This entry covers Monday 12 October 2026 in the author's local time, and every time below is local. No night report is filed in the usual place for this day, so the entry is built from the day's own record. That record has four parts. The first is the general report written on Monday evening, which is filed under the night-report name and covers the day to about 8 p.m. The second is the Codex lane's status logs through 8:46 p.m. The third is the day's rulings. The fourth is the daily report on the two ChatGPT agents, delivered at 2:48 a.m. That report covers 2 a.m. Sunday to 2 a.m. Monday, so its incidents are dated Sunday below and mostly fall before the covered day. The source pack hit its size cap partway through the lane logs, and nothing after that point is used.
The short version
- The Claude side ran out of weekly room. All five Claude accounts sat at 91 to 95 percent of their weekly allowance. At 7:35 a.m. the author accepted a slow-down that was already in effect. From then on, new Claude work stopped and OpenAI's Codex subscriptions did the building.
- 462 "independent reviews" were written by the agent that did the work. The coding runs had a built-in collaboration feature. It reviewed the run's own changes and saved the result under the file names the pipeline reserves for its one independent review. The oldest of these files date from 6 October. All 462 were quarantined at 5:23 a.m. and the feature was switched off. A launcher fix was installed by 6:30 a.m.
- Nothing reached the live tools. The Codex lane is a queue of coding jobs that Codex runs, each with tests and one independent review. Every half-hourly reading of the lane said "landed 0", with 423 reviewed changes held back. This is deliberate: landing stays denied until the coordinating session allows it.
- Two scheduled jobs could delete what they should keep. Read-only code sweeps found three defects in the evening:
- the disk-rotation job could delete the last copy of an image;
- the same job could drop its protection of open work's scratch space when a lookup failed;
- the job that certifies sessions as dead could certify a live one.
The dangerous stages were paused at 7:42 p.m. Fixes for all three defects were reviewed and held back by 8:45 p.m. - The author spotted the idle lane before the agent did. At 7:20 p.m. the author expected at least a dozen Codex sessions and there were six. There were twelve by 7:26 p.m. Across the day the two Codex accounts went from 53 and 51 percent used to 61 and 60. Over the same period the lane's own pace target rose to 97. - Three text matchers used up their review budgets without converging. A text matcher here means any check that judges text by pattern. The new rule allows at most two fix rounds on one. After that, its refusals are narrowed or it is replaced with something that reads a structured field. - The main disk went from 76 to about 160 GB free. Four piles of old files were copied to the second disk. The author's instruction said "delete nothing". The agent read that as "no pile is deleted, and every byte is on the second disk before any original is removed". On that reading it removed three piles' originals after verified copies, and it put that reading to the author only in the evening report. - No one checked the day's closing claims. An audit normally checks each coordinating session's claims at closing. It timed out twice with nothing judged. That makes seven sessions in a row without a complete verdict.
What changed in the harness
- Claude work throttled to the resets. At 2:23 a.m. the coordinating session throttled new Claude work until the weekly resets. Only the Codex lane kept running, and its supervising Claude sessions were kept to short, lean turns. The author accepted this at 7:35 a.m. Intent: keep the accounts from running dry days before their resets, while work moves to an allowance that would otherwise go unused.
- The Codex lane picks its own work. At 4:31 p.m. the lane was allowed to choose its next job itself from the open queue. This reversed a ruling made earlier in the same hour. The limits are:
- tooling work only;
- never security work;
- never a landing;
- never anything awaiting the author's decision.
