This entry covers the calendar day 2026-09-09 as the workspace counts it — locally. The machine's clock runs seven hours behind UTC, so the evening's work carries 09-10 UTC timestamps from 01:00Z onward while still belonging to the 09-09 record; that is where the seam falls in every time below. On the night report there is a conflict in the record and it is not resolvable from here: the assembler that built today's source pack reports no night report on file for the night ending 2026-09-10, while the day's own report directory lists a file whose name says night report for this date. The file's contents are not in the pack. Nothing below comes from a night report.
The short version
- The usage store had been counting the same model turn once per replay. A forked or resumed session copies its parent's usage history into its own file under its own clock, and the row key contained that clock. July held 216,147 stored rows for 57,610 real turns — 79.1% of that month's tokens were copies.
- Rekeying the store by what a turn is rather than when it was seen collapsed 507,228 rows to 339,161. July's GPT figure fell from $14,281.38 to $5,155.41, and July's total from $40,937.02 to $31,811.05. Nothing about July changed; the same turns had been stored about five times each.
- An independent review of that fix, run at the highest reasoning effort after the change had already shipped, returned no showstoppers, two high-priority findings and six medium ones. Six were folded, one was measured to zero against the real corpus, two were filed unfixed.
- The anti-stall sweeper charged a work lane one of its three restart attempts on five return paths that never launch anything — no seat with headroom, terminal unobservable, target already running, no ownership, account inactive.
- The same sweeper dispatched an already-finished item for the fifth consecutive time on one key, on the premise that it had sat 31 days untouched. The work finished five days earlier and had been re-verified twice; nothing had ever been permitted to write the status file that would have said so.
- The system disk fell from 367 GiB free to 180 GiB in three days — about 62 GiB a day — against a weekly reclaim job that works and recovers about 21 GiB a week. 190 scratch directories already authorized for deletion, 45.5 GiB of them, were waiting up to seven days for Sunday.
- A work session that died with its terminal server at 08:46Z left an uncommitted change in the shared tree that failed the nightly publish gate two nights running. The change was archived as a patch and the tree restored at 06:31 local.
- A configuration fix for the workspace machine was handed to the author as prose rather than as a copyable block; the author reported trying it and doubting the paste landed correctly. The record has no follow-up.
What changed in the harness
Usage rows keyed by state, not by clock. A turn's identity is now the session it belongs to, the five components of that turn's token delta, and the running total — with no timestamp in it. Intent: a turn replayed into a forked or resumed session collapses onto the row it already produced instead of being counted a second time.
The event timestamp kept as data, with the earliest emission winning. Intent: the surviving row is the original turn rather than whichever copy the scan happened to reach first, which makes the result independent of traversal order.
A one-time in-place migration rather than a parser-version bump. The rows already held everything the new key needs, so the collapse was exact. Intent: months whose session files are already compressed cannot be re-parsed, and a version bump would have preserved the old semantics for exactly the months that were worst.
Detect-and-heal for a session file that shrinks. A rescan that yields fewer rows than the file already owned now marks the collection degraded — it was reporting healthy through this — and clears the file cache so the next refresh re-derives every state from disk. Intent: a state stranded in some other file gets re-read rather than silently lost.
Counter resets counted in the health block. Intent: make the one collision the new key cannot rule out observable if it ever occurs, instead of leaving the assumption to go stale in silence.
The migration made retryable, and the missing-timestamp branch closed. The scratch table is dropped before it is created, and the timestamp comparison now treats a missing or empty stored value as replaceable. Intent: an interrupted migration should be recoverable rather than permanently wedged, and a row with no timestamp should not freeze forever on whichever copy landed first.
A metric renamed from "dropped" to "rejected". Intent: the name should state what the number counts — incoming rows refused — because a replay reached before its original is absorbed as a replacement and never counted, and the order-independent figure is the row count.
The reconciliation cross-check taught both key shapes. Intent: the tool whose agreement with an independent counter argued for this fix has to stay runnable against the database the fix produced. It had been refusing the very shape it caused.
The sweeper stops charging an attempt for a return that never launched. Intent: a lane's three tries should be three tries.
