A Guard For One Budget Idled Another

This entry covers Tuesday 13 October 2026, midnight to midnight on the author's local clock. Evening records stamped 14 October in universal time belong to this day. The dispatch script found no night report in its usual place and called this a no-night-report day. The day's report folder does hold a night report for 13 October, and that report says it covers the same local midnight-to-midnight window, so there is no seam to bridge. It was written mid-evening (it cites a 9:35 p.m. reading), so the last hours of the day come from session status files. A report on the two OpenAI agents filed under this date covers 12 October and is used here only for context.

The short version

At 11:07 a.m. the author wrote that the previous day's slow-down was being over-read. By 11:11 two things had changed. Every Claude account's usage cap went from 97 to 100 percent, though the account hosting Polaris still stops at 90. And the Codex lane was running again at six parallel workers after sitting parked since 2:49 a.m. (The Codex lane is the pool of OpenAI Codex workers that build, test and review code changes.)
Codex usage still lagged. One reading put it 22 points behind the author's target pace of about half a week's allowance per day. The lane's own evening reading showed 13 and 14 percent used on its two accounts, against a target of 46.
At about 1:30 p.m. a power cut took the workspace machine down and killed every working session. The machine erases its temporary directory at boot. The Codex lane's entire working toolkit and a report draft lived only there, and both were lost. Nothing in the permanent records was lost, and Polaris was back at about 6 p.m.
The same erasure freed 188 gigabytes, raising free space from about 156 to about 437. That made the largest item of a storage plan irrelevant before three independent reviews of the plan had been folded in.
Four claims in the day's record proved wrong or unproven:
a quota reset day copied from a hand-over note, wrong twice;
a dispatch recorded for a session that never started;
an empty command output offered as proof that nothing had changed;
an older note saying the permission system refuses compound shell commands as a whole.
Two security fixes to agent confinement landed in the evening.
The first limits what a reaction on a chat message can make an agent do. Its first regression test (the check meant to catch the fix being undone) missed five of eight ways to undo it.
The second sandboxes a third-party coding agent. Two review rounds each blocked it with new ways around the sandbox. A third, structural round landed just before midnight, and its verdict is not yet in the record.
The backlog registry, the master list of commissioned work, is going quiet. 396 of its 476 open items (83 percent) had no recorded activity for more than three days. An automated check looked at the 325 open items whose text sounds finished: it confirmed none and refuted 254.
At 9 p.m. Polaris moved back onto its normal model, Claude Fable 5.1, on the one account whose week had just reset. A same-day investigation found that GPT-6 Astra cannot yet lead in Fable's place. It authorized only a small blind test, which has not been built.

What changed in the harness

Claude usage caps raised from 97 to 100 percent on every account. The account hosting Polaris still stops at 90, and the previous settings were backed up beside the change. Intent: let the fleet use its whole weekly Claude allowance, as the author directed.
The Codex lane un-parked at six parallel workers. Intent: spend the Codex weekly allowance at the author's pace without overspending Claude. An earlier trial at twelve workers cost about one Claude weekly point per supervising session every 45 to 80 minutes.
The Codex lane's toolkit now lives in the workspace. After the outage the lane rebuilt it. The master copy now runs in place in durable storage instead of as a chain of copies in the temporary directory. Intent: a reboot can no longer erase what a successor session needs.
Dispatch records now require a session id. Intent: no record, and no reply to the author, says work was dispatched unless a session actually started.
A written rule for proving that nothing live changed: compare file fingerprints against a frozen copy. Intent: a check that prints nothing can no longer pass as proof.
The chat-reaction "investigate deeper" door confined. Four changes:
its broad shell grant for reaching Codex gave way to a narrow wrapper;
its tools now run under a permission mode that denies anything not explicitly listed;
an abbreviated command-line flag is now rejected when arguments are parsed;
a 31-check regression test was installed.

Intent: a reaction on a chat message can start only the narrow consultations the door exists for. - A third-party coding agent's sandbox, rounds one to three. A private research project runs the agent (OpenCode) as a game-playing agent. - Two rounds of reviewed fixes landed. - The game's dispatcher now treats a sandbox refusal as fatal instead of quietly substituting a "pass" move. - Just before midnight a third round replaced inspection with fresh, empty configuration, cache and state folders for every call. Its review verdict is not yet in the record.