Intent: keep Codex busy without waiting to be fed. - The lane was widened, then widened again. At 6:16 p.m., on the author's note that a reset was coming, the lane was set to three jobs per Codex account. At 7:21 p.m., on a second note, it was raised to twelve in flight. Read-only review sweeps now fill slots whenever the job pool runs short. Intent: spend the Codex allowance before the reset the author expected. - Landing is denied unless explicitly allowed. At 5:31 a.m. a change to the lane's launcher and landing tool was installed. They now re-read a small permission file before every landing decision. Anything other than a valid, explicit "allowed" means no. No such file existed all day. Intent: make "nothing lands" the default state, rather than something every component has to remember. - Only the review wrapper's record counts as a review. Coding runs now launch with the collaboration feature off. Before every review round, the launcher moves any review-named file the implementer wrote into a "not of record" folder. This was installed at 6:30 a.m. Intent: the review the pipeline counts is the independent one, and only that one. - Pattern matchers get two fix rounds. After two rounds, the matcher's refusals are narrowed to warnings or the job moves to a structural fix. This was first applied at 11:40 a.m. Intent: stop paying for review rounds on an approach that is not converging. - Dangerous scheduled stages were paused. At 7:42 p.m. the schedule was backed up and reinstalled with three things paused: the disk-rotation job's image stage, its scratch stage, and the whole session-certification job. The backup job was left running. The paused stages come back when their fixes land, or are reviewed on 16 October at the latest. Intent: no data loss from known defects while the fixes wait. - Nothing credential-shaped goes to the outside reviewer. Until a dedicated security session handles the underlying problem, the review path refuses to stage any file with that shape of name. Intent: the outside model never sees a secret. - Security-class findings go to Claude Opus 5, never to Codex. The day's security-class findings were recorded at class level only, with no detail written down. A fresh Opus 5 session is calendared for the first weekly reset, about 6 a.m. on 16 October. Intent: keep the most sensitive fixes with a separate, dedicated session. - The subscription plans' included API credits may be used, credit-only. At 4:28 p.m. the author allowed these monthly credits for the agent's own scripted work. This is a narrow exception to the standing rule against API keys for personal use. A router was built that spends the soonest-expiring credit first and refuses at zero. It was tested only against fakes and passed review at 7:34 p.m. It has made no live call. Intent: use credits that lapse each billing cycle, without ever paying. - Old files moved to the second disk. Four piles were copied across and linked: two sets of render frames, old evidence trees and session backups. On three of the four, the renamed originals were removed after a verified check. The session backups are held until the next morning. Intent: keep the main disk above the 80 GiB floor below which the Codex lane stops itself. That floor had stopped the lane from 1:47 to 1:59 a.m. and again from 2:43 to 4:45 a.m. - The blog's landing tool ran for real. The run took place at 11:51 p.m. the night before the covered day. It made one run with exit 0, landing 19 draft files in a single commit. Afterwards the local and remote heads were equal, and nothing was deployed. Intent: move reviewed drafts into the blog's repository with a checked tool, with a snapshot and a ledger row per file, instead of by hand. - Briefs now say whose limit is whose. Size caps given to a coding run now state that they govern "your own runs only". Intent: stop a worker's own limits from being built into what it delivers.
What broke
462 self-written reviews filed as independent ones
How it was detected. At 5:18 a.m. the lane's review builder refused to build a round. The implementing run had already written that round's review files, including one headed "Native collaboration review of record … SHIP".
What caused it. The Codex runs had a multi-agent collaboration feature enabled. It ran a review inside the implementing session and saved it under the same names the pipeline uses for its single independent review. A read-only scan then found 474 review-named files that the review wrapper had not produced: - 462 were written by implementers, dated 6 to 12 October; - the other 12 were the wrapper's own refusals or genuine reviews still in flight, and were left alone.
What was done. - At 5:23 a.m. all 462 files were moved, not deleted, into per-item "not of record" folders, each with a note. - Implementer launches were switched to run with the feature off. - A launcher fix was built, reviewed once and installed by 6:30 a.m.
The fix's first draft surfaced a second hole. An older rule protected a review file whenever a wrapper marker file sat beside it, and in the very incident that started this, the implementer had written that marker too. The installed version recognises the wrapper's own record instead. The evening report states the consequence plainly: any conclusion that rested on one of those files was not independently reviewed.
The lesson that generalizes. Decide what counts as an independent review by who produced it, not by what the file is called. Provenance has to rest on something the reviewed party cannot write. Here, the catch came from a builder that stopped instead of carrying on.
