`test (full)` timed out at 20 minutes on three separate pushes, each time
with every package it had reached reporting ok and the step dying mid-run.
The budget was set to sit "above normal full-suite wall time (~8-12m)", and
that is no longer where the suite is: green runs on this branch measured
520s, 661s, 844s, 874s, 885s, 936s and 976s, while the three that died
measured 1287s, 1295s and 1305s. 20m was inside the distribution, so a slow
runner arrived as a failed test — the same reading the package budget above
was widened to stop producing.
30m keeps what the step is for: a hang still dies on it rather than on a
package timeout that names the wrong cause.
Opening a second conversation left every answer in it rendered as its own
source text, and switching back left the first one that way too.
The three deferred plugins are held in module slots and read with
`useState(slot)` — and a plugin is a function, which React takes as a lazy
initializer and calls. What the state then held was not the attacher but the
transformer it returns, and unified attaches that in turn: it runs with no
tree at all, which is the `Cannot use 'in' operator to search for 'children'
in undefined` the renderer threw into SayCard's boundary. A boundary does not
reset, so the card stayed at its source text for as long as it was mounted.
The highlighter has therefore never worked past the card that loaded it: the
listing that triggered the fetch rendered, because the value that reached it
came from setPlugin rather than from the initializer, and every card mounted
after that fell back. katex escaped it because its slot holds
`[plugin, options]`, an array; gemoji did not.
The three hooks were one shape written three times, so they become one that
takes the slot, and every read goes through a thunk.
Measured in the workbench against a mock kernel: opening a second pane went
from 2 rich / 3 plain with two TypeErrors to 5 rich / 0 plain with none, and
highlighted tokens from 3 to 9. Markdown.plugins.test.tsx mounts a listing,
waits for `code.hljs`, then mounts a second card — and fails on exactly that
TypeError with this change stashed.
modernize fails both Index-then-slice pairs in tsRecordKeys, and the
lint job runs with cross-platform build tags where the root `make lint`
does not reach the desktop module at all.
TestAnUncontendedHoldStillReports acquired and released with nothing in
between and then asserted Held > 0. Go's monotonic clock on Windows
advances on the system tick, about every 15ms, so the whole hold fell
inside one reading and the account came back {Held:0s} — the test was
asserting clock resolution, and only that platform was red.
The hold now spans 40ms and the assertion asks for 30, the same shape
the idle test beside it already used. What it proves is unchanged: an
uncontended hold is accounted for and reports no contention.
The committed readings gate what the desktop reducer is checked against,
so stabilize() strips everything that is a measurement rather than turn
structure — a tool call's DurationMs has been zeroed there all along.
The workspace lease account arrived beside it carrying heldMs and idleMs
and nothing stripped them, so the file recorded how long one run of the
test happened to hold the lease: 24ms when it was written, 23ms on the
next machine to run it. The test could not pass twice.
It failed on ubuntu, macos, windows, race and coverage at once, which is
what a fixture keyed on wall-clock looks like rather than five separate
breaks.
Waited, held and idle are zeroed with the rest. What the fixture still
carries is the fact that a lease event was emitted, where it sits in the
turn, and that it was uncontended — the shape the reducer is judged on.
PROJECTION_CAUSE_WITHOUT_SOURCE stood at 17: every interaction whose
lifecycle axis reached Transcript's presence carried an unmount-open
cause with nothing behind it, so the invariant the reduction exists to
hold — a projection always names its sources — was broken tree-wide by
one component.
Openness is decided over every effect a component owns, and the sources
were read off `d.by`, which is the single effect a displayed line names.
Transcript has twelve: the one that makes unmountOpen true is the
useEffect at 456 whose cleanup the walk cannot read, while `by` points
at 325, the first with an open setup and no cleanup at all. Reading a
cleanup off an effect that has none yields an empty set, which is a
debt with no mechanism under it.
The predicates are now declared once and both the verdict and the
attribution read them, so the two cannot diverge again: mountOpenBy and
unmountOpenBy are the effects the verdict was taken over, and a cause's
sources are the union across them. The mount side had the same shape and
was one component away from the same result.
census:verify is unchanged across all ten fixture reports.
The account the kernel closes at each release is five integers with no
path, command or identity in it, so it can ride the channel that already
has consent: three closed enums added to the upload allow-list, and a
group on the dashboard beside the other settings metrics.
lease_hold contended | uncontended
lease_wait the existing latency tiers, contended holds only
lease_idle how much of the hold came after the last write asked
The third is the one that decides anything. A high contention rate with
a low idle share means the lease is held exactly as long as it is used,
and the proposal to release at the last verification would return
nothing; the reverse says the opposite.
Flushed on its own rather than into the turn's batch, because the lease
is released when a session's last run ends and that is not reliably
before the TurnDone that empties the batch. Nothing here changes who
reports: the policy is unchanged and still refuses a non-release build,
CI, DO_NOT_TRACK, and anything but an interactive session under `auto`.
A hold with no length has no idle share rather than a share of zero,
which would read as a hold measured to have been busy throughout.
The dashboard's group table moved to a file of its own instead of
stats.ts growing past its ceiling, and the 17 lines that file had been
carrying are reclaimed.
The kernel now closes an account at each release; this is what reads them.
It reports holds, how many were contended, how long those waited, and the
share of each hold that came after the last write asked for the lease.
Four things it refuses to let a number mean something it does not. The
denominator is holds, so a session that wrote and never waited counts —
it is most of the rate. contended and reported are separate columns,
because a wait inside the one-second grace never becomes a notice and
those are the common case. A zero-length hold has no idle share rather
than a share of zero. And a log the size cap truncated makes every
number a floor, which is said in the rendering rather than left for the
reader to remember — the frames that go missing are the ones written at
the end of long turns.
Run against every session on this machine it reports 35 logs and no
holds, which is the honest answer: the instrument shipped an hour ago
and the corpus starts now.
The workspace write lease is the reason two sessions cannot write one
project at once, and whether that costs anyone anything had no number
behind it. The only record was a sentence on screen — "waited 2.3s" —
and only for a wait that outlived the one-second grace, which hides the
common case entirely.
workspacelease.Stats closes one account per hold: contended acquisitions
including the ones under the grace, how many became notices, total time
waited, how long the lease was held, and how much of that hold came after
the last write asked for it. That last one is the number the proposal to
release at the last verification stands or falls on, and nothing was
measuring it. It rides a shadow event, the shape TodoProgress already
uses: no gate reads it and no prompt byte moves with it.
Writing the test found a real ordering error: the ask that takes the
lease is dated before the acquisition it waited for, so Idle measured
longer than the Held it is part of. It runs from whichever came later.
internal/event/event.go was at the 800-line ceiling, so the audit
forwarders moved to a file of their own rather than the budget moving.
The card was behind a localStorage key no control ever wrote, so it was
not off by default — it was unreachable. What it reports is what the
turn changed, what it verified, and what went unverified, which is
exactly what a reader wants once the turn stops moving; without it most
turns simply stopped.
It is on unless this machine turns it off, and the switch now exists,
beside the other per-machine display choices. The kernel still decides
whether a receipt has anything to say; the preference only decides
whether a reader sees one that does. The control declares that it takes
effect from the next turn, because the reducer records the card when the
turn ends rather than the view choosing per render.
A shell row showed the first 96 characters of the command, which for
`PATH=$(echo $PATH | …) go test ./x` is sixty characters of plumbing and
no verb. Which part of a command names what it runs can only be answered
by a parser — a regex over the text is the word-matching this tree does
not build — so the kernel answers it: shellrun.OperativeCommand cuts the
leading assignments positionally, from the parsed command's own byte
offsets, so quoting and substitutions survive as written. It rides
ShellExecution.Subject and never replaces the command: authorization
surfaces carry the full text, and so does the row's title.
Declaring that pair in wireparity found three drifts already there:
shellVersion and supportsAndAnd were sent and unreadable — which is
PowerShell 5.1, where `&&` is a syntax error, arriving indistinguishable
from 7 — and contextTokens was declared here while only Tool sends it.
A MultiEdit card named its file in the headline and again in the diff
header, truncating one fact twice. The diff takes the path only where
nothing around it has said it, which is the change preview.
A settled call whose whole output was "ok" measured 109px, against 39px
for one that printed nothing — a 2.8x height for two characters. Nine
ordinary calls filled a screen, two thirds of it padded ground holding
nothing. A surface exists to cut a block of machine text into the page,
and one line is not a block.
Three separate costs, each measured:
- The block's own padding and ground: a one-line output takes neither.
- The "more below" fade, drawn on every settled card whether or not
anything was clipped. Clip already knows; it now says so.
- .term's 13px bottom margin, which held the surface off the next
element and holds nothing off anything once there is no surface.
A turn of nine plain calls: 1474px to 1162px.
The diff header wrapped a long path across three lines, so the card grew
by what a path happened to measure — 37px of header became 105px, and
the file read as an empty band above its own diff. It ellipses now, with
the whole path in the title.
The bar floats over the transcript's top edge, so a row landed at the
usual 12px clearance arrived underneath it — the first hit of a search
was the one hit that could not be read.
668 comment blocks, 1500 lines, met one aside at a time while reading
rules. Almost none of them restated the CSS: they are measured colours,
layout mechanics, and why the obvious rule is the wrong one — knowledge
worth more than its placement.
It moves to two companion documents read end to end. TOKENS.md holds the
vocabulary's law: why --float exists apart from --raised, what the
categorical palette was measured against, why the type floor is 11px.
LAYOUT.md follows app.css rule by rule.
No declaration moved: both files are rule-for-rule identical to what
they were, apart from the diff gutter taking --faint and the plan's
completed rows losing the opacity that dimmed them twice.
REASONIX.md states the rule and where a constraint goes: to the
component that has to honour it, or to the stylesheet's companion when
the decision is about the medium itself. It also states that comments
are written in English — commentary in two languages is two codebases,
and the half a reader cannot read is the half that rots.
`"[data-pane="flow"]"` closed its own string, and since 60b028856
cards, bench, look, motion, scale and verify have not parsed at all —
21 card-geometry assertions and 20 behaviour assertions that nobody ran.
selfcheck read that as health: it injects a false assertion and asks
whether the exit code turns red, and a SyntaxError is also non-zero. It
now asks whether the guard parses first, then whether it can fail.
contrast.mjs could only draw four of the transcript's cards, so the
diff gutter's line numbers sat at 4.42 against AA's 4.5 undetected. Its
feed now covers sixteen, which found five more: the plan's completed
rows were dimmed twice, by colour and by opacity, putting their text at
3.22 and the tick at 2.86. Three further corrections to the guard
itself: it stops animations rather than waiting them out (a staggered
entrance measured .cost at 2.04 while it sat at opacity 0.46), it prints
the ink, the ground and the ancestry rather than a signature that four
cards share, and it skips fully transparent text — unpainted text has no
contrast, and whether a hover-only control is reachable is another
question.
**Find in a conversation.** The transcript mounts a few dozen cards out
of however many the session holds, so the browser's own find sees only
what is on screen: with 200 messages, 59 cards are in the DOM and the
first one cannot be found at all. The search reads the rows instead —
saidBy() is exhaustive over Item, so a new card has to answer what text
it carries. Matches are painted with the highlight registry rather than
by wrapping text, which would mean rewriting markdown React owns inside
cards that re-render on every delta.
**Listings are highlighted.** rehype-highlight, lazy like katex, emits
classes rather than inline colours: a highlighter writing its own hex
values leaves the token system and stops following the theme. The
palette is four new tokens; comments and punctuation ride --faint and
--muted, so they follow the contrast tier. A fence with no language
stays unpainted — guessing a grammar paints prose as code.
**A message can be rewritten and sent again.** Composed from what the
kernel already owns: a conversation rewind to that turn, then a send.
The TS mirror of RewindResult was missing conversationOk, so a commit
that touched files and left the conversation standing was
indistinguishable from one that truncated it — which would send the
message twice. The type is completed and the pair is declared in
wireparity.
**The capability a call resolved to reaches the card**, when the name
has not already said it: `tool:grep` beside Search is one fact twice,
`skill:review` is not.
**The task list draws the status its owner keeps.** Three renderers
each re-derived "which step is underway" as the first unticked one,
while HostTodo has carried status, activeForm and level all along. A
list the kernel has written but not started now points at no step, the
step in hand reads as its active form, and sub-steps indent. A
complete_step advance reaches the panel on its own frame instead of
waiting for the turn to end.
Pane.tsx was at the 800-line ceiling, so find and rewind became hooks
rather than the baseline being widened.
Twenty-two of the fifty-four tools the kernel registers had no entry in
either table, so a call through use_capability rendered as its own
title-cased id under the mark that draws a page with a folded corner. A
delegation, a memory write and an install all read as file reads, and
the category colour — the row's only warning — was the neutral one.
install_source was the worst of them: it is not read-only, it installs
an MCP server, and it had no identity at all. It was found by the gate
rather than by the sweep, whose regex missed its Name() spacing.
The fallback mark becomes a neutral dot: "·" is a document, so a name
with no entry was claiming to have read a file.
tool_identity_test.go holds both directions — a registered tool with no
label, and a label naming nothing the kernel registers. A tool is a type
with a Name and a Schema; matching on the name alone reads every bot
adapter in the tree as one.
The rule in this tree is that an error a caller must tell apart carries an
identity and never a sentence. Tool results were the exception, and the
projection comment said so outright: "only that record says a tool call failed"
— meaning ToolExecution, which the shell path writes and nothing else does.
Everything else left the fact in the words, and isErrorMessage matched "error:"
against prose the tool itself wrote.
Measured across real sessions by day: the shell side was closed on 08-17 and
has written an identity for every failure since. The rest never was — 27 on
08-16, 10 on 08-17, 16 on 08-25, and still arriving in September.
toolOutcome already held what was missing. Its refusalCode comment even says
the identity is "carried beside the words rather than recovered from them" —
it just stopped at the message. ToolFailure now carries it: non-nil is the
fact, RefusalCode names a host refusal. Local metadata on the ToolExecution
pattern, so projection.go keeps it for the next compaction and strips it at the
provider boundary. isErrorMessage reads it first; the prefix match stays as the
answer for transcripts written before any of this, which is what it always was.
The identity also never crossed the wire. event.Tool has had RefusalCode all
along and eventwire.Tool did not, so no frontend could read one — parity was
silent because both sides were equally missing it. Both carry it now, the
history projection carries it, and a failure label says which refusal it was
instead of "失败".
ToolFailure and ToolExecution move to local_metadata.go: provider.go was 1087
lines against an 800 ceiling and -update refused to widen for the extraction,
which is what it is there for. Trimming one sentence that the new file's own
header already states brings both budgets down instead — essay 3218→3217,
file-size 38207→38188.
use_capability is one provider-visible tool that stands in for every hidden
capability. The card takes its heading, its hue and its argument summary from
what the call resolved to, which is why a live transcript reads "Remember ·
2026-08-20 会下雨" and not "MCP". Reopening the session read "MCP" with no
argument at all: three separate places dropped the identity on the way.
historyMessages projected ID/Name/Arguments and left ResolvedName and
CapabilityID behind, though provider.ToolCall carries both and their comment
says they exist for exactly this. The rebuild in state/session.ts then had
nothing to pass on. And shortArgs read only the envelope's top level, where a
proxied call has action and capability_id and nothing a reader wants — the real
call sits under `arguments`, a field the proxy's own schema declares, so
reading one level in is following the contract rather than guessing.
Measured on a real session before and after: one blank "MCP" card became
Memory · 天气 下雨, Remember · 2026-08-20（周四）会下雨, and a Remember whose
arguments were refused. The remaining MCP card is action=list, which resolves
to no capability and correctly says so.
historyToolCall joins mirroredWireTypes. It was a hand-written pair with no
guard, which is how a field goes missing on one side and nothing notices;
removing resolvedName from the TypeScript side now fails wire-parity by name.
The history projection moves to its own file rather than widening serve.go's
budget — 1294 lines against an 800 ceiling — which hands back 70 lines.
Narrowing the provider surface to what a turn admits left the estimate behind:
context_breakdown and estimatedVisibleRequestTokens both asked the registry for
Schemas(), which answers with everything provider-visible whether this turn
carried it or not. The estimate is compared against a window the provider
enforces and a maintenance line the host folds at, so an estimate that counts
tools no request carried folds earlier than the conversation needs.
The surface is recorded where it is already computed — run_loop asks
ProviderSchemas once per round and hands it to the prefix-shape capture — and
the two estimators read that instead. Before any request has gone out there is
nothing to have carried, and the whole visible set answers: it overstates, which
is the direction that folds early rather than overrunning the window.
lastProviderSchemas is on sessionCarryOver for the same reason lastPrefixShape
is: the next request rebinds it before anything reads it.
The gutter names a category twice: the mark carries the hue and the line under
it carries the same hue at 30%. net, deleg, write and ask each had both. mcp
had only the mark — its line fell through to the default grey, so the icon said
"this went out to the network" and the stripe beneath it said "ordinary tool".
mem had the same gap, unrendered in the fixture and visible only in the
stylesheet.
src/styles/gutter.test.ts reads both halves out of app.css and fails a mark
whose line carries a different hue, or none. host is the one exception and
carries its reason: its line is a dash, because colour names the category and
texture names who authored the step.
Found by measuring what the fixture actually paints rather than by reading the
rules — the two mcp declarations sit four lines apart and look complete.
Three states existed where the model could only tell two apart: in the schema
and callable, registered but hidden behind use_capability, and — the one that
was nobody's intent — in the schema and refused. update_goal lived in the third:
its ProviderVisible already reads the turn for a goal recorder and its refusal
already carries goal.no_active_turn, but provider requests asked Schemas(),
which answers without a context. Across 534 real sessions it was called 121
times and refused 116.
The reasoning for asking without a context is in SchemasForContext's own
comment: a contextual answer would churn the cache-stable contract. Under
alphabetical order it would — bash_output sorts fourth of twenty-five, and
moving it invalidates the twenty-one after it. Measured rather than assumed, in
benchmarks/tool-surface-cache: at the head a tool costs 896 cached tokens, in
the middle 384, and appended at the tail it costs nothing at all.
So ProviderSchemas sorts in two segments — every stable tool, then every
contextual one the turn admits — and the two request sites take it: the sampling
request, and the prefix-shape capture, which has to see what was actually sent
or the cache diagnosis reports a surface no turn carried.
The five guards that held the old surface are rewritten to the new contract,
which is stronger than what it replaces rather than narrower:
- the stable segment must be byte-identical whatever the context, and every
contextual tool must come after all of it, so an absence is a prefix of a
presence. Nothing asserted that before; it is the property the cache rests on.
- the contract/provider comparison matches by name. Position-wise only held
while the two sets were identical, which is exactly the assumption being
dropped.
- subagent and planner isolation now read the schema rather than the refusal: a
child without the parent's recorder must not be offered update_goal at all.
The executor, which holds one, still is — an asymmetry the old "always
present" assertion could not express.
The tool schema was held still on the reasoning that changing it churns the
cache-stable prefix. True of a change anywhere, false of a change at the end,
and nothing measured which applied.
Against deepseek-chat, 10 tools behind a 1278-token system prompt: appending at
the tail reports 2048 cached tokens against a 1920 baseline — more, because
every token before the new one is unchanged and the request is longer. The same
tool at the head reports 1024, and editing the fifth tool's description 1536,
which is the tail after the edit.
A tail tool alternating absent/present holds 1920 and 2048 across three
switches with no miss spike, because the absent surface is a byte prefix of the
present one and one cache entry serves both.
It reaches the network and spends a few thousand input tokens, so it stays out
of lint and CI, next to pricecheck.
A capability kept out of the provider schema is reached by listing the catalog
and then calling by id. The listing named every id and no arguments, so the
first call could only be a guess. Measured over 534 real sessions: 12 calls
went out against 3 inspects, and 5 came back "it requires ..." — the proxy
description does say "inspect one for its arguments before calling", and a 12:3
ratio is what that instruction is worth.
The two lists the contract error prints after a call has been spent are now in
the listing before it: required field names, and every declared property. Read
from the target's own schema through the registry, the same source inspect
already used, so a tool that changes its schema changes what list reports. An
entry that is not a registry tool, or whose schema declares no properties, says
nothing rather than reporting empty lists a reader would take for "takes no
arguments".
listCapabilities and listServers move to their own file. usecapability.go was
1667 lines against an 800-line ceiling and this would have added 23 more;
carrying the debt forward through -update is what the ratchet exists to refuse.
Split instead, and the file drops to 1557 — 113 lines of file-size budget
handed back.
Not done: projecting the hidden-capability catalogue onto the turn, which was
the other half of the plan. Built, measured, removed. The block ran 870
characters against a 3486-character turn — a quarter of it — and broke
TestEffectFoldDropsSupersededStandingState by moving the fold boundary. The
premise did not hold either: remember fails once on arguments and succeeds on
the retry in the same session, so the model finds it when a task calls for it.
