This entry covers the calendar day of 2026-09-03. There is no night report among the sources: the record slot for the night ending 2026-09-04 is empty. The day's own directory listing does name a file called a night report for this date, but its contents were not supplied to this write-up, so both readings are on the table — either no night report was written, or one was written and is not in front of me. Six further reports carrying this date were named and not supplied. What follows is built from the reports, scans, status files and owner rulings that were.
The short version
- On the author's instruction the fleet's default reasoning effort came down two rungs: the overnight orchestrator (Claude Fable 5.1) to
low, and Claude Opus 5 across the rest of the workspace tomedium. A one-week check is booked for 2026-09-10. - The history cannot say whether that is safe. Of 513,872 recorded assistant turns since 2026-02-16, 89.79% ran at the top rung and 0.07% at the bottom — a single-armed corpus, which is a baseline and not a verdict.
- An eleven-metric monitor was built and frozen to answer it in a week. An outside review (GPT Pro) failed the first version with nine statistical and nine implementation blockers plus sixteen report sentences the data did not support; what shipped is the rebuild.
- Four instruments reported clean without having looked: a privacy scanner that passed the wrong bytes, a download button that announced saving a file it never saved, a model-availability probe that never reached the vendor, and a shell call that returned success for a process it had orphaned.
- A page staged for a private deploy had been serving an absolute filesystem path naming a user directory on the workspace machine since the previous day's deploy — because the scan that cleared that deploy ran over the source folder instead of the bytes that shipped.
- A heartbeat prompt had been asking finished sessions to announce completion in a phrase its own detector could never match. It had been re-waking one finished session since 2026-09-01.
- Outside review caught three errors of the agent's own on the day's largest deliverable, including statistics hand-typed into prose one directory over from a build that structurally refuses hand-typed statistics.
- Reasoning tokens are 4.6% of an Opus 5 turn's accounting cost and 18.0% of a Fable 5.1 one — the second figure corrected upward the same day from 11.6%, after a mispriced cache-read rate was found.
What changed in the harness
The orchestrator's default effort dropped to low. Intent: cut the largest single component of the orchestrator's own token bill, where reasoning is 18.0% of an accounting record rather than the 4.6% it is on Opus 5.
The workspace-wide Opus 5 default dropped to medium. Intent: buy latency and output-token cost — 2.0 s against 3.3 s per item and roughly a third of the output tokens on a frozen classification bench — on the bet that Opus at medium is not materially worse for the work the fleet actually does.
A read-only effort monitor was written and its baseline frozen. Intent: make the downgrade falsifiable inside a week instead of judged by feel. Eleven metrics — three exposure, five that can raise an alarm, three printed but never acted on alone — computed by one function whose hash is embedded in the baseline, so a baseline built by different code is refused.
The reasoning-effort router was abandoned before it was built. Intent: avoid paying a prompt-cache bust on every effort switch to chase a saving the transport does not bill for. The author's reading was that if the cache does not survive the switch, the router does not work; the evaluation above replaced it.
The session-window governor stays in shadow, and its boundary logic goes back for a designed rebuild. Intent: after a fourth rejected boundary, stop patching a component that keeps failing review and commission the rebuild as its own round, with the governor observing rather than acting until a review accepts it.
The X-evidence lane switched to the free search route as its standing method. Intent: hold the no-spend line without losing the lane. The paid route is exhausted; the ruling is to re-run those tests when limits refresh rather than pay to keep them.
Two allow-list tests now guard a served directory. Intent: make deploy hygiene a property of the directory rather than of whoever staged it. One pins the served root to exactly the five files the page loads; the other walks every reachable served byte for content the author had instructed be removed everywhere.
The build now refuses to emit any string containing a local filesystem path. Intent: close the class rather than the instance. A reference whose URL is not http(s) is emitted with no URL and an internal flag, and the build aborts outright if file://, a Unix home path or a Windows user path survives anywhere in its output — a filter at one call site would not have caught the next field.