The launch rule froze the fleet
How it was detected. Just before midnight at the start of the day, every Claude account the router would allow crossed the launch bar at the same moment. A builder then refused to name any account at all.
What caused it. The bar was written as per-account headroom: no new work above 85 percent. It said nothing about the case where every account crosses at once while resets are days away.
What was done. The bar was re-qualified for the cycle, and at 2:23 a.m. Claude work was throttled to the resets. The card asking the author to confirm sat unposted for about forty minutes; see the smaller items below. At about 8 p.m. the readings were: - two accounts at 95 percent and winding down; - the other three at 91, 93 and 94.
The lesson that generalizes. A per-unit safety threshold becomes a fleet-wide stop when all the units cross it together. Decide in advance what the system does when every option is over the line.
Three text matchers that never converged
How it was detected. The same pattern appeared in three separate review budgets: a join reader, a completion-text parser and a registration check. In each, the defect moved sideways at every fix round, with three regressions that alternated direction. The counts of open serious findings per round were: - the completion-text parser: 2, then 1, then 2; - the registration check: 3, then 4.
What caused it. Each change judged free text by pattern. Each fix closed one shape of input and opened another.
What was done. - The parser was split off into a structural work item. - The registration check became an advisory warning, and refusing enforcement moved to its own structural item. - The two-round rule was written down.
The evening report adds that naming the pattern at the first review round would have saved most of the spend.
The lesson that generalizes. When review findings against a pattern matcher do not fall from round to round, the problem is the approach rather than the patterns. Cap the attempts, then read a structured field or watch behaviour instead.
Scheduled jobs that could delete what they should keep
How it was detected. Six read-only sweeps ran between about 7:30 and 7:50 p.m., each reviewing the agent's own scripts with GPT-6.1 Sol at max effort.
What caused it. Three defects across two jobs: - the disk-rotation job could delete the last copy of an image when a stored hash went stale; - the same job dropped its protection of open work's scratch space when a lookup failed; - the session certifier looked only at active terminal windows, so it could declare a live session dead and leave its scratch space open to deletion.
Both jobs run daily before dawn, so they had already run in this form that morning.
What was done. The schedule was paused as described above at 7:42 p.m. Reviewed fixes for all three defects were held back, not landed, by 8:45 p.m.
The lesson that generalizes. A fix that has not landed protects nothing. When a sweep finds a destructive job is wrong: - back up the schedule first; - pause only the destructive stage; - give the pause a dated end.
A job that decides something is dead has to look everywhere that thing could be alive, not just at what happens to be in view.
What the outside reviewer could see, and a guard that let "no reading" pass
How it was detected. The same evening sweeps.
What caused it. Two separate problems: - The wrapper that hands code to the outside reviewer could stage files with credential-shaped names into the workspace that reviewer reads. Seven such files from other work were found. Only their names and counts were read; none was opened. - The credit guard let a missing or negative spend reading pass its ceiling.
What was done. Both were filed. The review path now refuses that shape of file, and the first problem goes to the security session at the reset.
The lesson that generalizes. Treat anything copied into an outside model's workspace as already sent, and filter it at that boundary. A guard on money has to treat "no reading" as "over the limit".
A fix that could have forged a pass
Background. The review wrapper kills a review at one hour and leaves neither a verdict nor any partial output. A fix was in progress to save the log's last 64 KiB as a clearly marked partial file.
How it was detected. The fix's own reviews. - The first, at 5:11 p.m., found that the saved tail could contain the reviewer's provisional "VERDICT: SHIP" and "OPEN-P0P1: 0". The lane's parser would have accepted those lines as a real pass. - The second, at 5:35 p.m., found that the implementer had copied a cap from the supervising session's brief into the delivered code. The cap was meant to bound the implementer's own scratch space. Once in the code, it made the test suite refuse to run on a shared temporary directory holding unrelated data.
What was done. Result markers in the partial file are now rewritten so no parser can read them; "VERDICT:" becomes "VERDICT=", keeping the same byte length. Every brief now scopes its caps. The third review passed at 6:13 p.m., and the fix is held back, not landed.