A separate restart budget for one work lane. The author ruled, accepting the recommended default, that the lane gets its own budget of three restarts a day, separate from the fleet's shared six, with every other rail unchanged — cooldown, minimum gap, escalation after three failed attempts, keep-list and exclusion vetoes — and an alert when the three are spent rather than the lane sitting empty and quiet. Intent: keep one lane staffed without letting it eat the shared budget, and make exhaustion loud.
A large model-weights cache relocated off the system disk. 147,209,020,485 bytes, 1,258 files, 361 symlinks, no hard links, copied to the bulk disk after checking that no process held anything under the source open. Intent: reclaim about 137 GiB without deleting a byte of something that is deliberately exempt from the weekly sweep.
Failover automation folded live and left observing. This one lands on the seam: the fold finished at 23:55 the previous local evening, and its first live confirmation fired at the top of the covered day — 38 sessions, every row observer-only, every one a no-op, no model switch, no message sent. Intent: prove the actuator sees the fleet before it is ever allowed to act on it.
Cards to the author now carry their review metadata. A card row records the reviewer, the actual verdict, the exact draft that was reviewed, and the review artifact — and a revised draft is explicitly marked as not carrying a verdict of its own. Intent: a card cannot imply a review it did not get, or borrow a verdict that was passed on a different version.
What broke
Every fork counted its parent's history again
Detected: not by an alarm. The defect was already identified and queued, and had sat 13 days with nothing picking it up; the anti-stall sweeper's third and final restart is what finally put a session on it. The magnitude was then measured by rebuilding every stored row's key from the row's own columns and counting the collapse.
Cause: the row key was the session, the event timestamp, the turn's delta total and the running total. A forked or resumed session replays its parent's entire usage history into its own file under its own clock, so every replay keyed as a fresh turn and was charged again. One July session was replayed into 60 files: 81,432 stored events carrying 8,134 real turns. September was already clean, because a guard added on 09-06 dropped the within-file half of this; the cross-file half is what survived it.
Done: the key was rebuilt from the turn's content, the timestamp demoted to a data column, and the store migrated in place. Ground truth after the collapse: July's counters for one model — 223,021,871 fresh input, 5,133,449,472 cached, 25,197,112 output — match an independent open-source usage counter's UTC-July figures for that model exactly, and the same holds for every other model in the common set.
Lesson: identity should be made of what a thing is, never of when you saw it. Any store fed by a log that can be replayed needs a key derived from the content of the event, because the moment of observation is the one field guaranteed to differ between an original and its copy. The corollary is worse than the bug: a clock in a key does not fail loudly, it inflates quietly, and the inflation looks exactly like growth.
The review found eight things, and two of them were tests passing for the wrong reason
Detected: by dispatching an independent review at the highest reasoning effort after the change had shipped and been applied to the live database.
Cause and disposition, in order. One high-priority finding — that a mid-session counter reset could make a genuine turn collide with an earlier one — was not argued with, it was measured: all 10,749 of July's session files were decompressed and re-parsed twice, once under the shipped key and once under a key that adds an ordinal incrementing on every counter reset. Both produced 57,370 states and 5,705,773,233 tokens; the stricter key kept zero states the shipped key merges. The second high-priority finding — that a file which shrinks between scans can strand a state that another file still holds — was real and was folded as detect-and-heal. The one live breakage: the reconciliation tool that produced the cross-check this whole fix rests on asserted the old four-part key shape and exits on the first July row, confirmed by running it against the production database. Then the two tests. A test that claimed to prove the earliest emission wins regardless of scan order had put the original first in both of its cases, so the branch that matters never ran. A second test compared the migration's key against the helper function rather than against what the scanner actually writes — and the failure that matters is a rescan re-adding every row the migration just collapsed.
Also caught, by the completion gate rather than the review: the review write-up had claimed nothing was edited while the reviewer was reading. Two evidence files were in fact created during that window, neither in the reviewer's read set. The gate rejected the unqualified wording, and the claim was narrowed to what was actually true.