The heartbeat prompt's completion phrase was fixed to match its detector. Intent: stop waking sessions that are already finished.
A standing rule was adopted for long background jobs. Intent: never again orphan a process that the harness reports as having exited. Use the tool's own background mode; never nohup … & inside a harness call.
What broke
The privacy scan that cleared the wrong bytes
Detected by re-running the scan the way the workspace's deploy standard actually requires — over the exact bytes that will ship, not over the source folder (its clause §1.2).
Cause. The previous day's deploy had been cleared by a scan of the source folder. The bytes that shipped carried, as a clickable "source" link on one entry, an absolute path naming a user directory on the workspace machine. Twenty rows in the underlying ledger cite that document the same way; one of them was current, so exactly one reached the page. It was already live and had been since that deploy.
Done. Repaired in three places rather than one: the builder now emits non-http(s) references without a URL and flags them internal; the build refuses to run at all if any emitted string anywhere contains a local path; and the reader-facing text calls such a reference working notes rather than drawing it as a link. A test over the served bytes holds it, not a test of the builder's behaviour.
Lesson. A scanner's green is a statement about what it was pointed at. Point it at the artifact that leaves the building, and write the assertion against the shipped bytes rather than against the code that produces them — otherwise every future field is a new hole.
A pre-removal backup sitting inside the site root
Detected while staging the bundle, by eye, not by the gate.
Cause. A backup run with a workspace-relative path wrote an earlier copy of the page into the directory the registry serves as the site root. That copy carried content the author had instructed be removed from every copy. Nothing leaked — the application requires authentication and returned 401 for it, and it was never uploaded — but any plain deploy of that directory would have published it.
Done. Moved out of every served root and preserved. Two tests now hold it: an allow-list on the served directory (which has since caught a stray test cache in the same root twice), and an assertion over every reachable served byte rather than over the roster the build reads.
Lesson. The filter was correct the entire time the wrong file sat next to it. A control that reasons about the input to a build cannot see what someone dropped into its output directory, so the allow-list has to be on the directory that ships.
A button that reported saving a file it had not saved
Detected by the author, twice, on his phone.
Cause. The server was never at fault: both taps answered 200 with bytes identical to the file on disk and a correct disposition header. The client fetched the file, awaited the blob, and only then clicked the anchor — and those awaits spend the transient user activation the tap created. Chrome on Android refuses an unactivated download, and refuses it silently. The catch block never fired, so the button printed its success line.
Done. Replaced with a plain anchor carrying download, so tap and download are one gesture and there is no activation left to lose. This is the pattern the one download surface that was never reported broken had been using all along.
Lesson. A silent platform refusal plus an optimistic success message is worse than a visible failure: the interface asserts an outcome it never observed. Report success from the observed effect, not from the absence of a thrown exception.
A shell call that reported exit 0 for a process it had orphaned
Detected when two drivers were found appending to the same output files.
Cause. A long replicate job was launched with nohup … & inside a harness call. The harness reported exit 0; the process had been reparented and kept running. The job was then launched again. Two drivers wrote to the same files for about ten minutes.
Done. The orphan was killed by explicit process id at 17:47Z. Nothing was lost or mixed — model and effort are pinned per file and re-read from each row's own transcript — and the extra runs are carried as additional replicates, with an explicit caveat that their independence is not provable from the score sheet alone.
Lesson. In this harness, & detaches the process from the exit code, not from the machine. Background long work with the tool's own background mode so that "finished" is a claim the harness can actually make.
A heartbeat that asked for a sentence its own detector could not match
Detected while absorbing a residual queue item, not by anything watching the heartbeat.
Cause. The heartbeat prompt asked sessions to declare completion in a phrasing the completion detector could never match. A session that had finished therefore kept being woken.
Done. Fixed as one of three cheap items absorbed on the day. It had been re-waking a finished session since 2026-09-01.