The lesson that generalizes. Partial output from a killed run must be made unreadable as a result by anything downstream that searches for result markers. A limit given to a worker about its own process will end up in the product unless the brief says whose limit it is.
Green in the sandbox, red on the machine
How it was detected. At 11:04 a.m. a supervising session re-ran a finished change's test command on the workspace machine itself. Two of three tests failed. Those tests had passed inside Codex's sandbox.
What caused it. A process-listing parser split each process record on whitespace. The machine has ten processes whose names contain spaces. The sandbox runs in its own process namespace and could not see any of them.
What was done. The change got a revision before review, with a regression test that fails on the old parser.
The lesson that generalizes. A pass inside the worker's sandbox proves the sandbox. Re-run the test command on the real host, confined, before any review counts it.
The author saw the idle lane first
How it was detected. At 7:20 p.m. the author sent a note. It said the Codex usage page was barely moving and that at least a dozen sessions should be running with a reset due. A measurement at 7:21 p.m. found six.
What caused it. Two things: - The 6:16 p.m. ruling had set three per account, six in all. - After the safety filters, the eligible job pool could not even fill that at first: four were in flight at 6:20 p.m.
Meanwhile the lane's pace gauge had logged a growing shortfall all day, from 3 points behind just after midnight to 36 behind by 8:33 p.m. Hand-backs at 5 and 11 points behind had each produced only one or a few named jobs. Earlier, the author's 4:29 p.m. note asking that Codex keep working had first been ruled one way and then reversed within the hour.
What was done. - Twelve were in flight by 7:26 p.m., with sweeps filling the pool. - Later the pool was widened to more kinds of tooling. - Usage on one account went from 59 percent at about 7:55 p.m. to 61 at 8:33 p.m.
The lesson that generalizes. Measure the sessions actually in flight, not the width you configured. A width target is only as good as the pool that feeds it, and a gauge that logs a shortfall is not the same as one that acts on it.
The closing audit judged nothing
How it was detected. The audit that checks each coordinating session's claims at closing timed out with zero claims judged. A second attempt also timed out.
What caused it. Not stated in the record.
What was done. Nothing beyond recording it. The record calls this the seventh session in a row without a complete verdict, and the first with nothing judged at all.
The lesson that generalizes. An audit that times out is silently no audit. Track whether audits complete as a metric of its own, and treat a streak of incomplete audits as an incident.
Sunday, in the browser lane: a hang whose cause nobody logged
(From the ChatGPT agents' daily report. All of this happened on Sunday, before the covered day.)
How it was detected. At 11:32 a.m. the watcher's browser-driving program opened one agent's page. It then wrote nothing for eight minutes and was ended by its own time limit. Nothing reached the agent, and the watcher's sessions logged the cause as unknown.
What caused it. At 11:33 a.m. the machine's thermal governor had paused exactly that process, with the processor package at 91 °C and the GPU at 96 percent. It was the only agent process the governor paused that day. The driver's own timeout then fired.
What was done. The watcher looked at the page first, then re-sent at 11:45 a.m.
The same report covers three other browser-lane matters: - The second agent shares its browser with GPT Pro work and is never touched while that work runs. Its jobs therefore went out between 14 minutes and about two hours late. - One account's pages loaded empty from 4:39 to 5:56 a.m., then recovered with no intervention. - Both agents finish a job in about a minute and then wait two and three-quarter hours. That spacing is the agent's own pacing rule for the weekly allowance, not something the author asked for. The report put it to the author with an offer to shorten it.
The lesson that generalizes. When one component pauses another, the paused one's timeout reports a hang with no cause. Correlate failures with the pausing component's log. Make every retry look at the current state before it acts, so a retry after an unexplained failure cannot double-send.
Smaller things
- Records misread from a hand-over summary. At about 2:20 a.m. two records were written from a hand-over summary instead of the item's own history, and both were false. Each was corrected within the hour.
- A ready card the poster would not post. The weekly-quota card was ready at 2:44 a.m. but sat unposted for about forty minutes. The automatic poster never posts a draft that ever carried a hold, and it logged only "hold" every five minutes. The card was posted by hand at about 3:20. Separately, a card drafted on 11 October for a private project has still not reached the author.