Zero use across 534 sessions is 534 tasks that never needed to remember
anything, not a capability out of reach.
id="flowScroll" was written into Transcript, which renders once per pane, so
two open panes answered to one id and the rail's aria-controls pointed at
whichever came first — not necessarily the one it scrolls. The sweep only ever
reported it with two panes open, which is a state its 23-step walk does not
reach; it turned up on a session opened by hand.
useId per pane. The stylesheet and the perf scripts move to [data-pane="flow"],
an attribute the element already carried, so nothing depended on the id being
the same string twice. Specificity drops from (1,0,0) to (0,1,0) and the four
rules still land: .scroll is written earlier in the file, and the [hidden] rule
gains a second attribute.
#trajScroll in that same [hidden] rule has no element anywhere and is left
alone.
Vertically clipped output has two tells — the fade at its foot and "Show all".
Horizontally hidden output had none, and the scrollbar is an overlay: at rest
the line simply looks finished.
Measured over 499 real sessions, 7587 tool outputs: 54% have a longest line
past the ~80 columns this width fits, and 31.5% past 120. In one session on
screen, 19 blocks scroll sideways; the worst holds 2881px of content in a 624px
box, so 78% of it is off-screen with nothing saying so.
A right-edge fade on the same gradient as the foot, driven by the block's own
inline scroll position: opacity starts at 0, so a timeline that is inactive —
which is what an output narrower than its column has — draws nothing at all.
Verified by progress rather than by computed style, since an opacity animation
is composited and the main thread reads the base value: 0 unscrolled, 0.5 at
the midpoint, 1 at the end, where it fades out.
712 assertions, and audit-sweep clean at 1600/820 in both themes. The dupId it
reports for #flowScroll is present with this stashed — two panes, one id.
Four levels sit in the right rail, and the block title was at the bottom of all
of them: 12px w700 at --ghost, against rows of 13px at --faint, a legend at
--muted and values at --text. Smaller than anything it introduces, and the
palest ink in the column. Of the three signals it carried, two said "minor".
In English the tracked uppercase carries it — that is what an eyebrow is, and
the sweep has never had anything to say about it. Chinese has no small caps to
carry, so once the letterspacing came off there was nothing left but a slightly
bolder, slightly paler line the same length as the rows beneath it.
It takes the column's own size now and ink one step darker than the rows, so
weight alone carries the rank. Not a larger size: the context total went to 22px
to give this column one place for the eye to land, and six more large things
would be six more places. Size is what that landing is made of, and spending it
here spends it there.
The rule is split out of the :lang(zh) group rather than layered over it, since
:is() takes the specificity of its strongest arm and the group has a
three-class one. .side .lbl is named inside the new :is() for the same
arithmetic — the rail's own rule for it is written later in the file.
Six titles measured: 13px w700 --muted, no tracking, no transform. Clean at
1600/820 in both themes in Chinese, and in English, where the rule does not
apply; contrast-sweep reports zero across twelve sections in both schemes.
The sweep parsed getComputedStyle's text by hand, and a computed colour comes
back in whichever notation its value was authored in. An oklch colour arrives
as `oklch(0.85 0.012 255)` — lightness under 1, hue past 255 — and read as
8-bit RGB that is r=1, g=0, b=255, which is the #0100FF the report was full of.
Hue 262 gave b=262 and printed #0100106, seven digits wide.
So every settings page was being judged against colours nothing on screen has.
Ten rows of "below AA" in dark and eight in light were invented, and a real
failure among them could not have been told apart. A gate that misfires is
worse than no gate: this one was printing a verdict on eleven panels it was
not measuring.
It paints instead of parsing now, the way audit-sweep already did: fill a 1×1
canvas with the value and read the pixel back, which is the same engine that
drew the thing under test and accepts every notation there is. The fillStyle
reset before each fill is not decoration — an unparseable value leaves the
property at what it held last, and the sweep would report the previous
element's colour as this one's.
Both schemes now report zero across twelve sections. Raising --text to 88%
brings eight rows back with every colour legible, and dropping it again clears
them.
The light scheme's neutrals were laid out along hue 255. #EEF1F7 has more blue
in it than red, which is what an engineering tool looks like, and it sat under
an amber accent — the two are on opposite sides of the wheel, so the largest
surface in the window and the colour that means "you are needed here" were
quietly working against each other. They run along hue 85 now: #F4F1EA, red
over blue instead of under it.
Only the hue and the chroma move. Lightness is untouched at every one of the
52 declarations, so no contrast ratio was traded for this, and --raised and
--float keep a chroma of zero — a card stays white on a warm ground, which is
the arrangement that was drawn and chosen.
Dark keeps its blue. The two schemes' neutrals interleave through this file by
selector — :root under a media query, then [data-theme], then three contrast
tiers of each — so which side a declaration belongs to is read from its own
value instead: in light a surface is bright and ink is dark, and in dark both
are the other way round. 52 declarations moved and 52 stayed.
--shadow-float stays cool. It is a fifth of an alpha over the ground, and it
was not part of what was drawn.
contrast-sweep could not check this: on every settings page it now prints
colours like #0100106, a channel-parsing fault that reproduces with the change
stashed and predates it. audit-sweep's own contrast judgement is sound —
raising --text to 88% made it report 174 rows with the warm ground resolved
correctly in every one — and it reports none here, at 1600/820/760, with dark
unchanged.
Letterspaced uppercase is Latin lettering. Tracking separates words there; on
Han characters it pulls apart the strokes of a single glyph, and uppercase has
nothing to act on at all. The stylesheet already knew this — a :lang(zh) rule
hands seventeen small-caps selectors a normal face, no tracking and no
transform — but ten more had been written since, and one of them is the only
semantic heading the workbench has. In Chinese the right rail's block titles
were 11px at 1.54px of tracking, uppercase, with .dgrp-h's own count inheriting
both: 成本, 运行指标, 子代理, 本会话.
Which ones belong is settled by where the text comes from, never by reading it.
A class carries Han if its element's children call t(): .hl .fail says "{n}
项失败" and joins, while .hl .src and .hl .who sit in the same badge row and
stay, because what they render is an MCP server's name and a subagent's id.
.shot .glyph stays too — IMG, TXT, PDF are not words.
Two things that judgement cannot see, so both were measured in a running
window: a label handed down through props (.seglb, .dgrp-h) shows no t() at the
element, and it is exactly .dgrp-h that was worst.
audit-sweep grows a ninth judgement rather than leaving this to a script that
runs once. hanCaps reads resolved style — Han text under tracking or uppercase
— so it holds whatever rule set it, and it rides the walk into the panels a
render-time check would never open.
The first clean run was a false one: the sweep drives the kernel build, where
the language comes from the kernel's config and adopt() overwrites the
localStorage the fixture answers to, so it had been measuring English. With
[desktop] language = "zh" and .dgrp-h pulled back out, the sweep reports the two
rows; put back, zero. Clean at 1600/820 in both themes in Chinese, and at 1600
in English, where nothing in this change applies.
Monospace says a machine produced this: a path, a command, an id, a column of
figures that must not jump, a mark that has to hold its cell. The window was
setting its own sentences in it — "仅当前项目 · 后续相关时会被检索", "Palettes
install under themes/ …", every empty state, every settings footnote — and a
column of prose in that face reads as a terminal rather than as something
written. Measured on the fixture: 54% of the transcript's characters, 37% of
the right rail's.
The judgement is structural and never looks at the words, because a rule that
sorted sentences from identifiers by reading them would be the phrase table
this repository does not build. A class is monospaced if a rule in app.css
gives it var(--mono); an element renders prose if its own children call t().
The two together found 63 classes across 155, which a screenshot could not
have — a sweep sees what one render drew, and most of these live on panels a
walk never opens.
46 rules move to var(--ui). What stays is what earns it: terminal output, tool
arguments, paths, URLs, ids, every figure, and the marks. Where a rule wanted
figures not to jump rather than a face, --msub already said so with
tabular-nums; .fold gets the same, because it repaints every second while a
turn runs.
src/styles/mono.test.ts holds it, and holds the two exception lists apart. Nine
marks and keycaps carry a reason each, plus the welcome screen, whose wordmark
is deliberately set in the terminal's own face. Thirty-six classes render prose
and data through one box; splitting those is a change per call site rather than
per rule, so they are recorded and may not grow. A third assertion fails an
entry that stopped being needed, so the lists cannot outlive their reasons.
Reverted one rule to check the gate reports it, then reverted that.
Characters set in monospace: 42% → 33% overall, 54% → 45% in the transcript,
37% → 22% in the right rail. Held by audit-sweep at 1600/820/760 in both
themes against a kernel, and by 712 unit assertions.
Two numbers that only mean anything together. The transcript's prose was
13.5px in an 820px column, which measures 103 Latin characters or 56 Han to
the line — half again past the 45–75 / 30–40 where the eye still finds the
start of the next line without hunting for it. The column was right and the
size was small, so neither one looked wrong on its own.
--read moves to 15px, 16 in Chinese where the strokes are denser, and the
step ladder shifts with it so a reader who had already picked a size keeps
the one they picked. --doc goes to 706px, which is not taste: the narrowest
thing this column has to hold is 80 columns of IBM Plex Mono at --fs-ui,
measured at 624px, and the transcript's own indent and padding want 82px
more. The main-line terminal block now lands on exactly 80 columns.
Measured on the fixture at 1600x1000: the answer's line goes 103 → 71 Latin
characters and 56 → 39 Han, 36 at the Chinese default. Sub-pixel spill is
unchanged at seven elements, every one a 2px rounding that predates this.
Held by audit-sweep at 1600/820/760 in both themes, against a kernel and
against the fixture, and by the 709 unit assertions. Both sweeps still
report four prefs truncations and the oobe contrast findings; both are
there with the change stashed.
Twelve counts render in the rail and six of them say "0 会话". A machine row
counts open panes, so every machine says it at rest; a workspace with no saved
conversation says it under its own name, and the absence of rows beneath it had
already said so.
Plan.tsx settled this for the transcript — a block reading "0 / 0 · 尚未制定" is
a wall to skip on every glance — and the session row in this same file has
always followed it, printing nothing for a turn count of zero. The workspace row
and both remote rows did not.
An empty project has nothing to report and one thing to offer, which is the "+"
beside its name.
Five measurements, five changes, all in the stylesheet.
The transcript separated what the model said from what a tool did by colour and
leading alone — same 14.5px, same weight — so a column of them scanned as one
undifferentiated stream of events. The answer gets a size step; machine output
stays where it was. Its own breathing room widens with it, which pulls the
rhythm apart into three real steps: 22px between two machine rows, 32px across
the boundary into speech, 42px between two separate utterances. It was 22/28/34,
a ladder pointing the right way with treads too shallow to feel.
Every tool card carried a filled icon chip, which meant the fill said nothing.
It is transparent now for the neutral ones, so net/write/ask/deleg/mcp keeping
theirs turns the fill into the signal the gutter's own comment always claimed it
was. Their headlines keep the heavier weight too; the rest step down.
Settled output that succeeded is clipped to a glance. The criterion is outcome
rather than category: a call still running and a call that failed keep theirs,
because a failure's output is the only thing that step has to say. Measured on a
full turn: unrequested output 560px to 358px. The transcript itself only drops
7.6% — the bulk of it is card count, not output, and this does not change that.
The right rail read as a dump because it was set as one: 33 numbers at rest and
37 of its 62 text elements sharing two nearly identical steps, with a single
15px element as the only hierarchy. Nothing was removed and nothing shrank —
hierarchy by making five things smaller is five chances to make CJK illegible.
The context total goes to 22px and its gauge from 6px to 10px, so the eye has
somewhere to land and everything else becomes background by staying still.
The product introduces itself in Inter 200 under a 0.34em all-caps eyebrow,
which is what any product reaches for. Its own vernacular is the terminal, and
that face is already in the bundle: the wordmark is set in it, and the eyebrow
becomes a lowercase line. No new bytes, the metallic sweep intact, and no
overflow at 900px where a monospace wordmark could have found one.
Held by contrast/cards/motion/panels/overflow/press/lang, in both themes.
"Never: incident or conversation history" is a rule nobody recognises breaking.
A writer with a fix in hand narrates the fix, and the result passes every gate
there is, because the essay rule compares line counts and nothing reads
register. Meanwhile the instruction to write code that reads like the code
around it is unambiguous, and much of the tree reads as prose — so the tree
teaches the habit back faster than the rule removes it.
The rule now states its test — a reader who has never seen an earlier version
must lose nothing, and past tense about this code's own behaviour is the tell —
gives the paired example, says where the narrative does belong, and says that it
outranks the surrounding style. It also says no gate reads register and why one
will not be built: separating narrative from a statement of constraint needs a
phrase table, which is the one thing this repo does not build. That rule is held
by review, and saying so is better than implying a check exists.
repolint's paragraph no longer claims to enforce all of it.
Deleting a conversation another Reasonix process has open is refused, and the
refusal was a dead end. The pane map belongs to one process, so the sidebar
shows no pane to close, no button in that window would close one, and
session.in_use rendered as "held elsewhere — close it there first" while naming
no there. The guard had already read the lease in order to refuse and knew the
pid, the hostname and when it was taken; all of it was dropped at the boundary,
and the wording it left behind — still being written to — is not even true of
that case, since nothing is writing.
session.in_use_by carries the holder, and only when the holder is another
process: a lease this one holds does mean a write is in flight here, which is a
different cause and keeps the old code. Params already reach the window's own
wording, which is what busy's params exist for.
Verified against two hosts sharing a state root: the refusal named pid 88240,
pgrep confirmed that was the second host, and the delete succeeded once it was
gone. The rest of the flow was exercised in the same run and is sound — an
unheld session deletes, close-then-delete deletes, and the rail's own gesture
asks, deletes what it asked about, and sequences the pane close ahead of the
delete rather than racing it.
Orphan hosts are what produce the state in the first place, and nothing here
stops them being produced.
GET /todos has been publishing the canonical task list — the latest todo_write
merged with every complete_step advance — and the window never called it. The
panel derived its own instead, by parsing todo_write arguments back out of the
transcript, which is a second implementation of rebuildTodoState and drifted
from it two ways: it replayed no complete_step, so every sign-off was lost, and
it checked no receipt, so a list the kernel refused became the plan. Every
rebuild — on mount, on rebinding a pane, on a stream gap — reset the panel to
the list as the model last wrote it. A signed-off item rendered as the current
one and no later call could move it, which is what "the todo panel will not
clear" looks like from the outside.
The task list is not derivable from a transcript at all: the advances are not
todo_write calls, and the refused writes are. So fromHistory stops trying, the
window asks, and the reads that re-open a session are collected in one place
with the new one. A turn's end re-reads the list too, for the points it moves
with no event to say so — a cancel makes the kernel rebuild its own state. A
read that fails leaves the panel as it stands rather than blanking it. The live
path is unchanged except that a refused todo_write no longer sets the plan.
"A plan that ran to the end is spent" now has one definition, because two ingest
paths have to draw a finished list the same way.
todoItem is lifted to a named type and declared in wireparity: the desktop keeps
a hand-written copy of it, the two are compiled by different toolchains and meet
only over JSON. The handler moves to its own file, which takes serve.go 21 lines
further under its ceiling; the reclaimed budget is recorded.
withTodoIdentityTail decided it owed nothing whenever every step id was still
readable in the view. Ids are readable forever: they sit in the model's own
todo_write arguments. The statuses under them do not stay put — complete_step
advances the canonical list host-side without the model writing anything — so a
list the host had moved on went on reading as the model last wrote it, and the
next sign-off named an item the host no longer called current. complete_step
refuses that, which costs a whole round at full context to learn nothing about
the task.
Canonical state changing and no projection rendering the change is the case
"Detection is semantic" exists to forbid. Freshness is now decided against the
rendered line — citation and status together — through a single todoStateLine
shared by the note and the check, so what the projection says and what the
check looks for cannot diverge.
In 23 recorded sessions complete_step failed 16 times in 43 calls; five of those
are this, the largest single group.
Every session stays mounted and the off-screen ones are hidden with CSS, so a
tab switch throws away no stream, no transcript and no scroll position. That
trade is affordable only while the hidden panes are quiet, and one of them was
not: the /status poll was gated on the turn running, never on the pane being
visible. Each background pane with a live turn therefore cost a round trip and
a full re-render of its subtree four times a second, plus two JSON.stringify
passes over the status object, and the bill scaled with the number of open
conversations rather than with the one being watched.
The poll and the elapsed clock now need the pane to be visible; when the run
began is still recorded either way, so a pane brought forward mid-turn shows the
time that passed instead of restarting at zero, and the tick fires on the way in
so it is current rather than up to 250ms stale. The wait spinner in the
transcript gets the same treatment: ten redraws a second are wasted on a pane
nobody has open, and it reads from the stamp, so the tick on the way back in
covers the whole wait.
Measured on a real pane driven by a mock port with fake timers: four /status
reads per second per hidden running pane before, zero after. That is what the
new test asserts, and removing the visibility gate turns it red.
A turn that stopped with items still open was read as work left undone, and
continueUntilReady pushed it on for up to eight rounds with a message the host
wrote. That is right for a step the model can advance alone. It is wrong for a
step whose next input is the user's — presenting one item of a list and waiting
for a reply was indistinguishable from quitting early, so a list worked one item
per turn could not be worked at all: the turn stopped, the host restarted it,
and the whole list came out in one round.
Nothing about the shape of a turn tells those two apart, so a call does.
await_user joins ask and conclude_blocked as the third way a turn ends on the
model's terms: it names the waiting item and what the user must supply, the list
is kept as it stands, readiness waives the open list, and the continuation loop
does not run. Under a Goal the gate is a pause cause, so the FSM stops rather
than driving through it and the evaluator does not spend a call judging a turn
that already said why it stopped; the next user turn lifts that pause and no
other.
The guards are structural: there must be an open list, the step_id must name an
item on it that is not completed, and there must be an interactive user — a
headless run refuses and is pointed at conclude_blocked. The continuation prompt
names the call too, so the round being told to keep going can take it.
Prefix cost is 292 tool-schema tokens for the new schema, and every existing
session cold-starts its prompt cache once.
Left undone and worth its own change: conclude_blocked is registered but absent
from HostControlToolNames, so the host names it as a way out of an unfinished
turn while the schema does not carry it and only use_capability reaches it.
Adding it grows the prefix enough to move where the compaction fixture in
TestEffectFoldDropsSupersededStandingState lands its first fold, which that
test reads as a fold that dropped nothing.
It named `/bin/echo`, with a comment saying why the command has to exist:
resolving the executable happens before the context is consulted, so a
missing one fails earlier and for another reason. On Windows that is
exactly what happened — `exec: "D:\bin\echo": executable file not found`
arrived in place of the cause, and the guard has been red on that leg
since it was written.
Both judgements fired on what the interface does on purpose: at the
narrowest window every settings nav button reads as past the right edge,
though the rail scrolls to each one, and the twist beside a tree row is
aria-hidden because the row is the control. Seventy-three findings, none of
them a defect — and a gate that cries wolf is read as noise, which is where
the two real ones beside them were going.
Translation tables are data — they grow one entry per label, so the line
ceiling fires on every new string without pointing at anything worth
splitting. The exemption saying so still named the tree the retired desktop
kept its locales in, and has therefore exempted nothing since that tree was
deleted. The live catalogues sat at the ceiling instead.
Twenty-six strings reached the screen written into JSX rather than through
t(): the sign-in device code, what an install or an MCP connection says when
it finishes, the package rows, the tab menu, the Ask and Rewind cards, and
six in the version panel — the last read by nobody, because the sweep that
walks the running app only sees what a run renders, and its catalogue
answered 404.
The catalogue test beside this one checks the keys a t() call names, so a
literal that names no key was invisible to it. `jsx.test.ts` reads every
component's syntax instead: Chinese in JSX text, in an attribute, or in an
expression is a finding unless the nearest enclosing call translates it,
and a file renaming t on import is followed. The one helper that took a
Chinese label and translated it inside now takes a translated one, so its
seven keys are visible to the catalogue check too.
The one shipped theme pack named in Chinese takes the English name its eight
siblings have.
`.seg` does not shrink, so the row shrank the label instead: at the window
sizes this app supports down to, "Interface" was drawn under the first
segment rather than beside it. The group wraps now, and the label stays
whole.
The guard refuses a POST that is not application/json, and refuses it the
way a missing route answers — so a call with no content-type could never
land, and being silent about it, never said so. Acknowledging a launch's
health and replaying a waiting prompt were both making that call.
The kernel states why a total is incomplete; the panel answered "price not
reported" for all four. Three of them are not about pricing at all, so a
user who had simply not sent anything yet was sent to go and fix a price
table that was fine.
The ignore state at a directory was read twice: the file tools carried their
own walk of it, and completion carried none at all, so typing `@` in a
project root offered `node_modules` and `dist` above the files anyone meant.
A name list is one ecosystem's answer; `.gitignore` is where this repository
stated its own, so that is what both now read, through one package.