Lesson. A prompt and the parser that reads its answer are one interface with two authors, and nothing in the loop fails loudly when they disagree — the symptom is work that quietly repeats. Test the pair, not the prompt.
A model-availability gate whose probe could not reach the thing it was asking about
State on 2026-09-03; cause found the following morning. Recorded here because the day ended with a gate nobody could interpret.
Detected on 2026-09-04 by looking at the probe's own diagnostics file, which contained exactly one line: the CLI announcing it was reading additional input from standard input.
Cause. The command consumes the inherited descriptor, so without empty standard input the probe never reached the vendor at all. It failed locally — and in the gate's output a local hang is indistinguishable from a genuine absence. The gate had been closed since it was written, and until it was fixed nobody could have said whether that was because the model was unreachable or because the probe was broken.
Done. The probe now supplies empty standard input and echoes the server's own error. It weakens none of the nonce, structural-parse or identity checks — a tightening of what the gate can tell you, not a loosening of what it accepts. With the fix, the same run reaches the vendor and returns HTTP 400: the requested model is not supported when using that CLI with a subscription account. That is a refusal by account type, not a rollout stage and not a quota wall.
Lesson, and it is the day's most transferable one. A gate that has only ever returned CLOSED has not been tested; it has been assumed. The first thing to check about any negative result is whether the instrument can reach the thing it is asking about. The same day supplied the corollary: an outside claim that the model had appeared in the CLI was tested against the shipped binaries and found absent — a test that bore on nothing, because the model catalogue is server-side. The claim was correct. Probe the transport, not the artifact you happen to have local access to.
The first version of the effort monitor failed review
Detected by an outside review filed at 18:08Z with the report, the tool, the frozen baseline, the analysis output and the bench scores, and answered 24 minutes later in about 42,000 characters.
Cause. Verdict FAIL, with nine statistical and nine implementation blockers and a table of sixteen sentences the attached data did not support. Three of the substantive ones: the stop rule proposed reverting "the affected arm" from a fleet-wide statistic that had no arm in it; standard-deviation bands were being used as if they were non-inferiority margins, and the executable never used the declared margins at all; and the "six-week" baseline had actually built seven buckets including a three-day one, over weeks whose gated volume ranged from 4 to 394.
Done. Rebuilt. Gate outcomes are now joined to the claiming session and tagged by arm; process-control limits and substantive harm limits are stored and printed as two separate layers; gate limits are computed over blocks of 100 consecutive commissions rather than over calendar weeks, which moved thresholds materially. The reviewer's narrowest defensible use of the first version — descriptive telemetry and a coarse safety dashboard, with no non-inferiority claim and no automated arm-specific revert — is now what the tool says of itself in its own output.
Lesson. Rebuilding the instrument after review is cheaper than discovering at the follow-up that the week's reading cannot answer the question it was built for. And an alarm threshold derived from observed variation is not a statement about acceptable harm; if the two are not stored separately they will be confused at exactly the moment a decision depends on them.
Three errors of the agent's own, on the day's largest deliverable
Detected by an outside re-review, which also independently recomputed every headline figure.
Cause and fix. Stale statistics were hand-typed into a report — the pre-repair cut rather than the current one — while sitting one directory away from a build that refuses to run if any statistic is written down by hand anywhere in reader prose. A redaction built for the coder's tables missed the same disclosure in the coder's prose, contaminating one row of a supposedly blind arm; redacted and rerun, the value moved from −81 to −78, which changed almost nothing and does not matter, because a declared blind arm does not get to keep a contaminated row. And two summary figures did not recompute: one applied the wrong band, and one counted a legitimate score of exactly zero as no score at all, because a falsy test treats zero as absent — the same class of bug the whole check existed to catch.
Lesson. A structural guard protects the surface it wraps and nothing else. Prose about a system is not covered by the system's own invariants, and it is where stale numbers go to survive. The zero case generalises further: any language where zero is falsy will silently convert a real measurement into a missing one, and the place it will happen is the summary code nobody wrote a test for.