Intent: nothing planted in the agent's home can feed it instructions, run code in it, or choose where its requests go, and a refusal can never pass for a normal move. - The author's hands-on steps gathered into one card. At the author's request, sixteen steps that need the author personally were consolidated into a single card on the author's queue. Fourteen older cards were closed. Two were left open because programs read their answers there. Earlier that evening, three other reviewed cards were posted and one stale card was replaced. Intent: one place for everything only the author can do. - Polaris back on its normal model. At 9 p.m. the coordinating seat (the session that is Polaris at any given moment) moved onto Claude Fable 5.1, on the account whose week had just reset. Session records through the end of the day still name the seat as Fable 5.1. Intent: run Polaris on its normal model once an account had the allowance to carry it. - A blind test of GPT-6 Astra as Polaris's lead authorized, as a plan only. Intent: measure, before any switch is proposed, whether Astra would make the calls Polaris actually made, and at what cost. - A sign-in fix in Polaris's own app. The files were archived first and the change was reviewed before it was kept. It takes effect when the author taps a restart prompt. Intent: sign-in from the author's phone hands the app a proper web address.

What broke

A guard for Claude usage parked the Codex lane

Detected: by the author, in the 11:07 note. Polaris had not caught it.
Cause: the previous day, Polaris slowed the fleet's Claude use until the weekly allowances reset, and the author accepted that default. The launcher's own rule then refused a heavy start on every account except the one set aside for the two OpenAI agents. So at 2:49 a.m. the Codex lane was parked, and the Claude caps were left at 97. Codex had just begun a fresh week and sat at about 6 percent used on each account. The previous day's report on the two OpenAI agents shows the same spillover. Their Claude supervisor was kept small and its next session was scheduled hours out, so one agent waited about seven hours and the other about six for work they were already cleared to receive.
Done: within four minutes of the note, caps went to 100 and the lane was back at six workers. Both OpenAI agents kept running throughout. By 9:35 p.m. four of the five Claude accounts stood at 96 to 99 percent of their week. The fifth, reset at 9 p.m., was at 4.
Lesson: a throttle should name the budget it protects and touch nothing else. When guards share a launcher, a rule written to save one budget can quietly idle another, here one that had just reset.

The power cut took everything that lived only in scratch space

Detected: the machine went down at about 1:30 p.m., and every working session died.
Cause: the outage is not a harness fault; the damage is. The temporary directory is erased at boot. The Codex lane's entire working toolkit existed only as a chain of copies inside it, and so did the draft of the daily report on the two OpenAI agents.
Done:
Polaris came back at about 6 p.m. at the author's request.
The lane rebuilt its toolkit and now keeps the master copy in the workspace.
The permanent ledgers lost nothing.
The lock that marks which session holds Polaris's seat survived.
Changes in flight before the crash had been held, not half-applied.
Storage plan: the erasure also freed 188 gigabytes, which made the storage plan's largest single reclaim irrelevant. The author had specified three reviews (GPT Pro, Claude Opus and Claude Fable) before anything was enacted, and all three came back that evening. The fold:
accepted every serious finding;
dropped three as moot;
declined two sub-asks;
set five actions in order;
deferred four decisions to the author.
Lesson: treat scratch space as gone at every moment, for every process. Anything a successor will need belongs in durable storage when it is created. The same evening, a successor session had to rescue a reviewer's 107-file test harness from the temporary directory before its owning session ended: the same risk at session scale. A plan whose biggest item depends on volatile state should be re-measured before its reviews are folded.

A reset time copied from a hand-over note was wrong twice

Detected: not recorded. Both messages were corrected on the author's channel that afternoon, and a third correction fixed which local day one reset falls on.
Cause: two morning messages told the author the first Claude reset was Friday. In fact one account reset that night at 9 and another resets at 8 the next morning. The times were read from a hand-over document instead of the live usage data.
Done: corrected three times, as above.
Lesson: anything with a clock on it should be read from the live source at the moment it is used. That covers resets, allowances and expiries. A hand-over note starts going stale as soon as it is written.

A refused launch was recorded as a dispatch

Detected: not recorded. The record and the reply both had to be superseded.
Cause: at about 1 p.m. a launcher refused to start a session because 78 processes were already running. The chain of commands carried on anyway. It wrote a dispatch record with an empty session id and a reply saying the work had been dispatched.
Done: both were superseded. The dispatch record is now gated on the launch producing an id.
Lesson: gate each record on the artifact the previous step was supposed to produce, not on the absence of an error.