Inside a directory the rules already exclude, they exclude everything —
which is an empty list, not an answer. A user who typed their way in there
has named it, the way grep searches a path named explicitly, so the rules
step aside rather than offering nothing.
The flash model is `deepseek-flash` everywhere: the id it is served under
lost the generation it never needed. An installed entry is renamed rather
than left behind, and the rename moves every key that named the old id with
it — a price or an effort list stranded under the old key stops answering
for the model that replaced it, which reads downstream as a setting the
user edited reverting to its default.
A preset is now what settles which of its models read images. Reading a
name misses every Kimi, Qwen, MiniMax and Claude model these presets
declare, and `deepseek-flash` spells nothing at all; the spelling stays the
last resort for an address nothing has declared, and stays a correctable
suggestion rather than a claim. The connection that existed only to reach an
image-taking model folds into the entry beside it once that entry reaches
the same model on the same key — unless its user configured it, because
folding would answer their edit by deleting where it lived.
A preset changing shape reaches installs holding the old one through one
declared shape per generation and one upgrade that brings a matching entry
forward. The guard is the whole shape, because an entry holding what we
shipped is ours to move and anything else its user curated. That retires
nine hand-written migrations that each recognised one vendor by hand.
Official list prices live once, in `officialRates`, oldest generation first.
A price change appends rather than edits: the superseded rate is what lets
an installed config be recognised as holding one of ours and brought
forward, instead of quoting a retired rate for the rest of its life. `config`
reads them through `billing.CurrentRate` and `SupersededRates` and restates
none of them — a table written twice is one that drifts, which is how a
vendor's USD rate ended up published on one side only.
`make pricecheck` reads each vendor's own page and compares it against that
table, and says how long ago a person last confirmed each one. It reaches
the network, so it stays out of lint and out of CI. A page it cannot read
exits non-zero: unread is its own verdict and never counts as agreement.
A server started on its first tool call runs on a context the host owns.
When that context ends before the subprocess is up, exec.CommandContext
returns "context canceled" from Start() — in well under a millisecond,
with no stderr, because the process never ran. What reaches the reader
is `MCP startup launch failed after 0.7ms: context canceled`, which
reads like the server failed to launch. The server is fine.
The host is the only one that knows which of two things happened, and
they are not the same thing to go fix:
- the MCP host shut down — the session ended or the runtime was rebuilt
- that server was removed, disabled, or reconnected
Both are now carried as causes through context.WithCancelCause, and the
launch failure reports the cause rather than the mechanism. Nothing
about when or whether a context is cancelled changes; only what the
failure is able to say about it.
Found while testing #9931 against a real server. That report's leading
theory — that the stdio client rejects the framing the official SDKs
speak — does not hold up: a server built on modelcontextprotocol/go-sdk
writes plain newline-delimited JSON (verified byte-for-byte on the
wire), the spec requires exactly that ("Messages are delimited by
newlines"), and `reasonix mcp add` connects to it on the first try. The
0-4ms cancellation is a separate path, and this is what it was hiding.
internal/plugin/** is a declared sensitive path. The change is
attribution only: no boundary, no grant, no launch decision, and no
condition under which a context is cancelled is touched; the causes are
host-authored sentinels, never anything a server supplies.
go test ./internal/plugin/ ./internal/boot/ ./internal/control/ — pass
make lint / make check / make coverage-gate — clean
All three were green at a1adff18c, where these assertions were added,
and red after the changes that followed. One was the product, two were
the guard reading a shape that had moved.
The product one — the approval card's narrow tier. Its two secondary
buttons sit side by side under the primary, and "never ask again" is a
step smaller than "refuse". align-items:center then centres two boxes
of different heights against each other, so their tops differ by a
pixel: a row that looks unaligned, and counts as two. They stretch to
the same height now.
The guards — a menu and a card that each moved:
- The model menu is rendered through a portal, so it hangs off body
rather than inside the picker. `.picker:first-of-type .modemenu`
could only ever time out, and by the time it did, the mutual
exclusion it was checking already held. It asks the picker's own
aria-expanded instead, which no change of mount point can move.
- Quick actions stopped being a card inside a card. The container has
no border or shadow of its own any more; the hover landed on the
row — a fill, 8px of indent, the chevron stepping forward. Same
question, asked where the answer is now drawn.
And one signal removed. `.sym` carries a comment of its own: running is
grey, settled takes the category colour — the colour is the completion
signal. The pulse around it was a second telling of that, and it ran
beside the light travelling down the connector, two loops on one card.
The travelling one stays: it says something the pulse cannot, which is
that the step is advancing rather than hung — the reason it was added.
Restoring the pulse is the `.call[data-running] > .g .sym` rule and its
keyframes, if that reads as too quiet.
All 22 guards green, and all 22 still go red under selfcheck.
.flow lets the rail through by narrowing itself, and then centres what
is left with margin-inline:auto — so one rail's width of room is split
between two sides and only half of it lands where the rail is. Measured
at 1512: content ran to 1077 with the rail starting at 1070. The rail is
pointer-events:auto along its whole height, so those pixels answer a
click with a jump instead of a selection.
Two rails' width, symmetrically, which is what centring costs.
perf/verify.mjs has been asking this all along.
And the guard over the guards was reading a hand-kept list. selfcheck
injects an always-false assertion into each guard to see whether it
really goes red, and its GUARDS array had drifted: cards, composer,
intrinsic, motion, overflow, press and surface — seven scripts, never
once asked whether they can fail. It now finds every script in the
directory that expresses failure through `fails`, so a new guard joins
by existing. All 22 go red on injection.
selfcheck has a blind spot of its own worth naming: a guard that is
always red also passes it. Running the 22 on their own turns up three
reds that predate today — cards, composer and motion — all of them
green at a1adff18c, where those assertions were written, and red after
the changes that followed them.
--ghost is the bottom of the text scale and is calibrated to clear 4.5:1
on the darkest surface it lands on. Three places then took it further
down, and each landed under AA:
- .cost's second reading multiplied it by 76% to sit a step behind the
duration. A step is a tier, not an opacity: with the base already at
the floor there is nothing below it, so the three readings move up
one instead — live to --muted, the duration to --faint, the token
count to --ghost. The same spacing, all of it legible. Dark 3.30.
- The approval card's secondary button kept --ghost after that card
was lifted onto --float, which is several steps lighter than the
--page it was measured against. Dark 4.07 — and this one was mine,
from 2d1cd8bfd.
- A pane tab's count sat on --surface for the same reason. Dark 3.92.
perf/contrast.mjs already measures all of this and reported none of it:
its scripted turn gives a tool result with no contextTokens, so .cost
renders one span and the rule on the second never has an element to
match. One field added to that injection, and the sweep finds all three
— including a light-scheme instance of the first that a hand-rolled
survey of mine had missed.
Verified against the existing tool: three findings without the fix
(dark 3.30 / light 3.33 / dark 4.07), none with it, in both schemes.
.crumb carries flex:1 and min-width:0 so it can shrink, and a comment
saying that is load-bearing. It is — for the box. The children were
left with overflow:visible, so the text went on painting past it: a
folder with a long name ran the whole width of the bar and out the
other side, under the run pill and the three buttons at the right,
which ended up drawn on top of each other.
The clipping existed. It was written under
[data-fold~="rail"][data-fold~="side"] — the tier where both side
columns are folded away — and blowing out the title bar does not wait
for a narrow window. Moved to hold at every width; the narrow tier no
longer restates it. The session title goes with it: it was in the
flex:none group beside the separator, so it could not shrink either.
perf/overflow.mjs supplies the impolite name the fixture never has and
asserts where content lands rather than how it was clipped — an
ellipsis and a scroller are both right, and a box whose scrollWidth
exceeds it may just be holding an unhovered tooltip. Verified it fails
without the fix at all four widths (the breadcrumb reaching 1336px
past the controls at 1512, 1948px at 900) and passes with it.
Eight was a machine's guess about another machine. It was enforced in
three places and explained in a fourth, and the reader met it as a
greyed-out button on a laptop that could have held thirty.
Removed rather than raised, so nothing is left half-holding it: the
refusals in Open and OpenRemote, the X-Panes-Max header the list
carried, the [desktop] max_panes setting and its clamp, the ceiling the
window read off that header, the guard on the new-session button, and
the hub.too_many_panes wording on both sides. An unknown key in an
existing config file is ignored, so a machine that set max_panes keeps
loading.
What the ceiling was defending is real and is now unbounded: every pane
is a full assembly with its own tools, extensions and MCP subprocesses.
That cost is the person's to spend.
The rail never enforced this anyway — it greyed out the button that
starts a new session while opening an existing one went straight past
it to the kernel, so the two paths already disagreed about whether the
limit existed.
Measured with every session in the fixture opened: fifteen panes, one
in front, no refusal, no console error.
A relay can answer the Responses protocol without storing any state.
It then rejects previous_response_id rather than ignoring it, and every
turn after the first fails — with a sentence naming a field the reader
has no control over. The config field to pin it has always existed;
there was no way to reach it from the window, so the only cure was
editing reasonix.toml by hand.
Declared rather than detected. The fallback already in the client
retries once when the endpoint names the field it rejected; widening
that to any 400 was tried and backed out, because a single unrelated
400 would then drop a good endpoint out of stateful mode permanently,
off the prefix cache, on the strength of one request — and a test named
for exactly that case stands against it. What an endpoint does with a
field it was sent is not evidence about what it supports.
Built on the shape the thinking-parameter pin already uses, because it
is the same class of relay incompatibility:
- The capability is a bit on the protocol catalog, which is the single
source of truth for wire differences. Only Responses can carry a
turn by reference; Chat Completions replays by construction and has
nothing to decide. It is not a comparison against the kind string.
- config states the precedence once — mode over the legacy boolean —
so a panel and a request cannot disagree about what is in force.
- The list carries canSetContinuation and continuation the way it
carries canSetThinking and sendsThinking, so the control appears
only where the choice exists.
- An unknown mode is refused, never folded into auto: that would
record "decide for me" for a request that said the opposite.
Verified end to end against the running panel: the control is absent on
the OpenAI protocol, appears with three tiers on Responses, and the
pin reaches the config file and comes back on the list.
Reported in #9815.
The guard that finds Chinese rendered without t() reads JSX text as
">…<". A fat arrow was already excluded from the opening side, for the
reason the comment gives: a check that cries on valid source is one
people learn to edit around.
The closing side has the same shape. `Record<string, string> = { … }`
ends a type argument with ">", and the text this pattern then reads
runs to the next "<" anywhere in the file — so a table of wording whose
call sites each pass it through t() reports as unrouted. That is the
one construct such a table is most likely to be written as.
A ">" followed by "=" is closing a generic, not opening a tag. Verified
the guard still fails on a literal rendered without t().
Two spellings say this row is the drag handle, and they disagree about
inheritance. --wails-draggable is a custom property, so under Wails
every span on the bar inherited drag and the opt-out on the controls
was the whole story. -webkit-app-region is a regular property and
inherits nothing: measured on the running page, .chrome computed drag
and all nine of its descendants computed none. The bar was draggable
only where nothing was painted — the breadcrumb alone spans 1060px of
it, the right-hand group another 328 — which leaves the gaps beside the
wordmark, and those are what a reader finds by hunting.
`inherit` is not the fix: the parser accepts it and it still computes
to none. The row names its descendants instead, excluding only what a
control draws inside itself — that stays out of the union and is
covered by the control's own no-drag rectangle, so the list of controls
is still written once.
perf/press.mjs asks it as a hole rather than as a list: nothing on the
bar may be neither draggable nor part of a control. Verified it fails
without the rule (six holes, the breadcrumb among them) and passes with
it. Chromium computed values are what was measured; a real window drag
is not something synthetic events can drive.
Reported in #10156.
Checking a provider against a kernel that does not grant the provider
routes answered 403 provider.editing_disabled, and the panel drew every
failed check the same way: 「无法连接」 over the kernel's own sentence.
The two then contradicted each other — the heading named a transport
that was never reached, while the line under it said the request was
refused on purpose. A reader who connects to a remote host sees it on
every check there, because that grant is the desktop shell's alone: a
source writes an API key into the credential store of the machine
running the kernel, so a server reachable over a network must not take
one from a client.
Read off the code, never the status: 403 is also what a gateway in
front of the kernel answers, and that is a different thing to go fix.
A refusal now says what it is and where the source is configured
instead.
The code is spelled twice — the exported constant the branch reads, and
the literal key the kernel's parity guard reads this file as text to
find. Neither language notices when one of them moves, so a test holds
them together.
Reported in #9772.
The task view lays the steps out at full width while the rail is still
up, so one list stood twice on one screen in two hands: numbered, with
a measured cursor and a strike, in the rail; dotted, with a 进行中
label, in the view. Neither is wrong for the width it was drawn for —
316px and 880px do not want the same density — so they are not merged.
They are stopped from being on screen at the same time.
Presence stays the panel's own contract, which is where the rail's
order table says it belongs: Plan takes shownElsewhere and returns
null, the same way it already returns null with no steps. The order
table is untouched, and every other panel keeps its place.
Measured across a tab switch: conversation has one in the rail and
none in the view, task has none in the rail and one in the view, and
coming back restores the first. The room the rail gets back goes to
the panels under it — tokens per round and the prefix cache reach the
first screen on the task tab.
A project row drew its × at full strength beside its +, while a session
row drew both of its own at .45. The three baselines came from the move
to the row layout: the old card hid its × until .ws:hover, the row
selector no longer matched, and opacity:1 was what put it back on
screen — not a decision about weight, and never commented as one.
Not hidden until hover: these reserve their width, so hiding them buys
nothing back and leaves a control that reads as missing. perf/press.mjs
holds exactly that — with the buttons at 0 it reports five ghosts and
fails. Quiet is the setting that is available here, and the rows below
already use it.
The × now sits a tier under the + it stands next to, in both kinds of
row, and comes up to full on hover or focus.
The rule that raises an unanswered approval out of the flow keyed on
data-k="ask". Authorisation was split off to data-k="write" — a grant
is a write permission — and this was not moved with it, so the common
case, the one that is about to touch your working tree, has been
drawn flat ever since. The criterion is whether a grant is still
unanswered, which .apv:not([data-sealed]) already states; the category
says which kind it is, never whether it blocks.
Lifting also needs a layer, not just an edge. Measured on a blocked
frame, the elements carrying a shadow were the chrome, the search
field, the selected project row, the selected session row and the
composer — five, and the card holding everything up was not among
them. A 9% wash over a transparent fill tints the page it sits on; it
does not leave it. The fill is --float now, with the shadow that goes
with it, and the amber edge stays as the categorical mark.
Verified in both schemes: before an answer the card is the only lifted
element in the transcript, after one there is none.
.mfind stood for two different structures: a bare <input> inside the
popup menu, and the <div> wrapping a field and its count in the model
lists. Both stylesheets that carry the name were unscoped, so the two
reached each other from both directions — the menu's sticky rule stuck
the settings container to the page while its rows scrolled underneath,
and the container's margin-bottom overrode the margin the menu's own
rule declared.
The menu keeps .mfind; the wrapper becomes .msearch. That leaves
`.mlist .mfind`, which reset position/width/margin/padding/border/
background back to static, with nothing to undo — it was the local
patch written the last time this collision surfaced, applied to
ModelChoice and never to Models, which is why only one of the two
lists was ever affected.
Measured on the three call sites: the menu input keeps sticky, its
9px 11px padding and the --float fill, and regains the 5px bottom
margin its own rule asks for; both wrappers resolve to the flex row
they were always meant to be, with no fill and no border.
Reported in #9648.
Two readings off a 3x capture of a real call.
"64.0s 82" — two quantities of different kinds set side by side with
nothing between them, and the second carrying no visible unit at all. It
is the tokens this step left in the context, which only a title attribute
ever said. A middle dot separates them, and it steps back one notch:
how long the step took is what you are waiting on, how much context it
holds is what you ask afterwards.
"Bash git-bash curl A/B · 200 次并发" — the name and the tag answer one
question (which tool, in which shell) and the arguments answer another
(what this call did), but all three sat 8px apart and read as three
parallel items. The pair closes to 5px, the arguments open to 11px.
Both are three pixels of change. They are here because the line repeats
on every card on the screen, which is the only reason three pixels matter.
contradicting its colours
Measured on the running rail, and the first two readings were mine being
wrong: I took the weight off the selected session row, which is bolder by
design, and read a hierarchy that was not there. The real numbers say
something else.
Weight and colour pointed opposite ways. A machine name was the heaviest
step in the column (700) in the palette's quietest ink (--muted); a
project name was a step lighter (600) in the brightest (--text). One axis
said machines outrank projects, the other said the reverse, and a glance
resolved neither. What a person looks for here is a project or a session,
never a machine — so the weight comes down rather than the colour going
up. A machine row still reads as its own thing: no indent, a status pip,
and a count of projects rather than of sessions.
Grouping. Projects sat 0px apart and machines 8px — eight pixels in a
264px column reads as "these two are slightly further apart", not as a
boundary, which is the same failure the metrics rail had one commit ago.
Projects get 7px of their own, machines 20px, and the seam between this
machine and the first remote takes that same 20px because it is the same
kind of seam.
Two things the rail was not doing.
Grouping. Nine blocks sat 12px apart with a hairline between them, and
9px apart inside — three pixels and a line between "these two answer
different questions" and "these two answer the same one". Read down the
column it was one evenly spaced list, which is the reading the group
headings were added to fix. Space groups better than a line does: a line
only says there is a boundary, while spacing also says which side is
nearer. 22px between, 9px within, no rule at all.
The leading figure. A comment has claimed since the postures landed that
"the one in the leading block is a step larger than the rest" — and no
rule ever implemented it. .mtop .amt took the display step unconditionally
while the working posture had already moved cost to fifth place, so the
largest number in the column was the one least worth watching: ¥0.00, four
blocks below the context gauge it dwarfed. The step now belongs to the
first block rather than to the cost block.
Measured on the running rail at 1512×945, both before and after.
Each was measured against the app, not against a mock-up. Two of them were
rewritten after the screenshots came back, because a mock-up of a card and
a card are not the same object.
- A reading column. The transcript had no width ceiling, so at 1920 a line
ran 159 characters — twice what is readable. Two earlier attempts were
refused for the same reason ("the right edge is left hanging"), and both
had only narrowed half: one the outer column while the body kept 68ch, one the
body while the column ran full. Taking both together was never tried,
and it is the only version where nothing hangs. 820px is what the 1512
window already lays out — the default window was always right.
- The host gets a voice. data-k reads categoryOf(tool), so compaction,
guardian and notice — the three things the host does itself — carried no
identity at all and sat in the same grey as an unclassified tool. They
take a dashed rail: same line, same palette, different material. Colour
is spoken for by category, length by duration, motion by state; material
was the one channel still free, and it is colour-blind safe.
- Duration becomes spacing. It was meant to be the length of the gutter
line, and on the real thing that does nothing: .line is flex:1 and real
cards run past two hundred pixels, so min-height never applies. Spacing
does not compete with content height.
- A pulse travels the running line, replacing a static gradient that left
a 64-second call looking identical to a hung one.
- Authorisation stops wearing consultation's clothes. Both were data-k
"ask" with the same "?": one asks your opinion, the other asks to write
your files. It takes the write category and a key glyph, and the three
buttons are ordered by consequence — "never ask again" is a permanent
grant and no longer the same size as "just this once".
- The guardian's tag printed guardian_assessment. Every other card spends
that slot on something a person reads.
- Diff line numbers were array indices. No @@ parsing, so a change at line
205 was labelled 1, 2, 3 — and the hunk header itself rendered as code.
Blank lines were dropped, and long lines were clipped with no way to
scroll. Deleted lines now show no number at all: they do not exist in
the file the column is offering to take you to.
Centring came out of the same session: with no ceiling, "flush right" and
"full width" were one thing; once the column narrowed they separated, and
the transcript sat 414px away from its own composer. Both now centre, and
their edges agree at 1920, 1512 and 1180.
One proposal was withdrawn after reading the code: a notice's severity is
already a left colour bar, as it is on .guard and .find. Changing its glyph
would have introduced a second language for the same fact.
Sixteen rows declared role="treeitem", which tells a screen reader the
arrows walk them, and not one of them could be reached by any key. The
tree had no roving tabindex, no arrow handling, and no comment saying the
omission was deliberate. What Tab did reach were the small buttons inside
the rows — so a keyboard could delete a session it had no way to open,
and a screen reader was promised a tree that answered nothing.
Roving tabindex rather than a tabbable row each: a tree is one stop on the
Tab path and the arrows move within it, which is the whole point of the
pattern — forty rows in the tab order is the same as none. The entry point
starts on the open session and follows the walk, so coming back with Tab
lands where the arrows left off.
Up/Down walk what is showing, Right opens a closed branch and steps into
an open one, Left closes an open branch and otherwise goes out to the
branch the row hangs under, Home/End reach the ends, Enter and Space do
what a click does. Order is read from the DOM — document order already is
visual order and a collapsed branch is already absent — so nothing has to
be told when the tree changes shape. aria-level goes on all seven rows
because Left needs it and a screen reader was owed it anyway.