Lesson: verify a test by breaking the thing it is supposed to catch. Every folded fix here was confirmed by inverting the comparison and watching the test fail; the two defective tests could not have failed at all. This is the same lesson the deploy checker taught two days earlier from the other direction — a checker that has never been observed failing is a claim, not evidence — and it arrived this time inside a test suite, which is where it is hardest to see. The second lesson is about freeze claims: state what you actually controlled, not the widest sentence that felt true.
The sweeper charged for launches it never made
Detected: by the session dispatched to fix an unrelated row, reading the sweeper's restart routine.
Cause: the attempt counter incremented, and a history entry appended, on every return from the restart routine. Five of those returns are skips that issue nothing at all — no seat with headroom, the terminal unobservable, the dispatch target already live, no account ownership, the account not configured or inactive. Each cost a lane exactly what a real try costs. The leg that found this had itself been restarted twice: the first session lived 29 seconds and touched no files, and the second never launched because the router refused it on unknown telemetry.
Done: the row is marked complete in the day's record. The pack does not carry the applied change or a re-run.
Lesson: a retry budget must only be spent on the thing it is budgeting. When the failure paths and the success paths return through one exit, the counter stops measuring how hard the work is and starts measuring how reluctant the harness was — and if that same counter also gates escalation, the harness escalates about its own reluctance. Note the timing on this one: the author's ruling that afternoon set a lane budget denominated in restart attempts, hours before the defect in attempt accounting was written up. Whether the lane budget reads the same counter is not stated anywhere in the record.
The staleness signal fired on finished work for the fifth time on one key
Detected: by the dispatched session checking the premise of its own dispatch before doing anything.
Cause: the item was dispatched as "open 31 days and nothing has ever picked it up." The work was finished on 09-04 and re-verified twice since; nothing had ever been allowed to write the status surface the detector reads. The premise has now been false five consecutive times on this key.
Done: the leg registered its completion gate before starting, with zero of eleven checks satisfied and two ordering witnesses declared up front. The gate failed twice and was right both times — the first round caught an annotation substituted for an ordered correction and waived on the leg's own authority ("not a registered waiver"); the second caught that documenting why a correction could not reach its consumers is not authorization to defer it ("explains the failure but does not authorize deferral"). It passed at 14:46 local with all eleven executable and all five prose criteria met and nothing recorded as omitted. The record does not show a fix for the detector.
Lesson: a staleness signal is only as true as the surface it reads. If finishing the work does not write the field the detector polls, the detector re-dispatches forever, each re-dispatch looks like diligence, and the cost is invisible because the sessions it spawns do real-looking work. Before adding a "nobody has started this" alarm, check that finishing is able to clear it.
62 GiB a day against a weekly reaper
Detected: by a sentinel that samples free space on a schedule — 238 GiB free at 13:30Z, 204 GiB at 13:50Z, a 34 GiB fall in twenty minutes with 182,000 new inodes. A dispatch note had quoted that 238 GiB figure as a 14:00Z reading; it was the 13:30Z row.
Cause: the weekly reclaim job is not broken. Its 09-06 run recovered 20.9 GiB. The fill rate is simply an order of magnitude larger: root fell from 367 GiB free to 180 GiB in three days. The measurable backlog is the sharper number — 190 scratch directories already carrying a deletion authorization were still on disk, 45.5 GiB, waiting up to seven days for the next Sunday. Separately, the largest single consumer, a 138 GiB model-weights cache, is deliberately exempt from sweeping as live state, which is precisely why deleting was never the right instrument for it.
Done: a census rather than a guess. By the time the investigation ran, the write burst had ended — the heaviest writer over a 20-second sample moved 1.7 MiB — and the largest single object on the disk, a 48 GiB scratchpad, belonged to a session that was still running and was ruled untouchable. The exempt cache was relocated to the bulk disk instead, preserving every byte.
Lesson: a garbage collector on a weekly cadence is a bet that nothing fills the disk faster than weekly, and that bet is rarely re-examined after the collector starts working. Size the reaper against the measured fill rate, and track the quantity that is already authorized for deletion and still present — that number, not total usage, is the real backlog and it is the one that says whether the cadence is wrong. When the biggest object is exempt or in use, the correct move is relocation, not a stronger sweep.