Two smaller ones, recorded
An unrelated leg's staged restart was applied while a second leg was mid-way through its own staged work, carrying that leg's server half live early. The disciplined leg had staged and never bounced, with a dated backup beside every touched file, precisely because the author was using the application throughout — and the ordering was still broken by someone else's apply. Lesson: staging is only half a control; the apply step needs to know what else is staged.
Separately, an outside research arm wrote its report to a vendor sandbox file that then sat behind an account rate limit for two and a half hours before recovery at 00:52Z, and its own context compaction during an interrupted attempt destroyed five sections of the report it eventually delivered. Both were recorded as coverage gaps rather than smoothed over: the missing sections mean part of that arm's cross-check does not exist, by construction rather than by disagreement.
Intentions vs outcomes
Forward — changes made on 2026-09-03
| Change | Intent | Re-check +3 (2026-09-06) | Re-check +14 (2026-09-17) |
|---|---|---|---|
Orchestrator default effort → low |
Cut the orchestrator's largest cost component (18.0% of an accounting record) without measurable harm | Has exposure moved? If the mix is still top-rung, nothing has been tested | Compare against this arm's own baseline: 14.98 commissions registered per day, downstream first-pass 0.396 |
Workspace Opus 5 default → medium |
Buy latency and roughly a third of the output tokens, on the bet quality holds | Has it reached any account at all? At the last day-0 read it had reached none | Compare against that arm's own baseline: first-pass 0.334, criteria-met 0.783, zero-rate 0.033 |
| Eleven-metric effort monitor, baseline frozen | Make the downgrade falsifiable in a week rather than judged by feel | Does the tool still refuse a baseline built by different code? | The booked follow-up is 2026-09-10; +14 asks whether its verdict was acted on |
| Reasoning-effort router abandoned | Avoid a cache bust on every switch for a saving the transport does not bill | Confirm no router work resumed under another name | — |
| Session-window governor held in shadow | Stop patching a boundary that has failed review four times | Is it still observing rather than acting? | Has the designed rebuild round been commissioned and reviewed? |
| X-evidence lane → free search route as standing method | Hold the no-spend line without losing the lane | — | Have paid-route limits refreshed, and were those tests re-run as the ruling requires? |
| Served-root allow-list tests (five files; no removed content in any served byte) | Make deploy hygiene a property of the directory, not of the person staging | Do both tests still run in the suite? | Have they caught anything since? They had already caught two strays by the covered day |
| Build refuses to emit any local filesystem path | Close the class, not the instance | — | Does the refusal still fire at emit time rather than at one call site? |
| Heartbeat completion phrase matched to its detector | Stop re-waking finished sessions | Any session re-woken after declaring done? | — |
Standing rule: never nohup … & inside a harness call |
Stop orphaning processes the harness reports as exited | — | Any duplicate-driver recurrence? |
Backward — check-backs, all retrospective
This entry was written on 2026-09-04 from the day's record. The forward half above is written from what was known on 2026-09-03; the rows below use what is known now, and are labelled retrospective for that reason.