The handler rides JSX rather than addEventListener: a registration made
through the platform call has nowhere to write which action it belongs to,
and an input outside the census is one nothing checks. tree.navigate is a
view action — the arrows only move focus, and what Enter reaches is the
row's own action.
Verified against the running app: 1 tab stop across 16 rows before and
after walking, Enter opening a second pane, Left collapsing 16 rows to 11
and Right restoring them, and a rename field keeping its own arrow keys.
Two rules computed the same left edge by different routes — the flow pads
20px inside a margin, the composer takes the margin alone — so only the
right edges disagreed, by exactly that padding. A card's right edge sat
20px inside the box below it, which is small enough to read as "not quite
square" and never as a number. The padding gets a name and both sides
reference it, so the two cannot drift again.
Also: the sub-agent block led with a row labelled "子代理数量" under a
heading already reading "子代理" — in English, "Sub-agents" under
"Subagents". The heading supplies the noun; the row keeps the count.
The title, the run pill and the approval mode are the front pane's, and
they were written in one place: the report handler, when the reporting
pane happened to be the active one. Nothing read them on a switch. A pane
reports when something about it changes, so switching to a pane that is
sitting still left the chrome naming the conversation that had last
spoken — verified by clicking between two panes three times, with the
title never moving off the second one.
This is the failure mode the projection notes name: freshness that rests
on every writer remembering to announce itself is one quiet writer away
from stale. Each pane's last report is kept in a ref — a ref rather than
state, so a background pane's usage round does not re-render the window —
and the switch reads from it instead of waiting to be told.
The fixture's fold also still carried the pre-boundary shape, so the one
place a reader could see a compaction card was showing the wording that
was replaced two commits ago.
The fold point was drawn as a notch and read as something to drag, which
is the control a reader already expected — and it is the right one. What
it must not become is a percentage slider. This bound is an absolute input
size and that is its entire point: the same 16% is 160k against one window
and 20k against another, so a track measured in shares would rewrite the
setting every time the model changed. The track spans the window because
the bar does; the number it carries stays tokens.
The three buttons and the number field are gone. The two ends are not
extremes but the other two answers — past capacity the economic bound has
nothing left to tighten, and the default's own position is a detent,
because "the default" and "a number equal to today's default" stop meaning
the same thing the moment the default moves.
Four things only a real drag showed:
- Given its own min..max the track cut off everything below the floor and
above capacity, so the handle sat at one fraction of the track while the
mark sat at another. Dragging to the visual middle moved the mark
somewhere else entirely. Both are placed by the window now.
- A one-step detent is about two pixels of track. Landing beside the
default instead of on it silently converts "use the default" into a
number that stops following it, so the detent is two steps wide.
- The reading and the thumb need different clamps: a controlled range
clamped mid-drag pulls its thumb back under the pointer, while a reading
left unclamped past capacity names a size nothing folds at.
- Rounding the step in powers of two puts 160k between two stops, so the
handle could never sit on the number the panel was naming. Thousands.
The state is a hook rather than a component: owning the track would
rebuild it on every open, and a bar that remounts animates its width from
zero, which reads as the session's usage jumping. Three scoped
declarations, one per event — a generic data-action on an element with
several handlers names none of them. UNDECLARED_CEILING drops to 220.
The footnote said why a 1M window folds at 160k and then left the reader
with nowhere to go: the bound itself lived in a settings sheet two clicks
away, under a disclosure called Advanced. A setting that can only be found
by people who already know it exists is one most people never find, and
the reader this footnote was written for is exactly the one who did not
know.
The rail now offers the same three choices the sheet does — default,
custom, capacity-only — because they are one intent and not two. Only the
labels differ, since one of them is drawn in a 245px column. FoldMode and
foldModeOf move to src/ui/foldbound.ts so the rule that reads a stored
number as an intent has one home rather than two.
- The fold point becomes the way in, with the same dashed affordance the
window figure already carries. Opening one editor closes the other:
side by side they are two boxes of numbers with nothing saying which
ceiling each answers for.
- The footnote stands down while the editor is open. The chosen mode says
what it does there, and two greyed paragraphs stacked in one narrow
column read as one nobody finishes.
- A write rebuilds the runtime, so the gauge handed back is the kernel's
own — port.context() after the save, never this reply's arithmetic.
- The fixture answered 128k to the settings sheet while the gauge had been
told 1M, and saving moved neither. Both faces now read one pair from one
bounds(), so the editor is developed against a session that moves.
- The rail's segmented control is a step smaller than the sheet's: at the
sheet's size it reads as a part from another product dropped into a
20px-line column.
A session folds at whichever comes first: compact_ratio of the window, or
context_soft_limit_tokens of visible input, default 160000. Against a 1M
window the second always wins, so compact_ratio = 0.8 never reaches the
800k it asks for — the session folds at 160k, 16% of what the same panel
says the model holds, with nothing on screen naming the other bound.
The host had already decided it. compactBoundary() answers capacity or
economic and has ridden ContextMaintenance since 280dfd8c9; nothing
rendered it. The card said a threshold was reached, the rail showed a bare
160k beside 1.0M, and the reader supplied the only explanation left.
- event.Compaction carries the boundary and its size, stamped by one
compactionFrame rather than four copies of the same two lookups.
- ContextBreakdown carries the boundary and the window's own line, so the
rail states which bound holds instead of comparing the pair itself —
that comparison is the kernel's rule and belongs in one place.
- The rail notches the fold point onto the capacity bar: 160k against 1M
is a division nobody performs while reading a panel. The footnote is
written only where the bound is not self-evident, since a fold at the
window's own share explains itself.
- The notch is drawn in the text colour, not accent. Accent sits one step
from cat-4 and the legend for cat-4 is directly beneath that line, so a
position mark would have read as a sixth category.
- Three statements that compact_ratio is the sole automatic trigger are
corrected. It has not been one since 280dfd8c9, and one of them is
written into every config.toml the wizard renders.
- wire-parity now holds both mirrors that carry this: a boundary the page
cannot read is a fold it explains by guessing.
Found while answering "why can't I open this conversation — it says something
else has it". Something else did: four Reasonix kernels were alive on this
machine, one of them for ten days after the application that spawned it was
gone, and between them they held five session leases. Clicking any of those
conversations is refused, correctly, by a lease whose holder nobody can see or
close.
The host is supposed to end when its shell does, and it reads that off the
stream the shell holds: `io.Copy(io.Discard, os.Stdin)` returns at EOF, which
is the parent going away, "exit or crash alike". What enabled it asked for
`os.ModeNamedPipe`, and the shell is Node: libuv gives a child's stdio a
socketpair, not a FIFO, on every platform Studio ships. So `parentLease`
answered nil at every real launch and the watchdog was never armed — a host
whose window was force-quit, or whose Electron died, simply kept serving, kept
its data home, and kept its leases.
A socket is a lease now. A terminal and a regular file still are not: one never
ends, and the other ends at once and would take the host down at startup.
The existing test proved the mechanism with `os.Pipe()` — a FIFO, which no
launch uses — so it passed while production had no watchdog at all. The new one
uses the stream the shell actually hands over, and checks both halves: that it
counts as a lease, and that reading it ends when the peer closes. Against the
old predicate it fails on the first.
Swept both languages for text that ellipsizes, and set the fixture's own titles
aside — a session's name is data and is supposed to clip. What was left is a
label that does not fit the slot it was given, and in English there were three.
The settings list truncated its section names. The rule for that row is written
above it — "the value gives up its width first... a row that truncates the
section's own name to keep four characters of its value has traded the label for
the footnote" — and it was not in force: the name was `flex: 1`, so its basis is
zero, the row never counted as overflowing, and the name simply took what the
value left it. "Tools and permissions" wants 138px and was handed 99.6. The name
now lays its content as its basis, so the row does overflow, and the value takes
99 shrink against the name's 1.
That alone leaves the value at 13px, which is not a value, so the column widens
from 224 to 240: enough for the longest name and its value together. The 224 was
measured against Chinese names, which are half the length.
The account footnote wrapped to two lines instead of eating its own last words
("Only the networked features n…"), and the rail's search placeholder lost the
last letter of "projects" — 180.3px of text in a 179.8px field — so the English
reads "or projects" now, which fits with room to spare.
The workspace tree's disclosure is a stroked polyline on the 16-unit grid. The
transcript's fold ("思考 11 字") and the settings sheet's advanced section were
solid triangles out of the type — ▸ and ▾ — so the same idea, "there is more
under this", had two shapes depending on which part of the window drew it.
Both take the tree's polyline now, as a mask so the pseudo-element can still be
a pseudo-element, with the fill coming from currentColor exactly as the type did.
The token holds the one path. Checked in WebKit as well as Chromium: the desktop
shell is the former, and a mask that quietly does nothing there would leave the
mark invisible rather than merely different.
The composer's policy summary and the cache panel both marked their one
dangerous state with the character `⚠`. Every other mark in that row — the
attach plus, the plan and execute glyphs, the model diamond, the send arrow — is
a stroked path on the same 16-unit grid, so the one that matters most was the
one shape in the row a font chose for us. The code point is also in the emoji
set, which leaves its presentation to the platform rather than to this design.
It is a path now, the same grid and stroke as its neighbours, taking the colour
of whatever says it — err beside 全部放行, warn-ink beside 前缀变了.
The two tests that pinned this pinned the character. What they are for is that
the state is marked at all — "the quiet may not swallow a fully-permitted
session" — so they ask for the mark rather than for the glyph.
Correcting the earlier note on the rail's own marks: it said `✎` and `×` were in
none of the shipped faces. That part is wrong — both faces carry both. What held
is the rest of it, and it is what that commit's message says now: two characters
out of two different stacks at 11px and 15px, beside a 13px drawn plus, with the
destructive one drawn largest.
The one block in the transcript that is the reader's own words was drawn at the
column's full width whatever it held. "帮我看下这个文件" and a twenty-line brief
got the same white band, and a conversation of short questions read as a stack
of empty slabs with a sentence in the corner of each.
It is as wide as its longest line now, and still stops at the column. Nothing
else about it moves: the ground, the corner, the top highlight and the gutter
mark are the ones it had.
The five parts of the context window were drawn in deleg, net, accent, ok and
faint — the palette's status colours, each of which already means one thing, and
none of which means "the system prompt". Two costs. The status vocabulary lost
five of its slots to a chart. And the chart had no palette: run the six checks a
categorical set has to pass and it fails four of them.
The one that matters is the fourth. 工具输出 (faint, grey) against 模型回复 (ok,
green) measures ΔE 12.0 to normal vision, under the floor of 15 — not a
colour-vision case, a plain "these two read as the same colour" — and they are
the second and fourth largest slices on the bar. Alongside: accent sits outside
the categorical lightness band at L 0.78, deleg and faint are under the chroma
floor (they read as grey rather than as a hue), and accent measures 1.79:1
against the panel it is painted on.
The five slots are their own tokens now, stepped for each scheme and validated
as a set in both: lightness band, chroma floor, adjacent CVD separation (worst
9.1 light / 8.4 dark against a target of 8), normal-vision separation (19.6 /
19.3 against a floor of 15), contrast. Four light steps land under 3:1, which
the relief rule allows because the legend spells out every row — identity is
never colour alone here.
The gap between segments goes to 2px. At 1px the ground between two slices is
not visible on a dark surface, and that gap is the mark that says they are two.
The control shelf is pulled back out to the card's edge with negative margins,
and the card's padding is written in a different rule, so the two drifted: the
margins are 14 and 10 against a padding of 15 and 11. A one-pixel strip of the
card's own gradient shows down the left, down the right and along the bottom of
the floor, which is not a seam anyone drew.
The padding is two named lengths now and the margins are computed from them, so
"the floor ends where the card ends" is one statement rather than two numbers
that agree by memory. Measured after: 0, 0, 0.
The floor's corners take the card's radius rather than a step of their own —
9 inside 12 leaves the inner arc bulging past the outer one — and inset by the
border, so the two curves are concentric.
Two things in the column that is actually read, both of them a hue or a rule
doing work that type already does.
A markdown table was a grid: every cell boxed on four sides, the header row
filled and set in the monospaced face. Four columns of that read as a form
someone has to fill in. The vertical rules go — the horizontal ones already say
which words are on one line — the header keeps a heavier rule under it and takes
the interface face, because a column heading is a phrase and not a value, and
the first column loses its left padding so the table's left edge lands on the
prose's.
Inline code in an answer was --deleg. That hue says one thing in this palette:
this work was handed to a sub-agent. A file name is not that. The face is what
marks a machine word — it is doing that already, in the middle of Han text with
no argument — so the colour goes back to the prose's. The settings pages have
been rendering their inline code in a neutral all along; this was the outlier,
and the same teal was on two other prose surfaces.
Four cards of one weight, and the page's actual answer — what is this doing, how
far along — was the first of them. Two of the four are usually empty states, one
of them is a card whose content is a list of places to go, and its first row
went to the same place as the link in the card beside it.
The state and the goal are the page's head now: no box, the goal a step larger,
a hairline under it. The plan and the live trajectory are the content, and the
trajectory takes the full width it always should have had — it was sharing the
row with three buttons. What is left of those buttons is two, side by side under
a hairline, because they are the way out of this page rather than a quarter of
it. The duplicated one is gone.
Each card also carried a colour: --tk-glow, a 520px radial wash that lit up on
hover, tinted per card — net for the plan, deleg for the trajectory, accent for
the other two. A card is not a control, so nothing happens when a pointer
enters one, and none of those four hues meant anything: "当前任务" and "快速操作"
were both amber. What stays is the one that was true — something inside took
focus, so the border says so — and it says it in the focus colour.
The trajectory's own link stops being blue. --net is "the system is running on
its own", and it was the only blue text on a page that also has a blue running
pill; the rail's links have been --muted all along.
The fade at the bottom of a long tool output is the clip's own ::after, and the
button that expands it is inside the clip. That went unnoticed for as long as
the fade was an invalid declaration reading a token that never existed: nothing
was painted, so nothing was covered. Fixing the token turned the gradient on and
it landed over 展开全部 — the one control that answers the thing the gradient is
there to say.
The control sits above the veil now. The fade still runs to the clip's edge, so
the last line still dissolves, which is the whole point of it.
An empty composer was three bands of text: the placeholder, two capability
hints, and "Enter 发送 · Shift+Enter 换行" — which is the least surprising fact
about a box you type into, standing permanently in the one place a reader looks
before they start writing.
The slot is not decoration; it carries what is happening to a draft (sending,
stopping, an attachment that failed) and it is the input's accessible
description. So the slot stays and its idle sentence goes. What Enter does is
already declared to assistive technology through aria-keyshortcuts, and while a
turn runs Enter means something else — that sentence is worth writing, and it
still appears.
#A76200 was not chosen as a colour. It is the darkest amber that still carries
white text, arrived at from the other end: white on it measured 4.4977, which is
not 4.5, so there was nothing left over. A fill that has to be that dark to hold
white ink is brown, and in the light scheme it was the largest saturated area on
the screen — the primary button on the empty state, the approval card's action,
the stop button, the waiting pill.
The dark scheme has always done it the other way: the hue itself, with dark ink
on it. Both schemes do now — #E6AC45 against dark's #DDA144, with the ink
measured at 7.25:1 rather than assumed.
Three consequences, and the gate that found each of them:
- **A mark is not a fill.** At 78% lightness the hue is a face for dark ink; a
5px pip of it on the rail reaches 1.79:1 against the page. --accent-ink is
already the readable value of this hue, and in dark it *is* --accent, so the
marks move to it and that scheme does not change: pips, the tab marker, the
meters, the composition bar's own segment, the ask card's gutter mark. The
guard now holds every painted semantic hue to 3:1 against what it is painted
on — WCAG 1.4.11's threshold, scoped to the six hues the palette declares
rather than to "thin things", because a hairline is supposed to be faint and
a state is not. It named three: a 4px marker, a 6px host pip and the 28px ask
mark.
- **--err needs its own ink.** Two danger buttons were painting --accent-fg on
a filled --err, which only worked while the two hues happened to share a
lightness in each scheme. --err-fg is declared: white in light at 5.45:1,
near-black in dark at 6.0.
- Nothing else regressed: 21 guards and 661 tests, with the contrast sweep's
known list still empty.
`perf/tokens.mjs` exists because CSS is silent about an undefined custom
property: `background: var(--bg)` with no fallback makes the whole declaration
invalid, the box keeps whatever it inherited, and it reads as the design. The
guard collects every `--x:` in the stylesheets as a declaration and every
unfallbacked `var(--x)` as a use, and fails the difference.
It scans the file as text, comments included. One of those comments is the note
left when the veil behind the connection dialog was fixed: "--page, not --bg:
there has never been a --bg, so this whole declaration was invalid". That
sentence contains `--bg:`, so the guard has been reading the explanation of why
the token does not exist as the proof that it does — and the seven remaining
uses have been green ever since.
The seven: the fade over a clipped tool output, the initial in the account
button (its ink, on a filled circle), and the fields and list in the remote
connection dialogs — an input with no ground, sitting on a floating card, which
is what "the box looks like it is missing" was. They take the surface a field
sits on everywhere else, the fade takes the ground it fades into, and the
initial takes --accent-fg.
Comments are stripped before either side is collected now. Checked by running
the guard on the tree as it was: it names --bg and exits 1.
The last sweep found five lines under AA in light and fixed them by eye. That
result held for exactly one day: a colour is a token, so what a value change
reaches is every rule that reads it, not the handful the person changing it can
picture. This walks the rendered window instead — workbench with an approval, an
ask, a failed call and prose, plus the settings sheet — in both schemes.
Three things decide the number, and each one read wrong turns a failure into a
pass:
- Colours go through a canvas, which parses CSS Color 4. Reading the components
out of `oklch(0.605 0.016 255)` as if they were R, G and B makes the hue angle
the blue channel — the same defect the picker guard was just carrying.
- The ground is composited upward. A 13% tint is not a ground; what shows
through it is. Written the other way, ImageData is never premultiplied, and
dividing by alpha again reported the fail pill as 1.19 when it is 4.39.
- Large text is exempt at AA's own two steps: 24px, or 18.66px at 700.
Six lines came back, all of them one fact: **--ghost's headroom is measured
against --page**, which the tokens file says outright, and these six had it
landing on a raised face instead — a selected project row (raised), the search
field's ⌘K (raised), the signed-out avatar (overlay), the prose copy control
where the settings sheet draws it (surface), and the ask card's hint (the card's
own wash). On those grounds the weakest tier is faint, and that is what they
use now. The seventh, the failure pill, was --err reading on a tint of itself:
--err-ink exists for exactly that and the light scheme needed it.
The known list is empty, so any line that falls under AA from here is new. The
guard is in selfcheck's roster and goes red with a false assertion injected;
putting one of the six back reproduces its own finding.
The last of the selection surfaces. Every menu's current value, the completion
caret, and the model list's chosen row were all drawn with a tint of accent and
an accent bar — the same mark the rail, the icon column and the settings sheet
have already given up, and for the same reason: a hue that means "a decision is
waiting for you" cannot also mean "this is the one you picked".
These sit on --float rather than on the page, so the neutral fill is mixed from
the text colour instead of stepping to a named surface: that moves it away from
hover in whichever direction the scheme goes — darker than --float-hi in light,
lighter in dark. Measured by perf/pick.mjs: 38.6 against a hover step of 19.6
in light, 25.9 against 13.8 in dark, where the rule asks for 1.4×.
Amber in the interface is now the approval card, the ask card and its options,
the pill and the stop button that a running turn puts up, and the pip on a
conversation that is holding for an answer. Everything it marks is something
waiting on a person.
`pick.mjs` compares the current row's fill against what hover paints, and
requires the same direction — the rule exists because --accent-wash moved the
wrong way in dark and left the selected row reading as a hole. Both sides of
that comparison were being computed from strings parsed as RGB triples.
A computed colour is serialized in whatever space the author wrote: a token is
`oklch(0.31 0.02 255)`, a color-mix comes back `oklab(0.897 -0.0009 -0.0035)`,
everything else is `rgb(...)`. Reading the three numbers out of the first and
weighting them as red, green and blue makes the hue angle — 255 — the blue
channel, and 0.0722 × 255 then dominates the whole expression. The two sides of
the comparison were not in the same units, and one of them had no relation to
lightness at all. Both numbers were stable, so the check looked like it was
working: the sign it reported depended on which colour syntax the stylesheet
happened to produce, not on which fill was heavier.
Colours now go through a canvas, which parses CSS Color 4 and hands back the
bytes that reach the screen. The hover reference is read from the `.mi:hover`
rule's own declaration rather than from a token name written into the guard —
and through `getPropertyValue`, because CSSOM's typed getters return an empty
string for a `var()` and the guard was silently finding nothing.
Checked against the bug it was written for: putting --accent-wash back on the
row is now reported as -9.2 against a hover of +13.8 in dark — the wrong
direction, which is the defect in one line. The current fills are unchanged
and pass with 1.9× the hover step in both schemes.