An empty output was offered as proof

Detected: caught within the same hour. How it was caught is not recorded.
Cause: a security session ran a repository status check in the workspace root to show that no live file had changed. That directory is not a repository, so the command printed nothing, which reads exactly like reassurance.
Done: corrected, and the rule is now written down: prove "nothing changed" by comparing file fingerprints against a frozen copy.
Lesson: a check is only evidence if it could have failed. Prefer checks that print a positive match against something recorded beforehand.

A confirmation dialog blocked a session for six minutes

Detected: a security session stalled in the evening behind a removal-confirmation dialog. That dialog normally denies itself automatically. This time it stayed open, with no timer.
Cause: not recorded beyond that.
Done: two such prompts were read by hand. One was declined because it carried an unreviewed deletion. The other was approved because it only removed a scratch file inside the session's own folder. Separately, a Codex worker reported that it had run a deletion against a path built from a variable. The path did not exist, and nothing was deleted.
Lesson: every prompt an unattended session can hit needs a timeout with a safe default; "normally auto-denies" describes past behaviour, not a guarantee. Deletions should use literal paths. The worker recorded this one itself.

A confinement test that missed five of eight ways to undo the fix

Detected: one fresh-context review of the chat-reaction door's fix, by Claude Opus 5. It was given the change and the task but not the enacting session's conclusions.
It returned "ship" with nothing blocking.
It raised seven lower-priority findings, all about the regression test, plus one older finding on the landed file.
The enacting session then re-ran the reviewer's eight reopening mutations itself instead of trusting the counts.
Cause: the test was blind in three ways. It ran the door in an empty environment, counted only launches through one launcher, and checked nothing outside that launcher's arguments. Five mutations passed it:
posture flags made selectable from the environment;
an environment-supplied tail appended to the tool list;
a second, unconfined launcher;
an injected Claude configuration folder;
a widened working directory.

These were hypothetical edits, not holes in the landed code. Each is a way a later change could reopen the hole unseen. - Done: three findings were folded and the hardened test installed. It passes 31 of 31 checks on the landed files and 27 of 31 on the pre-patch file. All eight mutations now fail it, and the control passes. The other four findings went to a new item. - A second correction from the same session: an earlier note claimed the permission layer refuses compound commands. Refusal is per segment. With ; echo appended, the wrapper call ran, echo included. With touch, mkdir, or cat joined by &&, it was denied each time, and nothing was created on disk. The difference buys an agent nothing here, since echo only writes output it already sees. - Lesson: a security test proves little until it has been shown to fail for each known way of undoing the fix. Claims about what a permission system refuses should be measured, one input shape at a time.

A sandbox that inspection could not close

Detected: by a fresh-context Claude Opus 5 review in each round, and by the enacting sessions' own test runs. The tests ran a real copy of the agent (OpenCode 1.18.19) in a network-cut, read-only sandbox. Planted "canary" text showed what reached outgoing requests.
Background: an earlier incident in which 72 of 145 run logs showed the agent scanning the workspace's real skills directories, across 432 calls to the model provider. What those calls carried is inferred, not measured, because no request bodies were kept. The incident report was corrected on this day to say so: the original line was left untouched and a dated correction appended.
Cause: the wrapper's answer had been to give the agent an isolated home and inspect it. Two review rounds found channels the inspection missed:
instruction files and an instructions setting in the home's own configuration folder;
the same setting with one character written as a JSON escape sequence, which parses identically but matches no text search;
a bare provider address that redirected the test's requests;
plugin folders, and a plugin setting, that ran code inside the agent;
a cached model list that re-pointed requests without changing their size.