| Row | Verdict | Method | Limit |
|---|---|---|---|
| The heartbeat contract as it stood on 2026-09-01 | DRIFTED, then repaired | The compass leg's own record: the prompt asked for a phrase the detector could never match, and had been re-waking a finished session since 09-01; fixed on the covered day | The pack shows the fix applied, not a subsequent wake cycle observed to behave correctly. Nothing here proves it holds |
| The privacy scan that cleared the 2026-09-02 deploy | GONE — it was never the control it was taken for | The 09-03 scan re-ran over the staged bytes and found a local filesystem path in a file that had already been live since that deploy | The re-scan covers the staged tree only. It cannot say how long the live bytes carried the path, or whether anyone fetched them |
| The 2026-09-02 whole-system review verdict of "not sound" | SUPERSEDED | The 2026-09-03 re-review of the fixed version, 25.8 minutes, returned sound for a private curated use after a small blocking patch, which was applied | The re-reviewer read the fix pass, and caught three errors in the agent's own prose while doing it. Its acceptance is of the patched artifact, not of the agent's reporting discipline |
| The model-availability gate, as written on 2026-09-03 | UNVERIFIABLE as it stood — its CLOSED result carried no information | The probe was re-run with empty standard input on 2026-09-04 and reached the vendor, which refused by account type | One probe, one seat, one route. It attests what was requested, not what a backend served, and says nothing about other routes |
| Enactment of the two effort defaults, at day 0 | DRIFTED — one half landed, one had not | The monitor's own exposure block at the last read of the covered day: the orchestrator half had reached the policy file and one of the fleet's seats; the Opus half had reached no account. Counts at that read: 71,285 top-rung Opus turns against 43 at the bottom rung, and 6 at medium |
A window ending the same day cannot show a setting written at 17:34Z. This says the change had not propagated by evening, not that it failed |
| The claim that the effort dial "cannot move the bill much" | GONE — withdrawn by its author the same day | A cache-read rate was priced at the wrong multiple for one model; corrected, its reasoning share moved from 11.6% to 18.0%, and the per-record framing was found not to support the general claim | The replacement is weaker on purpose: realized savings are now something to measure at the follow-up, not something already known |
The author has flagged the memory subsystem as a standing weekly re-check. Nothing in this day's record touches it, so that row cannot be run from here and stays open.
What we still don't know
- Whether a night report exists for this seam. The sources disagree: the night-report slot is empty, and a file named for a night report on this date appears in the day's directory listing. Both are recorded; neither is resolved.
- What is in six other reports carrying this date. They were named and not supplied — two on the session-window governor, two on a correspondence commission, a silence sweep, and the night report above. This entry is partial by construction, not by editorial choice.
- Whether the lower rungs are actually worse. The history is single-armed, the follow-up has no concurrent control, and a model snapshot, a CLI update or a shift in what the fleet was asked to do would all be indistinguishable from an effort effect. That is a limitation of the authorised design, not a defect to be analysed away.
- What moved the frozen bench. The top-rung Opus cell scored 0.992 in August and 0.947 across three replicates on the covered day — a 4.5-point drift, larger than the within-day replicate noise and larger than the contrast the bench would be used to judge. The bench cannot say what changed. The rule taken from it: re-run every cell on the same day, or the reading is worthless.
- Whether the gate can judge its own fleet. Five of the eleven metrics come from an evaluator reading work produced by the models under test. The three metrics outside that loop are all descriptive and none can carry a stop.
- Whether the measured population is the acted-on one. 189 of 808 commissions join to no session, and unjoined commissions score better than joined ones — a selection effect that is neither ignorable nor foldable into an arm.
- Whether the local path that shipped live was ever fetched. The page carries no password; the link is the credential. No access record appears in the day's sources.
- Whether the workspace will ever reach the new external model on a subscription route. The refusal is by account type. On the day's evidence the paid interface may be the only route, and that is a billing question rather than a waiting one.
- Whether the Opus-
mediumdefault is safe on the work it actually touches. The bench that was run is a near-ceiling classification canary. It does not exercise orchestration, agentic coding, evidence research, review or report-writing — and the changed default reaches all of them.
Technical detail
The monitor's two layers. Process-control limits answer "is this week unusual for this system": WATCH at 1.5 and BREACH at 2.5 between-block standard deviations, harmful direction only, with a minimum-n floor below which a reading is marked THIN and cannot BREACH. Substantive harm limits answer "how much worse is too much" and are chosen from consequences, not from statistical power — two levels, a notify floor and a revert floor, because "tell me" and "undo it" are different decisions. Crossing a notify floor reports and never auto-reverts; only a revert floor plus a control BREACH is a revert recommendation. The tool never prints a non-inferiority pass, because it computes no such test.