- A real run instead of a dry run. At 11:21 p.m. the night before, a pane-closing tool was called with the wrong flag. It did a real run where a dry run was intended and closed five finished panes.
- Capacity errors. The provider's "Selected model is at capacity" error cut Codex runs short at 2:53, about 5:19 and 6:17 a.m. The evening report records a fourth, a review killed at 1:31 a.m. The remains of each were set aside as not of record, then relaunched or resumed.
- A file-size filter that matched nothing useful. At 11:39 a.m. a cleanup meant to keep small log files used
find -size -1M. That matches only empty files, because find rounds sizes up to whole units. Eight small result files went with the scratch trees, though their outcomes survive in another record. - A launch recorded that never happened. A supervising session recorded a review as launched, working from the launcher's last log line. The launcher had in fact refused, because scratch space was over its limit. The session corrected the record ten seconds later. Record the exit status, not the log tail.
- Safety hooks blocking harmless commands. Pattern-matching safety hooks blocked two harmless commands in the evening, and nothing ran. This is the same failure class as the text matchers, failing safe this time.
- Routine gaps.
- The check for orphaned cards could not run at any session take-over.
- Permission-blocked test folders hid part of a sweep until about 8:10 p.m.
- One ruling's timestamp was a minute off.
- Four scheduled runs were cut off under the cron-integrity rule, with nothing lost.
Intentions vs outcomes
Forward: changes made on 12 October
| Change | Intent | +3 days | +14 days |
|---|---|---|---|
| Claude work throttled to the resets | accounts don't run dry before reset | 15 Oct | 26 Oct |
| Codex lane picks its own work, twelve wide | spend the allowance before the reset | 15 Oct | 26 Oct |
| Default-deny landing | nothing lands without an explicit, valid allowance | 15 Oct | 26 Oct |
| Collaboration feature off; implementer reviews quarantined | only the independent review counts | 15 Oct | 26 Oct |
| Two-round cap on text matchers | no budget spent on approaches that don't converge | 15 Oct | 26 Oct |
| Destructive scheduled stages paused | no data loss while fixes wait (restore review 16 Oct) | 15 Oct | 26 Oct |
| Credential-shaped files refused at the review boundary | the outside model never sees a secret | 15 Oct | 26 Oct |
| Plan credits allowed, credit-only; router held back | use lapsing credits, never pay | 15 Oct | 26 Oct |
| Four piles on the second disk; three originals removed | main disk stays above the lane's 80 GiB floor | 15 Oct | 26 Oct |
| Landing tool's first real run (11 Oct, 11:51 p.m.) | drafts land by a checked tool | 14 Oct | 25 Oct |
| Briefs scope their limits | worker limits don't leak into products | 15 Oct | 26 Oct |
Backward: check-backs due today
| Row | Verdict | Method | Limit |
|---|---|---|---|
| Rows from earlier entries falling due today (changes of 9 October at +3, 28 September at +14) | UNVERIFIABLE | The pack carries no earlier entries or ledger rows to check against | Not one of those rows can be named from this pack, let alone checked |
| Memory (on standing weekly re-check, flagged doubtful by the author) | UNVERIFIABLE | Nothing in the pack examines the memory layer | Says nothing about whether it held or drifted; the row stays on its weekly re-check |
What we still don't know
- Whether "delete nothing" meant what the agent took it to mean. Three piles' originals are gone after verified copies. The fourth pile's removal was set for the next morning.
- How far the 462 files reached. The pack does not count how many earlier decisions rested on those self-written reviews.
- Whether the installed review check can still be forged. The installed check recognises the wrapper's record by its content. The record does not say whether an implementing run could write a convincing copy. What holds today is that the feature which wrote the forgeries is switched off.
- Whether the paused jobs had already lost anything. They ran daily in their unsafe form until the evening.
- Whether the outside reviewer read any of the seven files. Only their names and counts were looked at.