A dead session's uncommitted work failed someone else's gate for two nights
Detected: by the orchestrator, when it traced a nightly publish that had refused to run.
Cause: a work session died together with its terminal server at 08:46Z, leaving an uncommitted credential-gate change sitting in the shared tree. That change blocked the publish pipeline's first gate on two consecutive nights.
Done: the changes were archived as a patch alongside the moved test file, with instructions to reapply and land them through the audited route after review, and the tree was restored to its committed state at 06:31 local.
Lesson: a dead session's uncommitted work is not neutral — it stays in the shared tree and fails other people's gates, and the gate failure names the gate rather than the corpse. Archive-then-restore is the right direction, because it preserves the work as a patch while letting everything else proceed. The measurable cost here is the latency: two nights of a blocked publish before the dirty tree was connected to the failing gate.
A fix the author had to run by hand arrived in a form he could not paste
Detected: by the author, who tried it and said so.
Cause: a configuration fix for the workspace machine — raising a file-watch ceiling — was handed over as prose rather than as a single copyable code block. The author reported attempting it and suspecting the copy-paste had not landed correctly.
Lesson: anything a human has to execute by hand should arrive as exactly one copyable block. A correct command delivered in a form that cannot be pasted cleanly has roughly the failure rate of a wrong command, and it fails silently on the other side of the channel, where the agent cannot see it. This is the delivery-artifact failure from two days ago in a different costume: the writing side sees a successful hand-off, the reading side sees something it cannot use.
A card that had been reviewed carried no record of it, and a citation that did not say what it was cited for
Detected: by an adjudication round tossing the work back.
Cause, first half: the card drafted for the author had in fact been reviewed at the highest effort, and the review had come back blocked — three blockers, six should-fix, two nits. None of that was in the card's own metadata. As filed, the card presented itself as ready, with no reviewer, no verdict, and no pointer to the review.
Cause, second half: a queue row cited an escalation as re-confirming the item it authorized. Reading the cited answer showed it adjudicates a different interlock and excludes this row in its own words.
Done: the card row now names the reviewer, the effort, the actual blocked verdict, the exact pre-fold draft that was reviewed and the review artifact; the recommended option is labelled and matches the stated default; the revised draft is explicitly marked as not carrying a verdict of its own; twelve properties were re-verified mechanically. The citation was corrected by appending a correction rather than editing the original row.
Lesson: a review that happened is not evidence unless the artifact carries it, and a revised draft is not an approved draft — record which version the verdict was passed on. For the citation: an authorization reference is a claim, and the only way to check it is to read the source before writing it down. In an append-only ledger, corrections append; the wrong row stays visible with its correction attached.
A deferral that pointed at a session which had already stopped
Detected: by a session re-verifying its own claims live before writing a handoff, rather than writing them from memory.
Cause: a deferred item was keyed to "after the other leg's release commit". That leg had escalated to the author's court on new grounds and stopped, seven minutes before the handoff was written. The pointer named an actor that no longer existed — which is the exact dead-letter shape the commission had been dispatched to fix.
Done: corrected in the evidence file and in the queue row before the handoff was written.
Lesson: a deferral keyed to another running process becomes a dead letter the moment that process ends, and nothing announces it. Key deferrals to a condition you can test, not to an actor you hope is still alive — and re-verify every pointer at handoff time, because a handoff is exactly where unverified pointers become someone else's problem.
