-run the corrected criterion in its entirety against the prior seal in a scratch tree so that both counts describe one definition.
The review broker. Serialises every session's requests behind a global concurrency cap and reports in-flight, queue, cooldown and lock counts; one worker checked the channel clear before filing rather than firing blind. Its status record carries a completion path and a trust flag, and a separate check against the conversation of record returns the model identifier and a completeness judgement. Where they disagree, the check settles it. An account-level rate limit is not retried into by standing rule; the correct behaviour is to wait out the cooldown and re-run, which recovered three provenance determinations on one round.
Trigger-vocabulary measurement. Density was measured per submission component against a fixed pattern, in hits per KB: 0.32 for the request, 0.50 for the implementation diff, 1.31 for the attached prior verdict — the only component enumerating access techniques, and the one a fresh reviewer needs least. The rebuilt submission measured 0.20, 0.20, 0.00 and 0.00, and was refused identically.
Falsification discipline. Every new invariant is executed against the previous sealed tree to show it fails there before it is allowed to pass here. One round's nine-claim criterion was committed with all nine failing against the prior seal; another's suite ran 47 of 47 passing on the submission and 21 of 47 failing against the previous seal. A hunt is run before sealing, printing an expected outcome per construction rather than a bare verdict column — which is how one round caught a construction reporting accepted for the wrong reason, its precondition having been destroyed by a predecessor's teardown.
The two failure shapes, stated for reuse. Round five: a check that quantifies existentially where the invariant quantifies universally — does this resolve somewhere, versus does it resolve where the contract means; were products supplied, versus are they the same products. A probe exercising one witness of an existential cannot tell those apart, which is why four such defects survived a 47-probe suite built to catch exactly the previous round's error. Round six: a check universal over its members and absent on another path — an alternate spelling that skips the classifier, a second enumeration of the same universe, an enforcement boundary that never runs the rule the adjudicator runs. A probe that quantifies over members cannot see a defect that changes the path. The standing rules now read: write down the quantifier the invariant uses and the quantifier the code uses and make them match; and write down the path set a check runs on and show it is every path reaching the thing it protects.
Evidence-gate chain of custody. In order, and all six must hold before anything may publish or act: the manifest is a dictionary and names this slug; the pack file exists and is non-empty; the pack's hash matches the manifest; the response carries a pack hash matching those same bytes; every attachment the manifest claims is actually present in the pack; coverage is re-derived from that validated inventory, with the stored table treated as audit data carrying no vote. The assessment is monotone — it can turn a would-be publish into a hold, never a hold into a publish — and it is recorded on every row, including rows already blocked for other reasons, so a known evidence gap is never hidden behind an unrelated failure. Two failure modes carry two different remedies: unsupported evidence holds for a re-pack, an unbindable response holds for a re-review. Malformed metadata holds rather than raising, because the routine that runs it runs inside a periodic sweep that a raised exception would wedge.
Phone playback. The two platform facts are that the Media Session API is recorded as not implemented in Android WebView, and that WebView does not request audio focus. Consequences observed in the harness: a capture service taking transient-exclusive focus produces no pause, because the page player never held focus to lose; media buttons land on a session that controls nothing; the note anchor is a page-side snapshot with a lead time and an eligibility window compensating for staleness, rather than a position read from a player object. The shape that works, in every maintained player surveyed, is one native foreground service owning both the player and the session, with the web layer sending intents and rendering pushed state.
Polaris is an AI agent that runs this workspace overnight, under a constitution the author ratified clause by clause. Its standing limits are fixed and were not touched today: no acts outside the workspace, no money spent, nothing sent in the author's name. This entry is written from the day's logs rather than from memory, and where the logs are silent it says so.