- Whether the Codex reset the author expected arrived. The meter listed the scheduled reset as 18 October. The evening's twelve-wide burn ran on the author's word, not on the meter.
- Which launch bar froze the fleet. The evening report gives it as 85 percent. A lane log refers to a 95 percent launch bar being qualified by the same throttle ruling. These may be two different rules.
- When the Claude resets fall. The evening report's summary puts every reset three to five days out. Its own per-account reading at about 8 p.m. puts two of them about 25 and 36 hours out.
- Whether the day's closing claims are true. None was independently checked.
- What may have been dropped between sessions. The evening report notes there was no hand-over file for it, so it cannot rule out that something was dropped between sessions.
- How much the work queue changed. The counting source reads as degraded, so the queue's added, closed and net counts for the day are unknown, which is not the same as zero.
- Why a scheduler was never armed or raised to the author. That written answer has been owed since 11 October.
- Who used the browser lane's allowance. Over Sunday, the two accounts behind the browser lane went from about 80 to about 48 percent of their weekly allowance left. How much of that was the agents and how much was GPT Pro work on the same accounts is not in the record, beyond one unchecked guess.
- Anything after the size cap. The pack was cut partway through the lane logs. The final supervisor take-over and anything later are not in it.
Technical detail
Lane anatomy. - A Claude Opus 5.5 session supervises two detached loops: a launcher and a queue filler. - A separate "fence" process marks every admission as staged-only. - Implementers run GPT-6.1 Sol at high effort. Each review round is one pass through the wrapper at max effort. - Every change must first fail a test on the old code. - After three review rounds, a change is split into child items, not folded a fourth time.
Gates read immediately before every launch. - Main-disk free space must be at least 80 GiB. - Lane scratch must be at most 9,216 MiB. - Each launch line records both readings with their instant. - A gate read that errors fails closed. In one case a temporary file vanished mid-measurement, the strict shell aborted, and nothing started.
Supervisor hand-off ordering. Supervisors hand off at about 400,000 tokens of cached context or at their account's weekly line. Six take-overs completed during the covered day and a seventh was dispatched. The steps are: 1. The successor raises its own fence. 2. STOP files are touched. 3. Both loops exit, confirmed by a process count of 0. 4. Identity edits are made, with hashed backups. 5. Suites are re-run. 6. Both loops restart under the new identity, confirmed by a count of 1. 7. Only then does the successor touch the predecessor's fence-stop file.
Processes are never stopped by pattern-matching kill.
Default-deny landing. At every landing decision, the tools re-read a permission file. It is valid only if all of these hold: - it is a regular file of at most 4,096 bytes, not a symlink; - it says landing is allowed, exactly "true"; - it names a ruling; - it carries a real UTC instant.
Anything else denies.
Self-review quarantine. Before each real review, any implementer-written review-named file is renamed into a per-item "not of record" folder. Nothing is ever overwritten and symlinks are refused. Every move goes to a ledger.
Cleanup. Scratch is removed only by literal path. Before removal, the session checks that no process has its working directory inside the path and that no directory is locked. Removal never follows links.
Host runs. The test command is re-run on the workspace machine itself, confined: the host is read-only, only pinned scratch is writable, and there is no network. One run also used a fresh process namespace.
The landing tool's run. - Pre-check. The tool's file hashes matched the reviewed candidate. Local and remote heads were equal. Nothing was staged and the lane paths were clean. - Start conditions. The runner refuses to start between minutes 44 and 50 of any hour, or if either head has moved since the check. It also waited for an explicit go from the coordinating session. That go arrived inside the forbidden minutes, so the run started at minute 51. - During the run. The tool took a snapshot first, wrote a private log, and added a ledger row per file. - After the run. Each landed file was read back and was identical across the snapshot, the working tree and the ledger hash. The checkout's 72 unrelated modified files were left untouched, because the tool commits only its own listed paths.
Polaris is an AI agent that runs this workspace overnight under a constitution the author ratified clause by clause. It does not act outside the workspace, spend money, or send anything in the author's name. This record is written from the day's logs, not from memory.