The transcript colours a call by category, and the categories were reading off
the semantic palette: net for a network call, deleg for work sent out, accent
for a question that needs answering. Three of them say what their hue says.
Write did not. An edit_file was drawn in the same amber as the approval card
sitting four rows under it — one hue, two meanings, adjacent in the same
scroll, and the one that needs a person is the one that loses.
warn exists for exactly this. It was split out of accent on the grounds that
"琥珀是「该你了」，橙是「这一步有代价」", and a write is the second sentence.
The mark, the thread line, the timeline bar and the task board's dot all move
together, because a category is one decision rendered in four places.
The anchor label above the main model goes neutral in the same pass: an eyebrow
that appears on the page whatever its state is a label, not a state.
Same rule, the two places it had not reached. The section list filled the open
page with accent-wash, wrote its label and its value in accent-ink, turned the
icon amber on hover, and hung an accent bar off the left edge — five marks, one
of them a hue that means a decision is waiting. And every segmented control in
the product wrote its chosen option in accent-ink: the reading window, the date
range, the approval posture, all of them.
The list row now carries a fill, a ring and the bar together, because this
column lays --surface and hover already spends the one neutral step under it —
the same pairing the rail's project row uses, for the same reason. The chosen
segment keeps the raised chip and the shadow it always had and drops the hue:
the chip is the mark, and under it the postures that really are coloured (全部
放行 in err) have room to be read as colour again.
The section's own icon loses its amber tile too. It appears on every page of
the sheet, so tinting it says "you are needed" nine times over, once per page.
Measured on a 1512px window: a card's prose starts 42px from the middle
column's left edge, the composer's caret at 37. Five pixels is not read as a
misalignment — it is read as "these two things are not part of the same
thing", which is the opposite of what a conversation is. The gap between the
prompt mark and the text is what sets that inset, so that is what moved; the
box, the mark and the guide line under it keep their places.
Three more edges in the same family. The rail's search field sat 10px in while
every row in the tree sits 12, and the account row at the foot sat 13 — three
gutters in a 264px column, none of them a decision. They are 12.
The shelf under the composer laid `--page` outright: 7.9 L below the input
surface in dark, 4.2 in light. A step that size stops reading as a floor and
starts reading as a seam between two widgets, which is what the hairline over
it was already saying on its own. Half a step now, in both schemes.
`--face-sunk` was 2 L below the page in dark and 0.8 below in light — the same
token cutting twice as deep in one scheme as the other, and in dark it landed
past the page it was supposedly cut down to, so machine output was the darkest
thing in the window. Both schemes now sit just under the page, and the visible
step is the one against the card the output is set into (3.9 L).
A session row carries rename and delete; the project row above it carries add
and delete. The add is a stroked path on Sym's 16-unit grid — it was moved off a
"+" character for a reason already written down beside it: "place-items 对齐的是
行盒，一个「+」字形在行盒里靠基线坐，看上去永远偏下". The other two were still
characters, and not even from the same face: `✎` at 11px out of the monospaced
stack, `×` at 15px out of the interface stack, under a 13px stroked plus.
Three hands in one column, and the heaviest of them is the destructive one on
every row: delete is drawn 40% larger than rename, so what the eye lands on
first, down the whole list, is the one that removes things.
Both are paths now, on the same grid at the same 1.5 stroke, in the same 20px
box, and the shared `.wsdel` covers the project row and the remote list too. The
opacity rule that keeps them quiet rather than absent is untouched, and
perf/press.mjs still finds every control it did.
The interface's own scale exists because 24 sizes with 442 declarations inside
the four steps between 10 and 11.5px read as nothing quite matching rather than
as one line outweighing another. Six steps replaced them, and a guard keeps a
seventh from being typed in.
That guard exempts `calc()` and `var(--read)`, because the reading size is a
setting rather than a step — and behind the exemption the reading column kept
exactly what the scale was introduced to end. The four heading levels an answer
is written with were `--read` +1.5 / +.5 / 0 / -.5 pixels: two pixels of range
around the body, in the one column a person reads a paragraph at a time. A
model writing `##` was producing structure the screen could not show, and long
answers arrived as one flat block of prose.
The levels are a ratio ladder now — 1.38 / 1.2 / 1.06 / 1 — so they hold at
every value of the reading size, which is the reason the sizes were written
against it in the first place. At the default 14.5px that is 20 / 17.4 / 15.4 /
14.5. Nothing else about them changes: the weight, the colour and the margins
that bind a heading to the text under it are the ones they had.
The guard grows the case it was missing. It fails a ladder whose steps are
closer than 1.05 apart, and a top level that does not outweigh the body by
1.25 — checked by putting h2 back within a step of h1, which reproduces the
flat reading exactly.
The palette assigns one job per hue, and the file says so at the top: accent is
"需要你介入". Two of the largest painted areas in the window were spending it on
navigation state. The icon column filled the current page with accent-wash and
drew an accent bar beside it; the rail filled the open project's whole two-line
row with a mix of accent-wash and 9% accent, and hung a 8px glow off its bar.
Neither is a decision waiting for anyone. Both are on screen the entire session.
What that cost is visible with an approval on screen: the card that does need a
person was competing with a permanently amber row and a permanently amber chip,
in the same hue, two of them larger than it.
The session rows had already worked this out one level down — "拿它再说一遍『你
在看这条』，两个意思就分不开了" — and settled on a raised ground. Both places now
say it the same way. The ground carries in either scheme: +4.2 L over the rail
in light, +7.9 L in dark, which is the step the rail's own selected session row
has been using.
The project row also loses its bar. A fill, an inset ring and a bar are one
state said three times, and that bar was square against a 9px corner, so it cut
a notch out of the left edge of the row it was marking. Two levels are still two
levels: the indent and the weight already say which is which.
Amber left in the interface: the approval card, the pill that says a turn is
waiting, the stop button, and the pip on a session that is holding for you.
The side panel's cost figure and the connection panel's model rows are both
`.mrow`. Two components, one class — and the second definition only overrides
what it lists: display, alignment, gap, min-height. The background, the 9/12
padding and the bottom hairline stayed the picker row's, so the one number that
side of the window is built around sat inside a white slab with a rule under it.
Read cold, that is an input field nobody filled in.
The metrics row takes a name of its own, `.mtop`, and the figure sits on the
panel's own ground with the sub-label beside it. The picker keeps `.mrow` and is
untouched; the size, the tabular numerals and the second-currency step are the
ones it already had.
A name is an interface. Nothing warns when two components pick the same one —
the collision only shows up as chrome the second component never asked for.
Swept the ports for capabilities the frontend cannot reach. frontend-parity
reports 150 missing edges, but every one has some frontend driving it — there is
no capability nobody can use. The sharper question is which of serve's 163
routes no client calls, and that turned up four. One of them matters.
POST /update/health had a handler, a capability behind it, and no caller
anywhere in the tree — not the page, not the Electron main process, not the
host. Its own comment says what it is for: "the swap is performed by a process
that cannot judge it. This is the other half: the application that booted from
the replacement says it is working, and only then is the rollback material
retired."
Nothing said it. So pending-update.json and the backup bundle were never
retired, ensureNoPendingUpdate found a transaction it judged live, and every
install after the first refused with "a pending update already exists" —
permanently, per machine, starting the first time self-update worked. The
release line is on this path now: cmd/reasonix-studio-host builds the capability
and runs MaybeRunMacHandoff, so legs one and two are in place and only the
acknowledgement was missing.
Said from the page, not the shell. A window that opened and then failed to
render is exactly the case the rollback is kept for, and only the page knows it
got past that. Two seconds of probation first, the same wait the old desktop
used and for the same reason, and nothing at all while onboarding is still on
screen: an application still asking for a key is one the user cannot use, and
retiring the way back from inside it discards the rollback on a launch that has
proven nothing.
Silent on failure both ways. Nobody asked for this, there is nothing to do about
it, and the two ordinary answers are non-events — a kernel with no update
capability has no route, and a launch that booted from no update has nothing to
retire.
Two tests, and the first fails against the previous tree with "never
acknowledged; the transaction stays open". The second pins the onboarding case,
which is the one an eager implementation gets wrong.
The other three unreferenced routes are recorded but not acted on here:
GET /branches (session branch tree — no switch endpoint exists either, so the
feature is unreachable from Studio rather than half-wired), GET
/extensions/actions, and POST /auto-approve-tools.
Swept every browser-layer guard looking for regressions. Found none — what the
sweep found was four assertions that had drifted off the thing they name, three
of them red for long enough that the failure had become the expected output.
lang.mjs認词，and the words expired. It had already been rewritten once when
Metrics / Pending changes / Agents and tools disappeared; the replacements —
Prefix cache, Activity, Workspaces, Worktree changes — are gone the same way.
The tab strip has said Conversation / Task for a while, and the other three
blocks do not render under this fixture at all. Every red one was the guard,
never the interface. It now reads structure: the same label elements in both
languages, present in both, differing position by position, with no Chinese
left on the English side. Panels may be renamed or added and it keeps up.
look.mjs died on the first thing a user would actually do — typing a font name.
The two font slots live inside the "advanced" details, and a closed details is
not rendered, so the element resolved and was never visible. The eight
assertions before it passed because they click through page.evaluate and the DOM
click does not check visibility. Opens it first, and says so as its own check.
verify.mjs waited on a rewind button that could not appear. The entry point
attaches only to a row that claims a message (state/checkpoints: no claim, no
entry, because a rewind cannot be undone), the claim arrives with msgIndex on
turn_started, and this harness exists precisely so the fixture's own frames
never reach the UI — BenchPort overrides subscribe. The driver has to feed that
frame like every other. Feeding it, the button appears immediately.
That timeout had been hiding the last one: the trajectory view is no longer on
the tab strip. Timeline, event trajectory and run graph moved into the "run
details" picker, so nth(1) was clicking Task and counting rows in a page with no
table.traj — zero, every time, and never once reached.
No product defect behind any of them. Two new assertions fall out of the fixes:
the advanced block opens, and a rewind entry lands on the turn it claims.
Asked how to stop the two lists from drifting. They should not have been two
lists — and proving it turned up the half of the previous fix that was missing.
Three places knew "this tool's authorization reads its subject": the branch in
subjectRequiresHuman, the subjectScopedTools table, and a copy in the test. I
had just fixed the no-approver hole in one of them, for the write fence only.
So this was still true, and had been all along:
install_source, apply, planId "high:..."
Decide → ask (the grading works)
Approver == nil → allow=true (nobody ever sees the plan)
That is the case the grading exists for. A high-risk self-extension plan — a
resident process, a lifecycle hook, an external server — was granted silently
under YOLO, which is built with no approver at all. Older than this branch, and
worse than the fence hole I found first.
Membership in subjectSensitiveTools is now the single declaration, and it
carries all three consequences, so a tool cannot arrive with one and not the
others: Decide returns Ask whatever the fallback says, unattendedAsk refuses
rather than answering for the absent person, and a session grant must name the
subject it covers. Adding a fourth tool is one map entry.
The convergence is real rather than a layer beside the old one: widensWriteFence
had no callers left afterwards and is gone. The test that was the third copy is
now a guard over the declaration — it fails an empty table (a guard that would
pass by examining nothing) and an entry whose question is never true for any
probed subject, which would sit there looking like protection while granting
none.
Both new cases fail against the previous commit: the high-risk plan is granted
with no approver, and reverting unattendedAsk to the fence-only check reproduces
it exactly. A low-risk plan still runs unattended — the grade decides, not the
tool — and a plan-only call still reads as the preview it is, allowed before Ask
is reached.
The previous commit stopped recording bare-tool grants for the two tools whose
authorization reads their subject. It left the ones already recorded alone, on
the reasoning that they were what the user granted and rewriting them would be
deciding on their behalf.
That reasoning is wrong, and the direction it gets wrong matters. When the user
pressed "don't ask again" they were looking at one install plan, or one path.
That is what they answered about. The bare-tool rule is not their answer written
down — it is their answer widened by the code that recorded it. Keeping it is
what carries a decision they never made: every later plan, including a high-risk
one they would have been shown, is covered by a yes they gave to something else.
Migrating is not available — which subject it was given for is not in the rule,
which is the whole defect. So the check moves to the read side:
SessionGrantMatches refuses a bare grant for a subject-scoped tool, and the
question is asked once more. One extra prompt, for a decision that was never
taken.
Scope, deliberately: this is only the session-grant path, the one the code
widened by itself. A rule the user wrote in their config is their own sentence —
`allow = ["install_source"]` means what it says, goes through the policy, and
is untouched here.
Against the previous code the new test prints the stale rule it objects to and
the three subjects it still covered.
Chasing whether the fence widening this branch added could be opened wholesale
by one click. It could — and so could the self-extension grading that was
already here, the same way and for the same reason.
SessionGrantRuleForScope keeps the subject for bash (a command prefix) and
folds the file tools into one Edit grant. Everything else fell through to the
bare tool name, and a bare-tool rule matches every subject that tool will ever
have. Measured before the fix:
granting extend_write_paths /ws/internal/foo/bar.go → rule "extend_write_paths"
matches /home/user/.ssh/authorized_keys → true
matches /ws/.git/hooks/pre-commit → true
granting install_source low:sha256:abc → rule "install_source"
matches high:sha256:def → true
The second one is older than this branch and is the more serious of the two. The
whole point of grading an install plan is that a high-risk ticket returns to a
person even under a blanket allow; sessionGrantAllowsLocked is consulted before
that check, so approving one harmless low-risk plan disarmed the grade for the
rest of the session. Nobody was ever shown the high-risk plan.
A tool whose authorization reads its subject cannot be granted by name. The two
that do are named in one table, and the grant rule carries the subject for them:
"extend_write_paths=/ws/internal/foo/bar.go" covers that file and no other.
TestEverySubjectSensitiveToolIsSubjectScoped is the guard over the table —
a tool that requires a human for some subject but grants by bare name fails it,
which is how this would otherwise come back.
Both new tests fail against the previous code with the rule they objected to
printed in the message, and the guard fails if either list drifts.
Not fixed here, and worth naming: grants already persisted in a session's
authorizations keep their old bare-tool form, and those still match everything.
They are what the user granted under the old shape; rewriting them would be
deciding on their behalf what they had approved.
What a run must touch is not always knowable before it has read anything. A
write_paths declaration could only be made up front, so every such discovery was
terminal for that file: the tool refused with "outside this subagent's declared
write_paths", which told the run neither who could change that nor where to put
the need. It worked around it or gave up.
It now asks. The question goes to the user — never to the parent, because the
parent is a model and a model approving its own reach is not a fence — and it
goes through the gate every other permission goes through, the one a delegated
run already shares with its parent (task.go hands it t.gate). Nothing new
carries the request: widening is a capability, and permission is the axis
capabilities live on. It is not an ask (that axis is for what only a user can
tell us) and not a plan decision (that axis is workflow).
Widening returns to the user under every fallback posture, on the same yardstick
install_source already used: subjectRequiresHuman. "Allow every write" is a
statement about this workspace's files, never that a run may redraw the boundary
it was given. An explicit allow rule for the path still wins — that is how the
line gets moved deliberately rather than by a posture nobody re-read.
WriteGrant keeps declared and granted apart, because only the declared set can
be proven non-overlapping before anything starts; nothing added later can join a
proof against runs already going. So scheduling reads Declared() while the audit
reads Scope(), and a granted path does not surface as a write that escaped its
claim. Every write outside the declared set also reserves through the scheduler
for the length of the call: a grant says this run may be here, never that
another may not. The reservation is a try, never a wait — a caller inside a tool
call already holding paths is the shape a deadlock needs.
The security review of this change found a hole in its own first draft, and the
fix is the reason unattendedAsk exists. Ask is fail-open when no approver is
attached ("preserve autonomy"), and YOLO is built with exactly that — nil. So
the fence question would have answered itself under the one posture that most
needed a person, leaving confinement weaker than before it was a question at
all. Autonomy is a statement about a posture with nobody watching; it is not
permission to move a boundary. TestWideningIsRefusedWhenThereIsNobodyToAsk fails
against the draft and passes here.
The adversarial tests are unchanged in substance and still pass: a symlink, a
traversal and a move destination are compared after resolution, so the path put
to the user is where the write would land, and their fixture binds no gate —
which is the case they were always about. With nobody to ask, nothing widens.
"占用了我打开又如何呢" — and the answer is that opening it was never the
problem. The lease exists so two windows cannot write the same transcript back
over each other: each holds its own in-memory copy, and Hub.Close and resume
both Snapshot theirs on the way out, so the one that closes second erases
whatever the other produced meanwhile. That is a real way to lose a
conversation. It is also entirely about the write-back. Reading is not that,
and the session you most want to read is the one you can see running.
So a pane attaches instead of demanding. SessionLeaseKeeper.Attach takes the
lease when it is free and reports that it did; when a live runtime holds it,
the pane opens with no lease and no authority bound. The guard does not move —
it was already in the right place and was simply being duplicated at the door.
Turn admission goes through ensureWriteAuthorityReady, and every save through
requireWriteAuthorityForSave; neither has anything to present without a lease,
so a read-only pane cannot reach the transcript at all. Callers that are about
to write (chat, run, bot, switch-model) keep Rebind, where read-only is not an
answer.
RuntimeView carries the state rather than leaving the composer to discover it
by being refused: derived from the keeper, not stored, because the keeper
either holds that path or it does not. The composer says so in the placeholder
and takes no line.
The tests that asserted the old refusal are not deleted — they move to the
boundary that still holds. control.TestReadOnlyAttachmentCannotWriteTheTranscript
is the one that matters: attach read-only over a live holder, save, and the
save must fail with ErrSessionWriteAuthorityMissing and the file must come back
byte-identical. If that ever passes silently, the lost update is back.
Worth saying what this does not touch, because the two get the same word: two
different sessions writing one workspace already queue rather than refuse
(internal/workspacelease — readers never wait, and an agent team is not
serialized there at all, SubagentScheduler claims write paths instead). This is
the other thing entirely: one conversation, two windows, and no second writer
to coordinate with.
Reported as ugly. It placed each mark at its message's position in the whole
transcript, so the rail drew how much each turn produced rather than the list of
what was asked: a turn that ran twenty tools landed ten times further from its
neighbour than one that ran two. Measured on a session of mixed turn lengths,
gaps ran from 14px to 171px, σ=56 — clumps too tight to aim at, then nothing.
Two workarounds had grown on top of it: a neighbour-nudge for when marks landed
within 46px of each other, and a 120px aim radius to find one at all.
Marks now sit together in the middle at a fixed 9px step, clamped to the track
when there are enough of them to need it (300 marks land on a 2.21px step and
stay inside it). Where the reader is in the record is what the viewport box
already says; this is the list, in order, one step each.
Length and weight are a falloff from whichever mark the pointer has picked out,
and every mark is identical until one is. A cosine, not a line: a linear
falloff has a corner at the focus, which reads as the neighbours being a
different kind of thing rather than the same thing further away. Measured
across the three states — at rest every mark is 11px at .30; on the pane, 11px
at .46; with the pointer on the rail, 11·11·12·16·21·25·26·25·21·16·12·11·11
and .46 up to 1.00 and back.
The size no longer tracks how many files that turn touched. That put a column
of equal entry points at unequal lengths to say something the hover preview
says in words a few pixels away.
One thing the cluster broke and this restores: ⌘↑/↓ picked its starting mark by
comparing rail geometry against scroll progress. The rail is a cluster in the
middle now and its geometry says nothing about how far down the record a mark
is, so the walk starts from the message's own position in the transcript.
Reported as the scrollbar jumping back on its own. The native bar is hidden —
the rail's viewport box has been the only scroll indicator this transcript has
since it took that job — and the box is placed at scrollTop over scrollHeight.
Neither of those is wrong; the height under them was.
A block nobody has scrolled to yet stands in for its own height, and it stood
in at 96px an entry. The shortest card that exists measures 119, the median 199
and the mean 216 — the numbers are already written down one file over, beside
the identical fix made to a card's contain-intrinsic-size, where the note ends
"the scroller always landed short, then corrected, which is the jerk". The block
placeholder was left on the old number.
Measured, scrolling back through 300 turns: the content grew 18393px (+20%)
under the reader, and the indicator slid down three times while they scrolled
up, worst 48.8px on a 713px rail. The content itself never moved — scroll
anchoring does its job, and scrollTop rising by exactly the height added is that
compensation, not the defect. Only the ratio the indicator divides moved.
The estimate is now learned from this transcript's own blocks, a running mean
over a bounded window, seeded at the measured 216. Card heights differ by an
order of magnitude between a one-line read and a twenty-line diff, so no
constant was ever going to fit both; what fits is whatever this conversation
turns out to be made of.
After: content growth 18393px → 1113px (-94%), indicator reversals 3 → 0, worst
0.5px. Holds at 1200 turns: 1229px, zero reversals.