Intentions vs outcomes
Forward — changes made on 2026-09-09
| Change | Intent | Re-check 2026-09-12 | Re-check 2026-09-23 |
|---|---|---|---|
| Usage rows keyed by state, with no clock in the key | Stop counting a replayed turn as a new one | Confirm a refresh since the change has not re-added collapsed rows — row count and per-month totals stable | Whether July's corrected figure held, and whether any month's total moved without a stated cause |
| Counter resets counted in the health block | Make the one collision the key cannot rule out observable rather than assumed away | Whether the health block has reported any resets at all | Whether the count is still zero, and if not, whether the key was revisited |
| Detect-and-heal when a session file shrinks | A stranded state gets re-derived from disk instead of vanishing | Whether the degraded state has fired, and whether the cache clear followed it | Whether the heal ever recovered a state, or has never fired |
| Reconciliation cross-check accepts both key shapes | Keep the tool that argued for the fix runnable against the database the fix produced | Run it against the live database for July and watch it complete | Whether the cross-check was actually re-run and still agreed to the token |
| Sweeper charges an attempt only for a real launch | Three tries should mean three tries | Look for a lane whose attempt count moved without a launch behind it | Whether any lane exhausted three genuine attempts, and what happened then |
| One work lane gets its own three-restart daily budget, with an alert when spent | Keep the lane staffed without eating the shared budget, and make exhaustion loud | Whether the alert fired on exhaustion rather than the lane sitting empty | Whether the separate budget changed how often the shared six were spent |
| Model-weights cache relocated to the bulk disk | Reclaim ~137 GiB without deleting exempt live state | Confirm the system disk kept the reclaimed space and the cache resolves from its new home | Whether the fill rate still outruns the weekly reclaim cadence |
| Failover automation folded and left in observing mode | Prove it sees the fleet before it is allowed to act | Whether every scheduled firing since has stayed observer-only | Whether it was ever allowed to act, and on whose authority |
| Card rows carry reviewer, verdict, reviewed draft and artifact | A card cannot imply a review it did not get | Spot-check the next card for the review object and that it names the real verdict | Whether any card shipped without one |
| Dead session's uncommitted work archived, tree restored | Stop one corpse from failing everyone else's gate | Whether the nightly publish gate passed on the following nights | Whether the archived patch was reviewed and landed through the audited route, or is still sitting |
Backward — retrospective check-backs
Written on 2026-09-10 with today's knowledge, against the intentions the record carries. The previous daily entry's re-checks fall due today rather than on the covered day; most of them concern a benchmark subsystem this pack contains nothing about, and are recorded here as unverifiable rather than quietly retired.
| Row | Verdict | Method | Limit |
|---|---|---|---|
| "Three restart attempts mean three real tries" (standing) | GONE | Read the sweeper's restart routine: five of its return paths are skips that launch nothing and all charged an attempt; one lane's three attempts included a 29-second session that touched no files and a launch the router refused outright | Shows the defect and a leg marked complete; the pack carries neither the applied change nor a re-run, so the repair is unverified |
| "A finished item stops looking unstarted to the sweeper" (standing) | GONE | The fifth consecutive false dispatch on one key: work finished 09-04, re-verified twice, and nothing was ever permitted to write the status surface the detector reads | One key. The record does not say how many other keys share the writability gap, and shows no fix for the detector |
| "Deploy credentials reach a deploy only through the broker, never a plain environment export" (standing) | HOLDS | Checked live: the token is absent from the environment; both shell profiles carry only the 2026-08-14 removal note and the broker route; the deploy CLI refuses in a non-interactive environment; no browser-login state exists | One machine at one moment. It shows the token is not in that environment, not that no path could obtain it — and the same absence is why two public surfaces could not be deployed at all that day |
| "A review reaches the author before a card does" (standing) | HOLDS, with the failure in the record-keeping | The day's card draft did carry a review at the highest effort, returned blocked with three blockers, before it was carded; what was missing was any trace of that in the card's own metadata, which was corrected | One card. Says nothing about how many earlier cards carried a review object |
| "The usage dashboard's per-month totals are trustworthy" (standing) | GONE, then repaired | The migration collapsed 507,228 rows to 339,161; July's priced components then matched an independent counter's UTC-July figures exactly | The match is on priced components for the common model set. A 240-row residue remains in the volume column, and the files needed to re-derive it are compressed |
| Previous entry: "the API key is stripped and that CLI runs on its subscription login" | UNVERIFIABLE | The pack contains no reading of that tool's configured auth mode or of any subject environment on the covered day | Cannot be closed from here; it is a process-level check and needs to be run on the machine |
| Previous entry: delivery canary pass rates, canary pause bound, boundary-gate refusal, model-identity disclosure, frozen panel sizing, public deploy gate | UNVERIFIABLE | The covered day's record contains no benchmark arm, no boundary receipt and no public-surface deploy | Silence in one day's pack is not evidence either way; these carry forward to the next entry that has the subsystem in scope |
| Previous entry: "spot-check other delivery rows for an empty artifact field" | UNVERIFIABLE | A file whose name suggests an enumeration of delivery writers exists in the day's report directory; its contents are not in the pack | The sweep may have run; this record cannot say what it found |
| Memory subsystem (author-flagged doubtful; standing weekly re-check) | UNVERIFIABLE this week | The pack contains no memory-subsystem evidence for the covered day | Stays on the weekly re-check regardless of verdict, per the author's flag |
What we still don't know
- Whether a night report exists for this night. The pack's assembler found none; the day's own report directory names a file that would be one. Both readings are consistent with what is here.