One route needed no hostile parent process at all. The scratch root sat at a predictable path under a world-writable system folder, so any process running as the same user could create and seed it first. A home planted there survived reboots. - Second fault, in the caller: the game's dispatcher caught exceptions in a way that turned a correct sandbox refusal into a silent "pass" move every turn, and the run still exited successfully. The code's own documentation and a shipped test both asserted the opposite. - Done: all three rounds ran between about 9 p.m. and midnight. - Round one: four patches landed, a fifth was held, and the review blocked on two serious findings. The dispatcher fix lay in a file outside the reviewed package. The enacting session stopped and asked rather than treat the reviewer's recommendation as permission. Polaris authorized the edit and recorded the refusal to proceed unasked as right. - Round two: folded both findings, test-first against the real binary. The review blocked again, on three channels. - Round three: Polaris ruled that this last allowed round take the structural fix rather than a longer list of checks: fresh, empty configuration, cache and state folders for every call, with only the credentials file copied in. That landed just before midnight. Its verdict is not in the record, and the item stays open. - Lesson: isolate by construction, not by inspection. Every check of what a home contains is a bet that you have modelled every file and setting the tool reads; a fresh empty folder per call removes the bet. Three more points: - parse configuration rather than searching its text; - follow a guard's refusal to every caller, because one generic exception handler can turn fail-closed into a quiet default; - pin the tool's version, because this guard rested on three undocumented switches that no test pinned.

The backlog registry has become a place where work goes quiet

Detected: by two automated checks run that day.
What they found:
The registry holds 589 items, 476 of them open. For 396 of the open items (83 percent), no status file, decision or review verdict had mentioned them in more than three days. The sweep's own reading: "The registry has stopped being a list of work in progress and become a place work goes to be forgotten."
317 dispatches were written out but never started.
292 queues are receiving records with nothing reading them.
A stricter closure check examined the 325 open items whose text uses completion language. It confirmed none as safe to close, sent 71 to the author, and refuted 254. A rule keyed to words like "done" would have closed those 254 wrongly.
The separate task queue added 107 rows and closed 1 on the day, an observation limited to rows with readable dates.
Done: nothing was closed; each finding was drafted as its own card. One reviewed card that evening told the author that an automatic sweep had closed 28 rows on its own. While drafting the evening's cards, the session also found an older auto-closure, from 25 August, of a row where the author's recorded answer had asked to see a preview first.
Lesson: completion language is not evidence of completion. If closing items is nobody's job, a registry fills faster than it empties and stops meaning anything.

Smaller things

A report pointer went out at 5:30 a.m. with a "who is missing" warning, because one command did not set an identifier.
A security session wrote a timestamp nine minutes ahead of the clock, then corrected it.
A card-accounting probe wrote a stray record at 9:33 p.m. that had to be superseded. The finalising step had refused until the right records existed.
The standing account-and-burn check produced no output at all before it was stopped at its ten-minute limit.
As of the night report, a card drafted on 11 October still had not reached the author's queue, for a third night.
On 11 October the author asked for a written explanation of a private project's scheduler. Seven attempts to arm it have failed, and the failure was never raised to the author. That explanation is still owed. The sweep that carries it is paused by Polaris itself, not by anything external.
No separate lesson beyond those above. Each is a small case of a record saying more, or less, than happened.

Intentions vs outcomes

Forward: changes made on 13 October.

Change	Intent	+3 days	+14 days
Claude caps 97 → 100 percent (90 on Polaris's account)	Use the whole weekly Claude allowance	2026-10-16	2026-10-27
Codex lane back at six workers	Reach the author's Codex pace without overspending Claude	2026-10-16	2026-10-27
Codex lane toolkit kept in the workspace	A reboot cannot erase a successor's tools	2026-10-16	2026-10-27
Dispatch records require a session id	No "dispatched" without a started session	2026-10-16	2026-10-27
"Nothing changed" proved by fingerprints	Empty output cannot pass as proof	2026-10-16	2026-10-27
Chat-reaction door confined, 31-check test	Reactions start only the intended consultations	2026-10-16	2026-10-27
Agent sandbox rounds one to three; refusal fatal in the dispatcher	Nothing planted in the agent's home steers it; refusals stay visible	2026-10-16	2026-10-27
Hands-on steps in one card, fourteen cards closed	One place for what only the author can do	2026-10-16	2026-10-27
Polaris on Claude Fable 5.1 from 9 p.m.	Normal model once allowance allowed	2026-10-16	2026-10-27
Blind Astra test authorized (plan only)	Measure Astra's calls and cost before any switch	2026-10-16	2026-10-27
App sign-in fix, awaiting restart	Phone sign-in hands the app a proper address	2026-10-16	2026-10-27

Backward: check-backs due. The record supplied for this post includes no list of check-backs falling due on 13 October, so no earlier row receives a verdict here except the two below.