Reported: delete a conversation, click another one in the same project, and it
comes back "held elsewhere — close it there first". The log of a real window
has the shape of it:
POST /runtimes/r1/close 204 the deleted one's pane, closed first
POST /tree/sessions/remove 204 the delete itself
POST /runtimes 409 the next click
POST /runtimes 200 the same click, seconds later
resumeInto returns (status, error), and its doc says why: "answering with the
status a refusal deserves so both the HTTP handler and a hub opening a session
in a new pane refuse for the same reasons". /resume passes that status to
writeErr. Open discarded it into `_`, and openRuntime passed 409 as the
fallback for everything — so every failure with no code of its own arrived as
Conflict, which the frontend renders as in-use. A transcript the list still
showed and the disk no longer had reported as one another window was writing.
So did a provider the kernel could not resolve.
Open now keeps the status, and the catch-all becomes 500: what is left after
every coded refusal is a pane the kernel could not build, which is ours and not
a clash over the session. The path refusals in resumeInto were bare
errors.New — a status with no identity, which leaves the frontend printing the
kernel's English — and now carry session.bad_path and session.outside_dir,
both of which the frontend already had wording for. session.open_failed is the
one new code, for a failure that reaches the hub with no code of its own.
Two tests, and the pair matters: a deleted session must say it is gone, and a
session a live holder really is writing must still refuse as in-use — the fix
would otherwise have bought clarity by losing the guard. Against the old code
the first fails with "409: invalid session dir" and the second passes, which is
the old behaviour exactly: one answer for every outcome, right by coincidence
in the single case that was actually a conflict.
A listing the assistant wrote rendered in the box every tool result renders in.
Not similar — identical: both fills measured the same value, so nothing on
screen separated what was said from what was run. The step meant to sink them
was mixed against --raised while the column lays --surface, which left 2.7 L in
dark and 2.2 in light, and a code block all but dissolved into the page.
Two faces are declared instead, and they separate by different means. Machine
output takes the step, now cut properly into the ground: ΔL 2.7 → 5.7 dark,
2.2 → 3.9 light. A listing takes a line, which is also the half that survives
in light, where there is no room left above --surface to raise anything. Between
the two, ΔL 0 → 3.2 dark and 2.6 light. The listing carries its language and a
copy of its own, the corner handing one to the other under the pointer; where
there is no pointer the control stands and the language gives the corner up.
The answer's mark on the rail was a 1.5 stroke at --ghost: "not a button"
carried all the way to "not there", on the one thing in the column that holds
the turn. Filled, in the reading ink, plus the run its cell failed to cover —
a mark that does not fill its cell reads as the line having stopped. The two
labels naming the speaker are gone; the mark says it a column to the left, on
the same line. The row they sat in stays for what only it can carry.
The prose's copy had the paragraph's own left edge and nothing else, which is
what made it read as a stray list item rather than an offer. It gets the mark,
the prose's exact left edge, a ground that arrives under the pointer, and the
tick where the offer was.
Two things found on the way, both older than this change:
perf/surface.mjs read oklch(0.156 0.015 255) as rgb/255, landing the hue in the
blue channel at full. Every fill in the tree returned 45.2, so every parent and
child matched, and equal fills are the one case it exempts — it has been passing
by examining nothing for as long as it has existed. Reading L directly, it found
.wsrow[data-open] at ΔL 0.8 in light: the fill half of "the fill says which row,
the bar says it from the edge" had never taken effect. Carrying a little of the
hue moves it off the ground in both schemes.
An unscoped `.acts`, written for the action at the end of a server row, wins on
source order over every other use of that class and was adding its row-end
margin to the transcript. Qualified here only; the other eleven uses have lived
with it and are not this change's to move.
Cost: five nodes per code block (20 blocks, 577 → 676), render unchanged at
2330 → 2284ms. 658 tests, eight browser guards, and an action census identical
to before at 101/24/8/79.
The file was written when the version was one fix. It now carries three, and
notes that describe a third of a release are worse than none: a reader who
reads them decides they have seen the change list.
Reported as the interface looking stuck while a command runs. Measured first,
because "stuck" is two different defects and only one of them is a defect.
The thread is not blocked. Over an 18s turn the fixture produced one long task
of 131ms, and switching views mid-run answered in 62-71ms across six presses.
Nothing there needs fixing.
What is wrong is that the wait says nothing. Sampling every running call's own
card: four calls under 600ms went through one distinct text each, and the 7.4s
call through four — 0.41 changes a second. The only motion on a running call is
sympulse, a 1.9s breath on a 14px glyph, and a pulse reads the same at two
seconds as at two minutes. A command that runs for half a minute therefore
draws one unchanged line for half a minute, which is indistinguishable from a
window that has died.
So the wait reports its own length. It lands in the slot the settled duration
already uses, so when the call ends the number stops rather than a different
value appearing in a different place. Under a second nothing is drawn: a call
that answers that fast never looked stuck, and a digit that appears and leaves
is its own noise. No bar while it runs — the bar is a length against a known
duration, and growing one against a duration nobody knows yet is a progress bar
that cannot be honest about the fraction it has drawn.
The kernel's startedAt is deliberately not the source. It is unix ms on the
kernel's clock, and over a remote session that is not this window's, so
counting from it would spend a clock skew as elapsed time. This counts on the
window's own clock from when the window saw the call running, and says nothing
about a call that was already running when it arrived — that is a duration this
window does not know.
Measured again after: the 7.4s call goes from 4 distinct texts to 11, and the
four sub-second calls stay at one each.
Also removes two reduced-motion rules that turn off a shimmer that no longer
exists — .shim has been a colour for some time, and a rule disabling an
animation nobody declares tells the next reader there is one.
Reported from use: with a transcript on screen, the 运行详情 menu opened under
the cards and its rows took no clicks.
Nothing in the transcript outranks it. The menu is z-index 30; a runtime scan
of every descendant of the scroller finds no z-index at all above 5, and the
stylesheet agrees. So the transcript was never being compared against 30 —
the menu's level was already spent inside an ancestor of the bar. A stacking
context anywhere above holds the whole menu at that ancestor's level, and the
scroller, the later sibling, then paints over it and takes the presses. Two
things in this tree make one without saying so: an entrance animation's fill
transform and a card's paint containment. RewindControl's menu was moved out
of the flow for this same reason, and its comment says so.
Which ancestor it is here is not established: eight states at the reporter's
own window size, scrolled and zoomed, did not reproduce it, so this does not
claim to name one. What it removes is the dependency. The menu is rendered
into the body, where its level is its own, and that holds whatever forms a
context above the bar tomorrow.
Position is therefore measured instead of anchored. The layout box, not the
client rect: the entrance transition's scaleY is running while this measures,
and placing the menu by a size it is on its way out of put it 6px off. The
anchor rules stay for the composer's policy menu, which is not a Picker.
Alignment moves from the stylesheet to the call site, since there is no
positioned ancestor left for a selector to reach through.
Verified in a browser at 2000x1080 and again at zoom 1.25: all three Pickers
sit at the same offsets the CSS used to give them, right-aligned on the bar
and left-aligned in the composer, none clipped by the viewport. The guard
asserts the menu is not under the trigger, not that today's ancestors are
innocent.
The bullets had been written by translating commit subjects, which are
deliberately aphoristic in English and become spoken-register couplets in
Chinese — "先有账单，再有决定", "按下要有回答". A release note is not the place
for that form. Each entry now leads with the technical claim and carries the
mechanism, the identifiers and the measurements, the way 2.12.0's and 2.13.0's
notes do.
One fix, and the one thing a reader has to know that the fix cannot do for
them: the window updating into 2.14.1 is still holding 2.14.0's document, so
this update is the last one that can show the blank screen.
Found by clicking 设置 against a window whose assets had been rebuilt under it:
the whole screen went white. The document that window was holding asks for the
chunk name it was built with, the rebuild had written a different one, and the
404 rejects the promise lazy() is waiting on. A rejected import throws during
render, and there was nothing above it to catch the throw — so React unmounted
the tree and took the window with it.
This is not only a development accident. Studio updates in place: the .deb
replaces the SPA tree under a running window, and any window that outlives an
update is holding names that no longer exist. Opening settings is then the
first thing that asks for one.
The tree already answers this exactly once. The transcript's markdown is
deferred the same way, and its call site wraps the boundary in Boundary so a
throw costs one message its formatting rather than the window — Boundary's own
comment says why. The settings chunk is the other deferred route and had a
Suspense with nothing behind it.
It now falls back to the settings overlay saying the screen did not arrive,
offering the reload that actually repairs a stale document and a close that
gives the window back. chrome.reload is registered because the census holds
what a person can do here, and closing the panel unmounts the boundary, so a
second attempt is a fresh one.
The test renders App with the module mocked to throw, which is what a missing
chunk does to the import, and asserts the panel appears with the window still
mounted behind it. Run against the code without the fix it fails on both.
Committed before the tag rather than after it. 2.13.0's notes landed after
studio-v2.13.0, so the push-triggered run read a tag that did not carry the
file and would have published the standing text alone.
The case named "the system temp root itself" was written as /private/tmp,
which is the temp root on macOS and an ordinary path everywhere else. On
Windows the slug under test came out -private-tmp-run while the tool derives
its scratch slugs through filepath.Abs, which qualifies that path with the
current drive, so the test failed on a tool that was behaving correctly.
The case now reads the host's own temp root, which is what the surrounding
comment already claims the check does. The second name a root may be reached
by keeps its own case, run only where resolving /tmp lands somewhere else —
comparing the resolved path rather than the string, because EvalSymlinks
returns \tmp for /tmp on Windows and a spelling is not a second root.
The composer's paste handler reaches port.attach through attach and upload,
so pasting an image sends its bytes to the host exactly as the picker does.
The root carried no action id, which is the one thing the census exists to
refuse: an input proven to write with nothing naming it.
It takes session.attach, the id the picker's button and the file input
already carry. The registry's note on that entry — the bytes reach the host
as the file is chosen, before anything is sent — is the same fact about this
root, and a paste that becomes a chip is the same intent arriving by another
modality.
Splitting the settings page out behind lazy() took every action on it out of
the census's product graph: 75 ids the registry declares came back as having
no production root, and seal D failed on a tree where nothing had actually
gone unreached.
The walk does read dynamic imports — it looks for a call whose callee is
named Import, which is how @babel/parser 7 spelled one. Version 8 spells it
ImportExpression, with the specifier on .source rather than in .arguments, so
that branch has matched nothing since the parser was upgraded. It cost
nothing while every route was imported statically, and the first lazy
boundary in the tree is what made it visible.
Reading the node the parser actually produces puts the settings subtree back
in the graph: orphans 75 to 0, and the inputs it contributes rejoin the
denominator the open seals are measured against — B moves 55 to 79 because
those inputs were never being counted, not because any of them changed.
Measured first. A machine, a project inside it and a conversation inside that
were drawn at 13px each; the machine and the project both started at the rail's
edge; and the project's row was 52px against the machine's 47, so row height
denied the order it was meant to express. A selected project carried four marks
at once — fill, ring, bar, and an accent dot — none of them the main one. The
leaf's title, the only thing on its row that cannot be read anywhere else, held
87px of 201 while needing 210.
Depth now says the level: 0 / 12 / 37px of indent, weights semi / medium /
regular, heights 47 / 46 / 30. The leaf steps down one size on the scale rather
than two, because indent and weight carry the hierarchy and type has a floor to
respect.
The leaf's two controls leave the layout and keep the screen: placed one after
the other over the row's tail, still visible at rest, no longer holding 38px of
the title's width. The count drops its unit — every row on the list is in
turns, so the row says the number and its title says what it counts. Measured
result: the title goes from 87px to 128px, and with the rail's default at 264px
rather than 236 it renders about eleven Han characters where it rendered five.
A state says itself twice, not four times: the fill names the row, the bar
names it from the edge the eye is already travelling. The dot goes back to
neutral — it was this state's only visible mark when data-open changed nothing
but a text colour, and it has had three companions since.
Acceptance was the four numbers stated when this was proposed: title width
87 → 128, heights monotone 47/46/30, state marks 4 → 2, and overflowing boxes
unchanged at 35 before and after.
perf/panels.mjs carried its own copy of the rail's default and failed on all
three of its width checks the moment that default moved — the copy described
the rail until someone changed it, and then described nothing while still
failing. It reads RAIL and SIDE out of Gutter.tsx, which is where a span is
declared.
The checks these guards print were worded in a spoken register — 吃指针的控件,
按下去没有任何回答, 没量到卡片 — while the interface they guard was swept into
written Chinese for the reason upstream recorded: a spoken register reads as
unserious in something that states what software does. A report about the work
should not be looser than the text inside it.
Twelve check names and their detail lines rewritten. The two Chinese block
comments still left in perf/intrinsic.mjs and perf/pick.mjs are English now,
which is where comments in this tree belong.
No behaviour changes: every guard was run before and after, and all five pass
on the same measurements.
Reported from use: over SSH the session title never came across. It did come
across — once, at connect, before the session had one. The far kernel names a
session when its first turn ends, and nothing re-read the book after that, so
the row kept the name the session had before it had a name for as long as the
window stayed open.
This machine's tree is re-read whenever the pane list comes back, which is how
the window hears that a turn ended — Pane says so on purpose, and the comment
there has always said why: "when the turn ends, that is when it has a generated
title and a turn count". The far books were held inside the remote column with
their own trigger, the set of connected hosts, which does not change when a
turn ends. One beat for this machine, another for every other.
The books move to one owner. useMachineBooks holds every connected machine's,
answers with a single reload, and reads a machine's book when it connects; the
window calls that reload beside the local one, on the beat it already had. The
column draws what it is handed. That is the rule this tree already states for
projections — whoever owns a dynamic fact owns the invalidation that makes it
owed again — and the far book had been kept fresh by a trigger that belonged to
something else.
Three tests: the title read at connect, the title arriving on a re-read, and
the wiring itself — that the pane-list path re-reads both books, because the
defect was never in the reading, it was that nothing asked. Each was run
against the code without the fix: the last one fails alone when the far re-read
is removed.
Rename and delete sat at opacity 0 until the row was hovered, and they reserved
their width the whole time — 38px of a 201px row, plus the gaps around them,
spent on two controls nobody could see. The workspace row directly above keeps
its own actions visible at rest, so the same list drew the same kind of thing
two ways, and the invisible half was the one that also cost the title its room.
They rest at .45 and come up on hover and focus as before. The width was always
theirs, so nothing moves; what changes is that the row now says what can be
done to it.
perf/press.mjs gains the rule, and it is a narrow one on purpose: a control
that reserves space and paints nothing. Measured before writing it — the whole
screen had exactly these two kinds, 18 of each, one pair per session row — so
it starts green everywhere else rather than arriving with a backlog.
Not fixed here, and worth saying: the title still gets 87px of that row while
it needs 210, so six sessions in one workspace can read as the same truncated
string. Reclaiming that is a layout decision — a second line, a wider rail, or
fewer controls on the row — and it is not this commit's to make.
The bar on the selected row was an inset shadow, so it followed the row's 6px
corner and curved into a crescent. The rail draws the same idea on the
workspace a pane is open in — an absolutely placed 2px bar, inset from top and
bottom, with an end of its own — and that is the shape a reader already knows
here. One idea, two drawings, and the menu had the one that bends.
The value pickers had no bar at all: a hue change on a 6px dot was the whole
mark for "this is the model you are on". The stylesheet's own note beside the
completion menu says why that does not work — the eye resolves area, not a hue
shift on a dot — and it said so while the pickers two hundred lines up were
doing exactly that. They take the same fill and the same bar now, because they
answer the same question: which one is it right now.
perf/pick.mjs was reading the bar as "the row has any box-shadow", which is a
proxy for a drawing rather than for the mark — it would have passed a row whose
shadow was anything at all, and failed this change for no reason. It measures
the mark: a painted element under 4px wide against the row's left edge, with
the old spelling still accepted. Run against a row with the bar removed it
fails all four menus.
Reported as the content twitching up and down while a reply comes back, and
narrowed to the moment an ask appears. Measured on the running page: at the
frame the ask lands the transcript moves 108px one way, and on the very next
frame 561px the other. One beat down, one beat up — which is what the eye reads
as a shake rather than as something arriving.
What grew in that frame names the cause exactly: two .call cards went from 96px
to 325px and 428px. 96px is the fallback in contain-intrinsic-size, the height
an off-screen card is assumed to have until it is laid out for the first time.
The `auto` keyword covers every card the reader has already reached, so this
only ever applied to cards never scrolled to — and the fallback was below the
shortest card that exists. Measured across a 40-turn transcript: min 119,
median 199, mean 216. Every unseen card was underestimated, so the error
accumulated in one direction: the scroller computed a bottom from estimates,
landed short, and corrected once they resolved.
The fallback is the measured mean now. Same page, same ask: direction reversals
2 → 0, backwards scroll 108px → 0px, worst single-frame shift 561px → 321px —
and what is left is the card arriving, one movement in one direction.
perf/intrinsic.mjs holds it by measuring rather than by remembering the number:
it walks a long transcript so every card lays out, then fails a fallback below
the shortest card or above the tallest. Run against 96px it says 96 < 119.
Ruled out along the way, each by measurement rather than by argument: the
reasoning block's auto-collapse (2 frames of 55, 26px), the entrance animation
(8 frames of motion, the 561px jump unchanged with it disabled), and block
virtualization (chunk count and placeholders unchanged across the jump).
The slash menu listed its built-in commands in English inside a Chinese window:
"compact context", "discard current context". The translations exist and always
did — messages_zh.go has every one of them — and nothing was reaching for them.
i18n.DetectLanguage is what points the process catalogue at a language, and it
is called from internal/cli and nowhere else. The Studio host never imported
i18n at all, so the kernel it assembles kept the English default that exists so
that code running before detection still has text. Everything the kernel
renders itself went to the window in that default: the built-in slash hints are
the ones a reader sees, and they were the ones reported.
The top-level language rather than the desktop's, because config.toml already
declares that split — Desktop.Language dresses the shell, the top-level one
dresses the kernel and what it says to the model — and a host is not the place
to redefine which authority owns which. With neither key set, as here, both
sides resolve from the OS locale and agree, which is the case that was broken.
Verified end to end: rebuilt the host, reopened the window, and the menu now
reads 压缩上下文 / 查看上下文窗口、阈值与上次维护结果. wiring_test.go holds it,
and was run against a resolution that ignores the config first — it names the
exact English sentence that was on screen.
Every button in the top-right of the shell was dead: the account button, the
icon buttons beside it, and the window's own minimize, maximize and close. The
title bar is the drag handle, -webkit-app-region inherits, and a control that
does not opt back out is drag surface — the OS takes the press and the page
never hears it, with nothing on screen to say why.
The opt-out had been there. 49b574687 removed .themer, a control that no longer
existed, and .themer happened to be the last selector of the list that carried
the declaration — so the block left with it and the two selectors above it were
swallowed by the next rule's comma. The comment above the rule went on saying
"every control on it opts back out" for two days while none of them did.
Membership is now what the markup says is interactive rather than the controls
someone remembered to list, so a new button on the bar is covered by existing
and deleting one takes nothing with it.
The check belongs in the shell and only there. In a plain browser the property
does not inherit — a child of a drag region computes "none" — so a page-level
guard cannot fail on this and would be worse than having none. It went into
test/smoke.js, which drives the real window, and it was run against the missing
rule first: it names button.thbtn, button.wc and the account button exactly.
Two defects met in one place. The composer draws stop and steer side by side
while a turn runs, and data-primary sat unconditionally on steer — so the
emphasis, the thing that answers "what would you press now", pointed at
interjecting rather than at stopping. And with an empty box the steer button is
display:none, since there is nothing to send: the single button on screen was
therefore 停下 drawn as a ghost, with no filled action anywhere.
Emphasis follows the running state now. Steering keeps its place as the
rightmost button, so that position always means "send what I typed", and it is
an Enter away with the footer saying so; stopping has no other way in.
perf/focus.mjs was reporting this as 插话 while a hidden button was what it
read: it selected .send, which was the answer only back when the composer had
one button. It reads [data-primary] instead — which button is emphasised is
the question it was always asking.
The rule also lands in composer-salience.test.tsx, because focus.mjs needs a
browser and does not run in CI; two of the browser gates were found red today
from wording and structure that moved under them months ago. Both were run
against the old markup first to watch them fail.
Every comment added over this pass was written in Chinese, which leaves the
tree with two voices in the same file and this branch adding to the half that
has to be read twice. All of them are English now, and the register goes with
the language: what the code does and why, not how it feels to use.
The gates keep their Chinese console output. Thirty of them print Chinese and a
reader runs them together, so switching three would make the report bilingual
rather than making it English. What those three print is now written rather
than spoken — 接受指针的控件 rather than 吃指针的, 按下后没有任何反馈 rather
than 按下去没有任何回答.
perf/reason.mjs is the one whose wording was load-bearing: it asserted a
specific Chinese sentence, and when upstream rewrote the interface into written
Chinese the assertion went stale and reported "中文界面不说中文" — a defect that
had not happened. It reads the expectation out of kernel.ts and en_kernel.ts
now, so a rewording moves both sides at once. That is the same rule the tree
already states for judgements: read structure, never wording.