- Whether the counter-reset collision the new key cannot rule out has ever occurred outside July. The measurement covers July's 10,749 session files and found zero cases; June's and August's files are compressed and were not re-parsed.
- What the residue in the volume column is. Re-parsing July gives 57,370 states where the database holds 57,610; the difference is described as 236 rows whose total does not equal input plus output, carrying 6,310,716 tokens — 0.11% of July. The two counts do not reconcile in the record, the priced components are unaffected, and checking further requires reading compressed files.
- Whether the terminal-server death recorded at 08:46Z and the session that launched at 08:48Z on the covered day and lived 29 seconds are the same incident. The archive note gives that time without a date; the record does not connect them, and neither do I.
- What the completion gate objected to when it closed the dashboard work with all four executable checks passing and a prose criterion at soft failure, raising an escalation four minutes before the row closed. The verdict text is not in the pack. The immediately prior pass on that same lane also closed at soft failure with its own escalation still open.
- Whether the lane restart budget the author ruled on that morning is denominated in the same counter that was found charging attempts for non-launches that afternoon. The record states both and connects neither.
- Whether the two rulings answered on the covered day reached the decisions ledger. They carry canonical decision identifiers, and the ledger the pack searched has no entry naming the date.
- Whether the disk relocation completed. The record gives the start time, the byte count and the file counts; this pack does not carry the completion or the reclaimed figure.
- Whether the file-watch fix was ever applied. The author reported trying it and doubting the paste; there is no follow-up in the record.
- Whether the two findings filed rather than fixed — an over-count at the head of a resumed file when the previous state is missing, and the compressed-month residue — are still open.
- Why the row that fixed the double-count sat 13 days with nothing picking it up. The record shows one detector that reports the opposite condition falsely; it does not contain a count of work that genuinely was never started.
Technical detail
The key. Session identifier, the five components of the turn's token delta, and the running total. The components rather than just their sum, because sibling workers forked from one thread share a session identifier and each run their own counter from zero, so two genuinely different first turns can land on the same running total — measured three times in four months. A real replay copies the stored usage block verbatim, so its components match to the token; a sibling collision does not, and stays two rows. Across the whole database, of 16,123 duplicated states, 16,120 carried byte-identical component splits and 3 did not.
The collapse, by month. June 41,152 rows to 40,966 states (5.505B tokens to 5.483B); July 216,147 to 57,610 (27.356B to 5.713B, −79.1%); August 203,773 to 194,429 (15.250B to 14.284B, −6.3%); September 46,156 to 46,156, unchanged, because it had been parsed under the guard that already dropped the within-file half.
Why a migration and not a version bump. Every June and July session file is compressed by now, so a bump would have kept those months under the old semantics and the over-count would simply have survived it. The precedent is three days older: a bump on 09-06 with a blanket delete removed 437,696 rows — 47.1B tokens — that nothing on disk could re-derive; the guard added after that incident keeps rows whose files are gone. The stored rows held everything the new key needs, so the collapse is exact rather than a re-parse.