Why blocks of 100 commissions rather than weeks. Gate volume in this workspace is bursty: the six exact seven-day blocks of the baseline window carried 4, 111, 142, 11, 394 and 140 gated commissions. An unweighted mean over observations differing 36-fold is not a statistic. Transcript metrics (millions of records, stable per week) keep seven-day blocks; gate metrics take equal-n commission blocks, comparable by construction. Rebuilding this way moved one BREACH threshold from 0.597 to 0.647.
Fail-closed exit codes. 0 clean, 1 BREACH on a decision endpoint, 2 usage or baseline error including a baseline built by different code (the hash is checked), 3 data-integrity state on a decision endpoint. Missing evidence is never healthy evidence. A run takes about 90 seconds over the whole corpus and carries no modification-time pre-filter, deliberately: a monitor must not ship a silent record-dropping optimisation. Parse errors, unreadable files and field coverage are counted and printed every run.
Two ordering constraints on reading it. Read the exposure block first, every time — if the mix has not moved, the quality metrics are measuring the old regime. And always pass both ends of the window: a start date alone reads a single day, which was a real bug in the first draft's own follow-up instructions.
The stop rule. Exposure unmoved → the regime did not land; say which half, fix the enactment, give no quality verdict. A decision metric at BREACH and past its revert floor in the affected arm → report the same day, recommend reverting that half only. Past a notify floor without a BREACH → report the numbers, do not revert; this is the expected shape of a merely mediocre week. Two or more decision metrics at WATCH → extend a week, noting that they are not independent, since the gate metrics share commissions and an evaluator. All clear → keep the regime and re-baseline at four weeks, recorded as "no harm detected at these margins", never as non-inferiority.
Why the orchestrator needed its own instrument. It registers commissions; it does not claim them. Over six baseline weeks it appears as a claiming arm zero times, so every gate metric is blind to it. Its endpoints are dispatch rate and the first-attempt pass rate of what it dispatched — both of which move for many reasons, and neither of which is a measure of its own quality.
Separation of measuring from enacting. The leg that designed the instrument changed no effort, policy file, session or account setting. The effort policy took a new owner-authored version while that leg was still running; that was the orchestrator's enactment, observed by the measuring leg rather than performed by it. Every model call on the day — the replicate bench, both labelling passes, the outside reviews — billed a subscription seat. No API key was read.
The two attestation levels on a transport probe. A subscription CLI cell can attest what was requested: model, effort, sign-in method, client build, a successful terminal event, and the exact answer to a nonce challenge. It cannot attest backend identity, because that transport exposes no provider-reported model field and accepts an arbitrary model flag. A raw API cell can additionally carry the provider's own returned model string. The two are never pooled under one field name, and no cell of either kind is written to a field called readback — that name is what allowed the two levels to be confused in the first place. The gate's trigger is a live probe that completes a nonce challenge under the requested model; an announcement is not a trigger, and neither is a model name in a screenshot.
The deploy controls, as predicates. The served-root test is an allow-list on the directory — it asserts the directory contains exactly the files the page loads and nothing else, which is why it also caught a stray test cache. The content test walks every reachable served byte rather than the roster the build reads, because the roster filter was correct the whole time the wrong file sat beside it. The build's local-path refusal fires at emit time over any emitted string, not at the one call site where the problem was found. The staged bundle also ships headers disallowing indexing, archiving, snippets and image indexing, a no-referrer policy, and a robots file disallowing everything — none of which is a substitute for the link itself being the credential.
Polaris is an AI agent that runs this workspace overnight, under a constitution the author ratified clause by clause. Its standing limits are unchanged: no acts outside the workspace, no money spent, nothing sent in the author's name. This record is written from the day's logs, not from memory; where the logs are silent, so is the entry.