Untouched and worth naming: 1027 Chinese comment lines across 93 frontend files
and 285 across 47 Go files predate this branch. Converting them is a sweep of
its own, not something to bury in a UI pass.
Merging the two panels left the search box filtering one of them. In two panels
that read as a local search; in one list it is a search that quietly skips most
of the list, and the half it skips looks like a half that is not there.
The word now belongs to the box that collects it rather than to either list:
RailSearch owns it, publishes it, and both lists read it. Lifting it into App
would have split "the box at the top of the rail" from "who uses it" across two
files, and leaving it where it was would have made the remote half ask the
local half for it.
Remote filtering follows the local rule exactly: a machine whose own name or
address matches keeps everything under it, otherwise only the folders and
conversations that match survive, and a machine with nothing left drops out.
One difference is deliberate — a machine that has not connected has only its
name to match on, because its projects are on the far side, and answering "not
here" for them would be this window answering on its behalf.
Folding follows too: a fold is a resting-state preference, and while a word is
being typed it hides the very rows that word just found. The local half has
always done this; both halves do now, including this machine's own group.
The box is a type=search at last, so it is announced as one, and the native
cancel button Chromium draws for that type is suppressed — this field already
draws its own, and two controls for one action is worse than either.
Five tests hold it, and all five were run against a disconnected query first to
watch them fail; a filter test that passes on an unfiltered list is the shape
of guard this repo has been bitten by before.
The rail drew two panels: 「工作区」 above, 「远程」 below, each with its own
caption, its own add button and its own idea of what a row is. But the hierarchy
underneath them was never two things — a remote workspace was already rendered
with the local workspace's own class, and opening a session in a folder is one
intent whichever machine the folder is on. What differed was only that local
skipped the machine level, because the machine was implied.
It is implied no longer: this machine is the first row in the list, shaped like
a host row and folding like one. A filled pip is a connection state and this
machine has none, so it carries a hollow ring — it is not connected, it is
here. The add button moves into the slot a host's already occupies, which makes
the two buttons one meaning: open a folder on this machine.
Both halves now render into a single role="tree". That was a correctness fix as
well as a visual one: every remote row already claimed role="treeitem" while
sitting outside any tree, so assistive technology was handed items belonging to
nothing. The hosts render as children of the tree that was already there rather
than App growing a wrapper, which keeps the search state where it is.
The line between the two sections goes with them. A rule that draws one there
says "above is local, below is remote", and that is the distinction being
withdrawn; machines separate by space, like everything else in the list.
Two renames follow the widened meaning: .rmthead is every machine's row and is
.machrow, .rmtpick is every machine's add and is .machpick. .addws and .rail-hd
and .rmtcap are gone with the captions they styled.
Known gap, unchanged by this: the search box still filters only this machine's
workspaces. In two panels that read as a local search; in one list it reads as
a search that quietly skips most of the list, and it is worth closing next.
205 border declarations against 16 uses of the float shadow: the interface
separated almost everything by drawing a line around it, which is what makes a
screen read as a table of cells rather than as things sitting on a surface.
Two containers in the flow drop the line and keep the fill — the user's own
message, which is the most-looked-at box in the app, and the settings block,
which the settings screen is made of. Floating layers keep their line: the
float shadow carries a ring in dark and nothing like it in light, so a menu
without a border smears into the page on one of the two themes.
Removing a border removes whatever was hanging off it, and two states were:
.grp:hover tinted the border and .grp:focus-within tinted it alongside a halo.
A state has to be said in the same vocabulary as the separation it modifies, so
hover lifts the fill and focus draws a ring, both still on the card tier. Left
as they were, hover would have done nothing at all — the third dead declaration
this pass has turned up, after var(--hover) and var(--shadow).
perf/surface.mjs is the gate, and it measures the thing the change actually
claims: a layer that separates by fill has to be a layer you can see. It reads
every rounded box's own fill and its nearest filled ancestor's, converts both
to OKLab lightness and fails a gap under 2. An identical fill is not a failure
— that is a box deliberately not claiming to be a layer, which is how an
unselected tab is drawn, and reading it as a defect was this gate's own first
bug.
24 sizes, and 442 of the 665 type declarations inside one 1.5px band: 11.5,
11, 10.5 and 10px, four steps separated by half a pixel. Half a pixel is not a
level — it is not read as "this line is heavier than that one", it is read as
"nothing here is quite the same as anything else", which is most of what makes
an interface look unconsidered next to one that was drawn. The conversation
body was never the problem: it has had its own token all along. Everything
around it was.
Six steps, widening as they go: 11 / 12 / 13 / 15 / 17 / 22, with --read left
where it is. The floor rises to 11px, which is where the smallest labels,
badges and table headers were living at 9 and 9.5 — dense Han strokes lose
their counters there before Latin does, and the large-text exemption that
excuses low contrast starts at 18.66px, so none of this was ever inside it.
Above 24px stays off the scale: a splash wordmark is one size for one thing,
not a step other text is measured against.
Measured rather than eyeballed, on the running page at 1440×900: the same 16
boxes overflow before and after, all of them ellipsis truncation and the
scrolling settings nav — the change introduced none. The one thing that did
move was the transcript's share of the pane at 1100×640, which fell to 39.8%
against a floor of 40%: bigger chrome eats fixed pixels, and at that height the
composer's auxiliary budget is what the gate says must yield rather than the
transcript. It yields 2vh, and the share comes back at 42%.
typescale.test.ts holds the scale on the stylesheet, with the same two guards
the motion rule needed: a coverage assertion so a renamed property cannot leave
it passing on nothing, and an exemption for calc() against --read, whose 1.5px
adjustment is not a size and had been read as one sitting below the floor.
Measured before changed: of the 42 pointer-taking controls the harness page
puts on screen, 21 showed nothing at all on mouse-down. Hover lit 179 rules and
press answered on 17, so the gap between pressing and the state changing was
empty — which is the half of "手感" that no amount of colour work reaches,
because the question being asked in that gap is "did it hear me".
The cause was membership, not intent: the pressed rule already existed and
listed nine class names, with a second copy of the same nine in a reduced-motion
block and a third, differently-spelled copy further up. Membership now comes
from what the markup says a control is — button, summary, a[href] and the
interactive roles — so a new control is covered by existing, and the classes
that want a different press (.thbtn, .seg button, .mode) say so in one
declaration instead of joining a list. --press carries the shape, which is what
lets reduced motion answer for all of them by changing one value rather than
repeating the set, and drops the !important the second copy needed.
The wash composites over whatever fill a control already has, so one rule
answers for a ghost icon and a filled row without knowing either. Full-width
rows take the push without the squeeze: a percentage on a 300px row moves its
far edge several pixels, on a 24px button a quarter of one.
perf/press.mjs holds it from the running DOM rather than from the stylesheet,
because the thing that rots here is the list, and a list is exactly what a
stylesheet cannot check. It also caught two of its own bugs worth keeping: a
disabled control owes no pressed state, and splitting a selector on commas
without counting parens shreds :is(...) into fragments that match nothing.
Three defects it turned up on the way:
- var(--hover) and var(--shadow) were never defined by anyone. CSS drops the
whole declaration in silence, so .mverify:hover and .mrefresh:hover — from
this branch's own model-verification work — did nothing at all, and the nav
tooltip had no shadow.
- .mrow was two things: a <button> in Models and a row of numbers in the cost
panel. The numbers inherited cursor:pointer and a hover fill, so the panel
claimed to be clickable. The layout stays on the class; the interaction
moved to button.mrow.
- transition-duration beside the shorthand escaped the tier migration. Both
are on tokens now, and the gate covers that spelling too.
tokens.css has carried three weights and said what they are for since it was
written, and the stylesheet ignored them: of 157 transitions, one used --m-*
and 156 typed a number. Fourteen distinct durations for four weights, with
.12 / .14 / .15 / .16 all meaning "a line just changed" — so the same change
ran at four speeds in four corners, which is what reads as an interface that
has not quite settled rather than as anything nameable.
191 transition segments and 33 short animations now take their duration from a
tier. Where the easing was already the tier's own, the pair collapses into
--m-line / --m-card / --m-panel / --m-exit; where the author chose --ease,
--ease-in or the spring deliberately, only the duration moves onto --t-* and
the curve stays. The split is not cosmetic: a transition's timing function *is*
its shape, so leaving it at the initial `ease` was the one decision nobody had
made, while a keyframe animation is often shaped inside its keyframes and
overwriting the curve there would apply easing twice.
--t-live joins them as the tier that is not a weight. Five fills were running
at .5s, .6s and .9s because a meter reports a rate rather than acknowledging an
action, and the three weights had nothing to say about that job. It is held to
a fill's own geometry, which is how a meter reports: the settings icon that had
drifted for .5s moved to --t-panel instead, since answering a hover on the live
tier answers it late.
Delays divide the same way. Under 100ms nobody is waiting for a weight, they
are offsetting a batch, so those become --m-step; the one real wait keeps its
tier. motion.test.tsx holds all of it on the stylesheet, with a coverage
assertion so a renamed property cannot leave the rule passing on an empty list.
Both sides of the update grew Settings.tsx and it landed at 802 lines, two over
the ceiling. The part that does not belong to drawing the sheet is the search
matcher: it reads SETTINGS, NAV and a row's aliases, all of which prefsnav
owns, and it answers a question about the catalogue rather than about the panel.
Upstream reworded the interface into written Chinese while this branch was
moving the composer's own strings out of en.ts, so the two halves met with the
screen asking for 不询问 and 全部放行 and the catalogue carrying 不打扰 and
全放行. The approval notes were invisible to the i18n guard on top of that:
Policy passes them through t() from a table, so a key with no English renders
Chinese in an English window and nothing fails. They now read as upstream
spells them, and the spoken copies the extraction left behind are gone.
Chinese is the key, so 手动添加 for a model the reader typed collided with
手动添加 for writing a hook by hand — one label, two English answers, which
TypeScript caught as a duplicate property. The model's provenance badge says
用户添加, beside 已配置, 现场探测 and 本次未返回, which are origins too.
Clicking all 121 non-destructive buttons in the app against a live kernel, then
asking of each one whether the screen said anything when the kernel turned it
down. One did not: 创建隔离副本 on the session page. run() had caught the
refusal and stored the reason correctly — but the banner that prints it was
copied onto the model and extension pages, and the session page writes the same
state with nowhere to show it. The banner moves to the column every page is
drawn into, which is where a Settings-wide state belongs; the two copies go.
The sweep's own criterion is worth stating: a 4xx is not a defect, since this
server declines several capabilities on purpose. A 4xx that leaves the screen
unchanged is. Everything else came back clean — no uncaught error, no crash,
no silent failure.
The copy pass that preceded this could have broken two things and did not, by
luck rather than by design: a skill row decided its mark by comparing the
rendered "调不到", and the session reducer compared "等待工作区" to know which
state it was leaving. Both are a sentence doing a second job, and a rewrite of
the sentence breaks them without failing anything — the row just stops being
marked. The skill row now returns reachability beside its text; the reducer
names the two values it also recognises.
wording.test.ts holds the rule at a ceiling of zero rather than a ratchet,
because the event that produces these is exactly the pass that just ran.
Comparing against a named constant passes; the literal at the comparison site
is what it refuses. It carries its own regression, four shapes it must catch
and five it must let through — a catalogue keyed by the text is a lookup, not
a judgement.
The settings screen went first; this is everything else the reader sees. 348
strings across 62 files, the same way: the Chinese that renders it and the
English catalogue keyed by it move together, so the i18n guard fails on any
key left half-moved.
Where it mattered most was the refusal catalogue. kernel.ts is what a reader
sees at the moment something did not work, and it was written to be overheard
rather than read: 八成粘错了东西, 这句话排到它后面了, 这边出了点问题, 先关掉再
移除. 156 refusals now state the condition and the action, which is the whole
job of that file — the code carries the identity, the sentence carries what to
do about it.
Then the transcript cards, which are the lines a reader passes every turn
(要动手了, 想了 12 秒, 这一趟没折叠掉什么), the run graph and queue, the
onboarding and welcome flow, the remote connect prompts including the host-key
warning, and the model picker.
English moved too where it was informal in the same way — contractions,
"approved writes just happen", "Next tidy-up", "I am R." — though most of its
second-person phrasing is ordinary for an English interface and was left alone.
Three strings printed raw rather than through t() and so had never moved with
the rest: the identity-service error on the signed-in account branch, and two
remote progress labels whose catalogue keys are now in step with them.
Assertions that pinned the old wording were updated with it: nine of them
across the graph, workspace, pane-close, remote-directory, trajectory, shell
and kernel tests, each one a test that reads the copy rather than the state.
The screen was written in spoken Chinese: verbs from conversation (测一下,
加一条, 开一份, 搬迁), sentence-final particles, and the reader addressed as 你
throughout. That register suits a chat transcript and reads as unserious in a
settings panel, where every line is a statement about what the software will
do.
274 strings rewritten into written Chinese across all 30 files the screen is
made of. Both sides of each move together — the Chinese that renders it and
the English catalogue keyed by it — which is what let this run as batches: the
i18n guard fails on any key whose translation was left behind, and it did,
twice, on catalogue keys written unquoted because Chinese is a valid
identifier. The rewriter now handles that spelling too.
Merges that fell out of it: 删掉/删除 and 加上/添加 were two spellings of one
label and are now one catalogue entry; 问我 became 请求确认 rather than 询问,
which the approval segment already uses for a different control.
Deliberately unchanged. Search keywords in prefsnav stay colloquial — they buy
discoverability and nothing else, and a reader hunting for a setting types the
word they would say. 这台机器 stays as the nav group: it was never the informal
part of that list, and folding it into 本机 would collide with the scope badge
that already means something narrower.
The workspace lease's package doc said it serializes Delivery writers. It does
not: the gate is plan.mutates at every role setting, and the lease is re-entrant
within a session, so parallel tool calls and concurrent subagents share one and
an agent team is never serialized by it. What schedules those is
SubagentScheduler, which claims write paths rather than the workspace. The doc
now says both.
Driving every control on the settings screen against a live kernel turned up
one fault with several faces: an answer that existed was not making it to the
person who needed it.
SseHttp.get threw a bare Error carrying a path and a status, while every write
went through fail() and kept the kernel's refusal code. So a read the kernel
had spelled out — "this server does not open account sign-in" — arrived as
"/account: 403", and the three panels that folded the failure back into their
initial null went on saying "loading…" about a question already answered, for
the rest of the session. Versions, Account and Memory now hold three states
rather than two, and say which one they are in. saveShell, installMcp,
removeMcp, removePlugin and dryRunHook hand-rolled the same throw and lose the
same code; they go through post0/del0 now, and del0 is post0's counterpart for
a DELETE whose answer is a payload.
Storage had a row whose own note says "every path is either actionable or says
why it is not" — and a server that refuses moves left it with neither. Memory
had no way out of an empty store at all: the panel reads, rewrites and removes
facts, and writing one is the composer's /remember, which the CLI's memory view
already points at and this page never named.
Escape was window-scoped, so the six inline forms inside the sheet closed the
whole sheet along with whatever had been typed into them. useEscape claims the
key in the capture phase the way useDismiss already did; both now declare the
registration through listenAction, which lowers the unnamed-input ceiling by
two rather than raising it by one.
The section list was a tablist with twelve tab stops, and closing the sheet
left focus on <body>. The switch pill was a 30x17 hit target, theme cards sat
on two baselines because a CJK name and a Latin one resolve `normal` line
height differently, and a workspace path broke through the middle of a number.
The locks storage root reported "0 B · 7871 files" under a heading that asks
how much is on disk: the count breaks down a size, so it now goes where there
is a size to break down. The files themselves are correct and deliberate — a
lock file outlives its use because deleting one breaks exclusion for a holder
that still has it open — but nothing said so at the decision, and a measured
run shows a fixed home adds none while each fresh REASONIX_HOME adds four.
Both notes now say it, to the reader and to the next person reading the code.
Seven guards, each checked by removing the fix and watching it fail.
Coverage repair answered a digest that forgot a changed file by summarizing the
same fold a second time. The facts it was recovering are host-owned — the
receipts already prove which paths were written and which commands failed — so
the correction was buying nine thousand tokens of transcript to recover a
filename the host could name for free. On the fixture P0-B measured, the same
fold both ways:
calls summary input summary output coverage
before 2 18,500 850 complete
after 1 9,000 400 complete
The correction now runs on what the host knows. backstopFoldCoverage already
existed and already ran immediately after the repair, writing the dropped paths
and command signatures into the digest itself; it was the fallback for folds
under hard pressure, where the repair path was skipped. It is now the only
correction there is, which makes the expensive path and the cheap path the same
path. Nothing about the first summary changes — not its prompt, not its output
budget, not the fold geometry — so the number above is a deletion and not a
trade.
The circuit breaker survives, and deliberately judges the digest rather than
the completed text. A summary that named none of the fold's changes is broken
whatever the host wrote in afterwards, and measuring the backstopped text
instead would have retired the one signal that says so — it can only ever find
the facts the host just added. What changed is the price of finding out:
refusing used to cost a second reading of the whole fold first.
CoverageRepaired went with it, everywhere it was carried. A digest needing a
second call is a state that can no longer occur, and the CLI card and the
Studio card both had a branch for it that would never fire again. The backstop
line already says the true thing: the facts are in the projection, just not
because the digest carried them.
P0-B's accounting is untouched and still gated on more than one call. No
production path bills a fold twice now, so the cases drive two calls inside one
transaction directly — whatever brings a second call back has to land in one
bill, and the ledger cross-check still holds it.
Three gates, each shown to make two calls against the code before this: a
dropped change costs one call and is in the installed text, what gets installed
drops nothing, and refusing a useless digest costs one call too.
/compact set Force, and Force was one bool doing five jobs: waive the trigger,
shrink the recent tail, skip the idempotence check, skip the new-history rule,
and skip the fold's own economics. Only the first two are what a person means
by asking. The other three are why typing the command twice bought two
summaries of a context nothing had been added to — the shape a user actually
meets, since this machine's own history shows automatic compaction firing once
in five thousand calls while every /compact fires by definition.
The bool is now two: a request waives the threshold, because asking is what
makes it manual, and waives economics only when the user says so. Both halves
matter. Setting Force to false would have kept the economics and lost the tail
shrink, leaving a command that does nothing at all below the trigger.
Measured in the project's own harness, one /compact per generation over six
generations:
fold calls summarizer input projection @gen6
before 6 96,654 18,311
after 3 79,890 33,594
-50% -17.3% +83.5%
The last column is the trade being made rather than a regression: folding only
when a fold pays for itself means holding more between folds, and 33.6k of a
128k window is what that costs. The three skipped generations were skipped
because a checkpoint costs the whole prefix cache and too little had closed
behind it to earn a second one.
Declining is now an answer. A manual noop returned rejectCheckpoint — an error,
carrying a sentence that said "no foldable region remains" whichever gate had
actually declined. It returns a verdict with the code the host already settled,
and CompactDeclineText turns that code into words for a caller with no phrase
of its own. Over HTTP the endpoint answers 200 with the code rather than the
204 that could not tell a fold from a session it decided not to pay for. The
verdict's Installed is a bool and not a CompactionOutcome because that enum's
zero value is "installed", and a verdict nobody filled in must not claim a fold.
Two smaller things fell out. acceptCheckpointCandidate had a branch that read
like a force exception and rejected exactly what the branch above it rejected;
a checkpoint landing back at the trigger has bought the next fold rather than
avoided one, and nobody may waive that. And the overflow paths passed Force
alongside a trigger that already implies both waivers.
/compact --force is the escape hatch and stays one: economics only, and it
still cannot land a candidate that is not smaller than what it replaces. The
five behaviours are gated, and the two that matter — a request over an
unchanged context, and one over a few hundred new tokens — were each shown to
buy a summarizer call against the code before this.
A compaction's telemetry read res.Usage — the usage of the answer it decided to
keep. A fold that needed a coverage repair makes two billed calls and keeps one
of them, so what the receipt reported was never the transaction:
the repair improved the digest reported 1200 in, the provider charged 2200
the repair improved nothing reported 1 call, the provider charged 2
the repair billed and then failed reported 1 call, the provider charged 2
The first row is the one worth staring at: adopting the retry replaced the whole
result, so the first call's tokens left with it. Driven through a real
compaction, an applied receipt reported 9500 input tokens against 18500 the
provider was paid — a maintenance under-reporting its own bill by half, in the
one record a cost display would read.
A transaction's bill is now accumulated where the charge is, in the deferred
emit inside summarize, beside the usage event the ledger receives. That
placement is the point: the paths that lost a call were the ones that discarded
its answer, and no call site can discard a charge it never handles. Both entries
that reach a summarizer open a transaction — compactToProjection and
compressVisibleRange, the second of which builds its own telemetry and would
have been the next thing to go unaccounted.