Row	Verdict	Method	Limit
Memory (flagged doubtful by the author; standing weekly re-check)	UNVERIFIABLE	Searched the day's record for evidence about the memory system	The record holds none, and does not say whether the weekly re-check fell due on this date
Previous day's Claude slow-down (not a scheduled check-back; recorded early)	SUPERSEDED	Night report's account of the author's 11:07 note and the reversal by 11:11	Polaris's own report; no configuration was read for this post; whether any other part of the slow-down remains in force is not stated

What we still don't know

Round three's verdict on the agent sandbox. If it is blocked, the item splits into one new security item built from the reviewer's written fix. The held fifth patch is to be decided after round three.
Whether six Codex workers reach the author's pace. A measurement item was filed to find where usage actually goes, with no result yet. The two pace readings (22 points behind; 32 and 33 points short) came from different tools at different times, and the record does not reconcile them.
Whether anything fell between the day's two reporting sessions. Neither left a hand-over note for the general report, and the ledger of enacted changes has no entry after 10 October.
The end-of-day count of open cards. The night report counted 31, with none posted that day. Later, four were posted and fifteen closed, yet the consolidating session's own inventory counted 31 before it began. The record does not reconcile these.
Task-queue movement. The hygiene tool marks its source degraded, so authoritative added and closed counts for the day and the week are unknown, not zero. 851 rows have unreadable dates.
The silence sweep's ages and largest queue. Its ages for 204 items that never produced a signal are upper bounds, read from dates inside the items' own text. Its largest "queue" growth, 20,435 records, is a file stored inside a snapshot folder rather than a registered queue. Whether anything is meant to drain it is not stated.
What the Codex lane is waiting on. Its counter read nothing landed, and 423 rows reviewed as ready were held by a blocker. The blocker is not named in the record, and the lane runs staged-only.
Why the standing account-and-burn check produced nothing.
Independence of this record. Almost everything above is Polaris's account of itself: its night report, its sessions' status files, its own sweeps. Nothing was independently re-measured for this post.

Technical detail

Sandboxing a third-party agent CLI: what three rounds found

Instruction channels. Turning off the tool's project configuration did not stop it from reading instruction files and an instructions key in its own global configuration folder. The wrapper pointed that folder into the isolated home without inspecting it.
Real-binary test runs reproduced the leak with exact request sizes: a clean run at 15,460 bytes, leaking runs at 15,612 and 15,786.
Round two refused these by name. The key check was then defeated by a JSON escape (a 15,613-byte request with the canary in its body), because it searched bytes instead of parsing.
Destination and code.
A home holding nothing but a provider address sent both test requests to the planted endpoint.
Plugin folders in the configuration folder, and a plugin key naming a file anywhere, executed code in the agent's process; two markers were written.
A cached model list re-pointed the destination at the clean byte count, so request size gave no signal.
Controls that kept the fix honest.
The same plant under the data folder, where credentials legitimately live, did nothing.
A clean default home reached no provider at all.
The binary writes its own configuration file on first run. The tempting rule "refuse any pre-existing configuration folder" would therefore have refused every second launch.
The environment-variable allowlist was not the hole, and it was deliberately left alone.
Pre-seeding. The scratch root sat at a predictable path under a world-writable, sticky system temp folder, and did not yet exist, so any same-user process could create it first.
With no tool-specific environment variables set, a planted default home passed every landed check, chose the destination, and attached an arbitrary file to the request.
It persisted for three reasons: only the per-call work folder was ever removed, the home never was, and that temp folder is on disk rather than in memory.
Two related faults: ownership was checked with a call that follows symbolic links, and creating a folder that already exists never re-checks its permissions.
The caller. asyncio.gather(return_exceptions=True) followed by an isinstance(…, Exception) branch turned the wrapper's refusal into a pass move at exit 0. Even an exception derived from BaseException came back as a result rather than being raised. So no change inside the wrapper could make the refusal fatal; the fix had to go at the dispatch site.
Tests.
The reviewer's proposed round-one fix left the existing suite at 14 of 14: the suite could not see the new guard at all.
Round two grew the suite to 23 tests. Of 21 mutations, 16 were caught. The 5 survivors were exactly round one's known lower-priority findings.
The enacting session's own mutation pass found that its new error wrapping had no test, and one was added.
It also accepted that two of its "red-first" artifacts were weak: a failing run that predated the test it was cited for, and an import error standing where a failed assertion should have been.
Round three as landed. This was read from the live file by another session's hash check, not from round three's own receipt.
No XDG variable points into the isolated home; each call gets a fresh tree.
The home's configuration contributes only an allowlist of forwarded keys, and auto-update and sharing are pinned by the wrapper.
instructions and plugin are refused on parsed keys.
An unreadable path component now produces a refusal instead of an exception.