Survivor rule, and the attribution it bought. The earliest timestamp wins, never whichever row was scanned first. Of 6,168 duplicated states whose copies disagreed about which model produced them, the disagreement was always an unknown against a named model, and the earliest copy carried the named one every time — so July's 29,961 unknown-model rows and August's 1,776 turn out to be replays of rows that do know. No duplicated state's copies disagreed about the month, and none about the account.
The measurement that closed the reset finding. All 10,749 July session files decompressed and re-parsed under the scanner's exact rules, keyed twice: the shipped key, and the shipped key plus a per-file ordinal that increments on every decrease of the running total. If any same-key repeat were a genuine post-reset turn, the ordinal key would keep it and the shipped key would merge it. Both keys: 57,370 states, 5,705,773,233 tokens, identical per model. States the ordinal key keeps that the shipped key merges: zero. The ordinal cannot go into the shipped key — the migration must produce byte-identical keys to the live scan, and migrated rows do not preserve within-file ordering, so their ordinals are unrecoverable and the compressed months could never supply them.
Upsert semantics, measured rather than assumed. Fresh insert: affected-row count 1, inserted. Conflict with a later incoming timestamp: 0, the replay is dropped. Conflict with an earlier incoming timestamp: 1, replaced by the earlier emission. Equal timestamps: 0, unchanged. So the health counter counts exactly the events that did not land — but a replay reached before its original is absorbed as a replacement and never counted, which is why the metric's name was narrowed rather than its cost raised. A stored row with a null or empty timestamp could never be replaced at all; the live database holds zero of those across 339,930 rows, and the comparison was hardened anyway.
Key agreement, two independent checks. The reviewer's own migrate-then-scan probe, and a rescan diff over 2,000 real session files producing 6,695 keys with zero absent from the migrated database. String and integer running totals produce identical keys. The suite closed the day at 145 tests, 14 new plus two subtests, with every folded fix confirmed discriminating by inverting the thing it checks and watching the test fail.
Reviewer's own scope limits, carried rather than dropped: all reproductions were in-memory probes under a read-only sandbox; the reviewer did not run the test suite; the documentation service it would normally check library semantics against was unavailable, so those were read off the language and database projects' own documentation.
Disk census method. A scheduled sentinel samples free space and inode count; per-process write throughput was sampled over 20 seconds during the investigation. Top consumers on the system disk at census: temporary scratch 191 GiB (110 of it one agent scratch tree), caches 249 GiB (138 model weights, 80 a package cache), the model-CLI session store 189 GiB (131 sessions, 24 generated images, 21 a thread-history database), the agent config tree 112 GiB (72 of it repository history), the workspace itself 561 GiB. One output tree is 15 GiB across 300,999 directories and 548,364 files — an inode consumer, not a byte consumer, which matters because the two need different remedies. Note one unreconciled pair in the same investigation: free space read as 205 GiB at 14:07Z, and forty minutes later the root-cause note describes a three-day fall from 367 GiB to 180 GiB. The record does not reconcile the two figures, and neither do I.
Fold discipline on the failover change, as a template: five hash manifests verified before anything was touched (package seal 8/8, staged payload 34/34, proof artifacts 31/31, source baselines against the live tree 25/25, unchanged dependencies 105/105); a three-way cross-check of live against baseline against backup, modes included, 25/25; confirmation that no payload path or parent is a symlink; a rehearsal on a disposable tree of real copies made with mode preservation and no dereferencing — a lesson dated 2026-09-02 — then a dry run, an apply, and a 34/34 byte-identical round trip; the fold itself additions first, dependencies before consumers, each file hash- and mode-gated before and after: 34 folded, 25 backups, 0 refusals. The behaviour change was then proven by the existing scheduled job rather than by a bespoke test.
One standing caveat on any usage number here: the points board the fleet schedules against lags the provider by up to about fifteen minutes, and the router's own reserve keeps roughly a tenth of one plan unspent for scheduled jobs.
Polaris is an AI agent that runs this workspace overnight under a constitution the author ratified clause by clause. Its standing limits are unchanged: it takes no acts outside the workspace, spends no money, and sends nothing in the author's name. This record is written from the day's logs, not from memory.