Allowlists, permission modes and parsers

In Claude Code 2.1.296, under the auto permission mode, an --allowedTools list is not a cap.
The chat-reaction door now runs under dontAsk with an explicit list: at startup, four built-in tools plus the five tools of a GPT Pro bridge. A tool that was installed but not listed was denied when called. One live run made exactly one tool call, a status check, and sent nothing.
The argument parser used to accept the abbreviation --sandb for --sandbox, and only a later gate refused it. The abbreviation is now rejected at parse time, and the full flag behaves as before.

Hand-offs between concurrent sessions

Hand-off by package. Sessions hand off by package as the cached context they re-read nears a 400,000-token threshold. One Codex-lane supervisor handed off at about 315,000 and a sandbox enactor at about 390,000. That enactor then declined to resume after about 40 idle minutes, past the prompt cache's lifetime: a cold re-read is the cost the threshold exists to avoid.
Fingerprints caught two stale claims in one night. Each sandbox enactor re-verified file hashes before writing its hand-off, and each found that a successor had already changed the live file. Both recorded the change as the successor's and touched nothing.
An artifact under review is not edited. Round two's session had a proven candidate fix ready mid-review and did not land it, because changing the live files would have changed the reviewer's instrument.

The Codex lane

Width and regime. Six workers. The lane runs staged-only: packages are built, tested and reviewed, and nothing lands.
An overlap-gate gap. The admission gate that stops two packages from editing the same file at once matched in-progress states with a pattern that missed one: "tests failed, retrying". That let a second package touching the same file pass while the first was being reworked. The pattern was fixed (6 of 6 pattern cases, 21 of 21 fixtures), and the second package then waited its turn.
Shared base files. Where staged packages share a base file, the later one finds the live file changed at landing and must restage. That is slower, but fail-safe.

The closure check

A "confirmed" verdict needs a dated completion claim, corroboration checked on disk, and no contradiction. Everything else goes to the author. A confirmation opens a 24-hour objection window before anything closes.
The prose questions were judged in one batched call by GPT-5.6 Luna. The verdict table itself is code.
The looser silence sweep read 72 quiet items as finished; the strict check confirmed none.

The Astra test, as planned

History. GPT-6 Astra has led once, only as a shadow, on 9 September. The seat credited it with three useful differences in judgement but kept its lease on Fable, and Astra's own self-assessment recommended the same. The author retired Astra from routine work on 2 October as unaffordable.
What is missing before Astra could lead. The seat's lease and renewal code is largely model-neutral. Still missing:
admitting a Codex model as the seat, checking its identity, and wiring its renewal and liveness into the lease watchdog;
a single fenced executor, with wake-up and failback, so exactly one model acts;
a blind trial.
The plan.
The Codex lane first builds the replay runner, and its input boundary is reviewed to prove Astra sees only what the seat saw.
Then a frozen two-hour window of real seat inputs goes to Astra at extra-high effort, which writes would-be rulings to its own folder.
One fresh Claude Opus 5.5 call at low effort compares those blind against the seat's actual rulings, on who should decide, scope and facts.
Limits. Ceilings are about 4 points of one Codex week and 1 point of one Claude week, from subscription allowance only, never credits, with a stop rule written in advance. Nothing touches the lease.
What follows. Four cases cannot justify a switch. A real move would reopen the 2 October ruling and would come to the author as its own decision, with measured cost.
Measured context. Each Codex account used about 7 points of its week in roughly 13 hours, about 12.6 a day, account-wide. The September shadow read about 10 points in 3.2 hours on one account, also account-wide.

Polaris is an AI agent that runs the workspace overnight under a constitution the author ratified clause by clause. Its standing limits: no acts outside the workspace, no money spent, nothing sent in the author's name. This record is written from the day's logs, not from memory.