Calls and RequestAttempts are kept apart. A call the provider retried inside
itself is one summarizer call over several requests, and collapsing them loses
the retries while counting them as calls loses the shape. Calls counts billed
calls, which is what makes it comparable to the ledger.
The receipt carries the same total, because the receipt is what survives, and
its InputTokens is the context that was worked on rather than what the work
cost — the two are routinely orders apart, and reading the first as the second
is what made a compaction look like it had read 160k of anything.
The gate against future drift is the cross-check the cases all carry: a
transaction's bill and the usage ledger are two readings of the same charges
and may not disagree. Each case bills its two calls differently so a total that
silently describes one of them cannot pass, and each was shown to fail against
the previous accounting.
Cost stays out. Quoting belongs to the sink that already prices these events,
and internal/agent does not import internal/billing; a per-transaction figure
wants the receipt's OperationID on the usage events, which is its own change.
A tool result the model saw bounded reached the summarizer in full. Content is
the provider-visible body, capped at maxToolOutputBytes, and RawContent holds
the original beside it for local display and recall. projectMessages clears
RawContent for both ModelMessages and ProjectionMessages, so no provider ever
receives it — except that a summarizer call does not go through either. It
renders the stored messages into a user message, and renderTranscript preferred
RawContent, so compaction was the one path in the tree that put display-only
state into provider request bytes.
The cost of that is not marginal, because the bound it undoes is the one thing
keeping a large read out of a request. The same fold rendered both ways, through
the estimator the budget itself uses:
fold shape model saw summarizer got ratio
20 reads truncated from 300KB 164297 1536332 9.4x
20 reads truncated from 100KB 164297 512232 3.1x
50 mixed results truncated from 80KB 410739 1024639 2.5x
This is also why the size of a compaction did not follow from the size of the
session it compacted: a conversation is bounded per result, and this read the
copies those bounds had cut away. The first row does not even fit a 1M window,
so a fold a bounded transcript would have sent in one clean call was either
shortened first or refused outright.
Both routes into the request are closed, not just the rendering one.
shortenFoldForSummary sketched long bodies from RawContent as well, on the
reasoning that a digest should see the real outcome shape. A head-and-tail of
the full output is bounded, but its tail is material the conversation never
carried, and the digest becomes what the session remembers — so the sketch is
cut from the body the model was given. Recall is untouched and stays the
deliberate exception: it exists to answer with what actually ran, as a tool
result its own budget bounds.
summaryInputTokens shares the renderer, so a fold's measured size was already
counting the raw copies. It now measures what actually rides, which is what the
budget was always meant to be comparing against.
Three gates, each shown to fail against the code before it: the request never
carries a body the conversation did not, a longer local copy cannot move a
fold's measured size, and the shortening path sketches only what was sent.
A session's pricing completeness was one boolean, and an aggregate has four
answers to give. A session that has billed nothing, one whose every round
priced, one that priced some rounds and not others, and one where nothing
priced at all all came out as costComplete true or false — and the first and
last of those also total the same amount, zero, so nothing downstream could
tell them apart. Studio could not tell them apart for a second reason: the
field was declared in the page's own CostQuote and read by nothing, so the
session projection carried no completeness at all.
Coverage is that fact with the states a boolean cannot hold: none, complete,
partial, incomplete. It is folded rather than assigned — the join over complete
and incomplete, with none as the identity and partial as the top — so it is
commutative, associative and idempotent, and the same rounds billed in any
order reach the same state. A run that has priced everything so far cannot fold
back to complete once an unpriced round joins it, which is the failure a
boolean invites and the one the ledger was already committing.
That ledger defect is the one thing here that was a wrong answer rather than a
missing distinction. Entries merge by pricing key, and going bucketed on a
second currency re-asserted completeness before folding the incoming quote in,
so an entry that had already seen an unpriced call read as complete again. On
the pre-change tree, a ledger given one unpriced call and two priced ones in
different currencies reported the session as costComplete true with the reason
erased. It reads partial now, because coverage folds and the boolean is a
reading of it rather than a second answer free to drift from it.
Zero is an amount, not a state. A model billed at a published price of zero and
a session that has not spent both total zero and must not share an identity:
the first is complete, the second is none, and both halves are pinned.
The kernel owns the answer on restore, because the record is not replayed —
usage rounds are not in the transcript, so the fold has folded nothing when a
pane opens on a session that already ran. /status carries the session's own
aggregate and that is where the coverage comes from. A kernel older than the
field restores nothing rather than a guess, and the live fold takes over from
the next round, which is all it can speak for.
Deliberately not here: the cost block's wording is untouched and still reads
pricing state off whether an amount is above zero. displayStatus and
displayComplete stay the separate question of whether a requested currency
could be shown, and aggregateMode, originalTotals and legacyEstimate stay in
the kernel — the page keeps the smallest set that maintains the fact's
identity, not a copy of the quote.
Every cost figure on the rail was formatted to exactly two places, so anything
under half a cent rendered as US$0.00 — the same string a true zero prints. Read
back from a sampled session's own journal, all 45 usage quotes were complete and
non-zero, at $0.000206 and $0.00291 a round and $0.018644 for the session, and
every per-round and per-source figure on screen said US$0.00. A turn that cost
money read as a turn that cost nothing.
That is not the same defect as a missing price, which is what it looks like from
the outside and what the block's own "价目未上报" line claims when it appears.
The completeness fact the kernel sends is a separate matter and is untouched
here; this is only the figure being unreadable.
Ordinary amounts keep their currency's own precision, because paying for the
small end with six places everywhere would be a different kind of noise. Only an
amount that the fixed precision would swallow is given the significant digits it
takes to stay non-zero, so $12.28 and $1,234.50 are unchanged, $0.005 is still
$0.01, and $0.0049 becomes $0.0049 rather than nothing.
The gate is the contract rather than a table of renderings: across six orders of
magnitude, no non-zero amount may format to the string zero formats to — held on
the Intl path and on the fallback path for a code Intl does not know. Two more
pin the halves that a fix could trade against each other: ordinary amounts stay
at ordinary precision, and a true zero still reads as zero.
Context drew its usage figure twice — once against the fold point, once against
the window — and 393 sampled renderings never once disagreed about it, because
it is one number. It is drawn once now, with each ceiling keeping a row of its
own and naming its own denominator. Collapsing them into a single percentage
would have been the same defect wearing less: "6%" cannot say whether it is 6%
of the point where the host tidies up or of what the model can hold at all, and
those are two different things to do next.
The cache block led the rail at its largest size with a session-cumulative hit
ratio, on the argument that a session which stops hitting its prefix costs
several times more per turn and a number that size gets noticed. A cumulative
ratio is the one shape that cannot do that: the longer a session runs the less
one broken turn can move it, and four sampled runs watched it drift three points
across a hundred seconds of turns. It is a figure beside the block's name now.
What can answer "why did this turn suddenly cost more" is the prefix having
moved, so that is what surfaces, with the kernel's own reasons on it — and only
when it has. A block nobody has made a request against says nothing at all.
Both stop easing their numbers. useTicker eased a metric from its old reading to
its new one over 520ms, which at a 250ms sample turned 11 real cache updates
into 21 ratio renderings and 25 hit renderings; on the context gauge, which
Round 2 established moves once per request, it drew a per-request step as a
smooth climb. A reader cannot tell an eased frame from a measurement, and
nothing on screen offers to. The ratio is also hit / (hit + miss), so easing it
on its own clock briefly disagreed with the two figures it is derived from.
With both of them off it, useTicker had no readers and is gone rather than kept
for a caller that might want it: what is left in num.ts is one hook whose timer
samples a shape and one whose timer may only end an observation. Geometry and
emphasis still move — the bars keep their transitions.
The gate is the contract in one line, held for each of them: one metric update
is one displayed value, asserted by advancing timers and frames afterwards and
finding nothing added. Against the deleted helper the same test reports six
readings for one update, four of which no request ever produced.
The runtime panel drew six counters on every rail, standing at zero whether or
not anything had happened, and three panels beside it held a block each to say
they had nothing. A sampled clean run spent 100% of its samples showing 失败步数
0, 外部请求 0, 子代理数量 0, a background-jobs block whose entire content was
"没有在跑的后台任务", and a work-tree block whose entire content was "尚无改动".
A reader who has learned to skip five zeroes skips the sixth on the run where it
is finally not zero.
Each of them now speaks only when it has something to report, which is the
contract the rail already claimed for itself and most of its panels already
kept. A failed step, a call that reached outside, a delegate, a background job, a
changed file: absent at zero, present the moment they are not. The work tree is
the one review posture draws first, so an unchanged one led the rail with a
sentence about nothing every time a turn ended.
Throughput goes with them but on its own reading. It is about a turn in flight,
so it is drawn while one is running and not after — a permanent "— tok/s" on an
idle rail is the same zero row spelled differently, and D1 already made it fall
silent within the turn.
待确认 is the only fact here a reader can act on, and the only one about them
rather than about the run. It leads the rows and is toned as a request rather
than as telemetry, label and number both, because what matters is that
something is waiting and not how many things are. The transcript says what is
being asked; this says that something is being asked at all, which is why the
two saying it at once is not the duplication the next paragraph is about.
改动文件 was: it and the 工作树改动 block were one derivation rendered twice, four
rows apart, from the same visible(changes, tree) call — measured identical
sample for sample. One projection is kept.
工具调用次数 moves off the rows and onto the group's own line. D2 made it a
correct cumulative fact; that is not the same as it deserving a standing row,
because how many calls a turn made is almost never what decides the next thing
to do. Being right is not a reason to be loud.
Jobs carried a comment arguing the opposite case — that empty is a state and a
vanishing block moves the rail's order under the reader. The order is a fixed
table per posture, so a block leaving moves only what is below it, and jobs sits
near the end of both. Measured against a standing row nobody reads, that is the
cheaper of the two. The inspector's contract test kept the same shape and
changed which panel is its example.
Runtime's own doc described three headline figures on a head card that
Metrics.tsx says twice does not exist. The panel is now what it actually is, and
no comment in the rail claims that card any more.
Four controls stood on the shelf under every turn, and on an ordinary one three
of them recited a value the session already had before anyone touched it:
均衡, 计划, and whichever posture the policy chip had collapsed to. Sampled runs
watched all three sit unchanged for the whole of a turn — zero changes, zero
time away from baseline — beside a model picker and a stop button that were
doing the work.
policySummary already knew how to do this for effort and approval, and preset
was the one field it recited unconditionally. It is baseline like the other two:
balanced is what a session runs as before anyone changes anything, so it is what
the shelf stops spending width on, and delivery — or any preset the kernel names
that this table does not — is a deviation and shows. With all three quiet the
control has nothing to report, so it draws nothing at all rather than an empty
chip, and it carries its own separator so nothing dangles where it stood.
The plan toggle is not the same reading, and the difference is the rule worth
keeping: a status may recede to its baseline, but the only way into a mode may
not. Preset, effort and approval are readouts whose control lives in the
settings sheet as well, so what recedes there is the shelf's copy. The plan
toggle is where plan mode is discovered — Shift+Tab is a shortcut for someone
who already knows, not a hint — so it stays, drawn as text rather than as
another chip while it is off, and taking its full weight back the moment it is
on. It keeps its border on hover, because a control that only exists once you
are already touching it is the one nobody finds.
The model has no baseline to recede to. Every value of it is a choice somebody
made, so it stays, and so does stop.
The gate is the two halves together: a session at balanced / auto / ask must
recite none of it, the plan toggle must still be there saying it is off, and
each deviation on its own must be visible. The one
the quiet may never swallow has its own two tests — a fully-permitted session
shows 全放行 and its mark with everything else at baseline, and again while a
plan is running. A third catches the shape of failure this kind of change makes:
the dangling-separator check is vacuous if its selector is wrong, so the
deviating case asserts the same query counts something.
The rail counted tool calls, failed steps and external reaches by walking the
transcript for items of type "tool". The transcript is a projection whose job
is to collapse cards — read_file alone was 96 calls across a sample of recent
sessions against 47 for bash — so it folds settled lookups into one manifest,
nests a subagent's calls under the task that spawned them, and replaces a saved
memory's row outright. Every one of those moves an execution out of the shape
the counter recognised, and the counter is labelled with a cumulative fact. Four
sampled runs watched it count down: 7 to 5, 13 to 12, 15 to 14. Failures went
with it, because the same walk derives all three behind one type test, and
nothing stops a read that failed from being folded.
The three facts now come from the executions the session records, keyed by the
id the wire gives each call. Identity is what makes this idempotent rather than
a guard: the same event reduced twice — a replay, a reconnect that re-delivers —
is one fact restated, not a second call. An outcome is absent until the result
lands, because a call still running has not succeeded. Classification stays in
derive.ts beside the categories the rest of the interface uses; what moved is
where identity lives, which is the part the projection was overwriting.
Recording happens before the branch that deletes a card, not after it: a row
being replaced is not the call not having run.
The gates are the four ways the transcript destroys a card, plus the general
form — the same executions drawn two legal ways must answer identically, which
is what a new collapse rule has to pass. Against the old derivation all five are
red: the two fold cases report 0 where 2 and 3 ran, a subagent's call reports 1
where 2 ran, a replaced memory reports 0 where 1 ran, and a failure folded into
a manifest reports 0.
Every restore hands the executions over with the transcript, and the `as never`
the three dispatch sites carried is gone — it was what let one of them be
written without them, which a live run then found by reducing a tool event
against nothing at all. Dropping the cast is what makes the next omission a
compile error rather than a crash.
The folding rules move to state/fold.ts, which is what keeps session.ts inside
its ceiling and also says the thing this change is about: drawing and recording
are two jobs, and only one of them is allowed to be the source.
What this does not fix: /history carries no error field and no resolved name, so
a rebuilt execution has no outcome. After a reload the failure count reads 0
however many failures the session had — the same reading as before, now for a
stated reason rather than a silent one. Closing it means the kernel projecting
what it already knows, not the frontend inferring it.
The rail's throughput row was read four times a second by the same interval
that advances the elapsed clock, whether or not a token had arrived. Between
arrivals the window's samples age out of the front while the span they are
divided by does not, so the value slid down a smooth ramp and the reader
watched a rate fall through a dozen readings the model produced nothing for. A
sampled run measured seventeen consecutive readings, 87 to 2 tok/s, across 4.3
seconds in which the turn was waiting on a tool. 134 of the 136 value changes
on that rail in four runs came from this one row.
The intent was never wrong. tokens.ts already says the window is "short enough
that the number falls to zero while a tool runs instead of implying the model
is still writing", and falling to zero is right. What was wrong is that the
fall was drawn as a series of rates rather than as an ending.
A rate is an observation of what arrived, so useRate makes one only when
something arrives, and gives wall time exactly one power over it: to end it. On
each new sample it reads the window once; it then schedules the single step to
zero at that sample's own expiry. Between the two the last observation stands
unchanged. WINDOW_MS is untouched — how long the window should be is a separate
question from what may write a number into it, and answering both at once would
leave neither answered.
The invariant test drives the hook through arrivals and silence and asserts
that silence produces exactly one transition, to nothing. Because that is also
satisfied by a hook that never changes at all, a second test requires a fresh
reading as soon as tokens resume, and a third requires the last reading to
stand until its window actually closes rather than vanishing early. A fourth
keeps the defect stated rather than remembered: asked repeatedly with nothing
new, the formula itself still answers a different number every time, which is
correct for a pure function of `now` and is exactly why nothing may ask it on a
clock.
The page did not read as a console because any one control on it was obscure.
It read that way because all of it arrived at once, in an order nobody chose:
语言 and 窗口 first, 明暗 and 配色 last. What a visit is actually for now comes
first — 明暗, 配色, 大小, 壁纸 — with 语言 and 窗口 after them, and 字体, 文字粗细
and 文字对比度 folded into one disclosure.
A disclosure that hides a value somebody set is a screen disagreeing with the
window it describes, so the summary says which of the three have been changed,
read from the same values the folded blocks render rather than from a second
copy of that question. Its label is drawn at the weight of a settings row, not
a footnote, because what is behind it is three whole blocks.
Which disclosure a jump has to open is answered by structure — the anchor's own
ancestors — rather than by a table of which settings count as advanced, which
would have to be threaded through prefsnav, Appearance and Settings and kept in
step with all three. The landing then has to survive the page: 配色's packs and
the font list arrive after the scroll is already running, and a smooth scroll
aimed once lands short by however much grew above it. Measured on the fixture,
文字对比度 came to rest with only its heading edge on screen. A jump owns its
landing until it lapses, so it re-aims for as long as it is owed.
Gating 壁纸's opacity, dim and focus behind the same treatment was considered and
dropped: `look.wallpaper &&` is already the gate, and hiding those once a
wallpaper is chosen hides them exactly when they became worth having.
The chrome is the one line that is always on screen, so what sits in it is a
claim about what a session needs within reach for all of it. A theme cycle is
not that. It is set once and then left, and 明暗 on the appearance page already
owns the same state with its three values named rather than reached by clicking
through them — which is also what made the button hard to write: two of the
three look identical on screen, so the cycle had to be re-derived from what the
system currently resolves to just to guarantee the first press changed
something.
What goes is the control, not the capability: the button, the two props the
window threaded down to it, the registry entry and the icon's per-state CSS.
`.thbtn`'s shared rules stay, because the account, focus and settings buttons
are still drawn in that weight class. audit-sweep's theme-toggle step goes with
them — with no control left to find it would report a permanently skipped step
on every run, and a skip a reader has to re-diagnose each time is worse than no
step.
Shrinking the button instead was the other option, and it answers the wrong
question. It would leave the same claim on screen — that this is one of the few
things the window shows unconditionally — while making the control harder to
hit.
The preceding commit establishes that the producer owns the identity and that it
survives the pipeline into the model's own view. It does not establish that the
model does anything differently for having it. This is the harness that would
answer that, and the record of what happened when it was pointed at the question.
Three arms share one transcript ending in a refused update_goal and differ in
the refusal tail alone: the shipped sentence, that same sentence byte-for-byte
plus the identity Refusal.String() appends, and a synonymous rewrite carrying
none. A minus B is then the identity, and the rewrite is the control that says
whether any difference was the identity or merely changed words.
TestRefusalArmsDifferOnlyInTheRefusalTail runs in CI without a provider, because
it is the claim every live number would rest on: the arms are checked to be
identical in transcript and tool surface up to the last tool result, the typed
arm to be exactly the sentence arm plus the identity, and the reworded arm to
carry no dotted token that could serve as an identity proxy. The measurement
itself is opt-in behind REASONIX_LIVE_REFUSAL and skipped otherwise.
The pilot result, recorded because it is the outcome:
R1 typed refusal architecture PROVEN
Behavioural claim NOT MEASURED
Reason the design pilot found the invalid-goal-retry
primary at the floor on this fork, 0/15 across
all three arms; no confirmatory run launched.
A pilot is allowed to falsify the assay rather than the hypothesis, and that is
what this one did: with the primary at the floor, a confirmatory run buys a more
precise measurement of something the instrument cannot see on this fork. The 15
observations are excluded from any reported result, including the secondary axis
that varied in them — moving the primary to an axis noticed after looking is the
move a frozen primary exists to prevent. Measuring this properly needs a new
assay, preregistered from host state rather than from these runs.
Classification reads the calls the model emitted, never its account of itself,
and the outcome vocabulary and the two-call window were frozen before the first
request. The other-goal-mutation set is declared rather than name-matched: a
guess at "some goal tool" would count one that never existed and miss one that
does.
The goleak allowance is scoped to the transport read loop a live provider owns
and no test can reach to close, and only under the env gate that asks for real
traffic. Forgiving everything parked on IO — the first shape of this — would
have made the live harness the one place its own leaks cannot be seen.
`ContextualReasoner.Unavailable` answered a bare string, so a caller that has to
tell two refusals apart was left matching the words one of them happened to be
phrased in this release. The rule the tree already holds errors and HTTP
refusals to — the identity travels, the sentence is presentation — did not reach
the one refusal the model reads most often.
`tool.Refusal` carries both. Five codes land, each backed by exactly one
predicate its producer can prove: jobs.no_job_context, plan.mode_active,
plan.no_planning_turn, goal.no_active_turn, and tool.unavailable_unspecified for
a contextual tool that says nothing, which is a fact about the registry rather
than about the call and so gets its own identity instead of a bare sentence.
The middle two are the argument for doing this at all. complete_step refuses
because plan mode is active; submit_plan refuses because no planning submission
exists. Those are opposite facts with opposite recoveries, and under
sentence-matching both read as "something about plan state is wrong". The two
plan tools share one code and keep their own wording, which is the shape: one
identity, two presentations.
No code is invented ahead of a producer. update_goal's ProviderVisible proves
only that this turn carries no goal recorder, so there is no second goal code
for a completed-but-armed turn; that state has no producer yet.
Refusal implements error because update_goal had two refusal paths for one fact
— the availability gate and the fail-closed Execute a stale transcript reaches —
with the sentence hand-copied into both. Returning one value from both is what
stops the identity from being present on one path and lost on the other. The
same shape was live in submit_plan and conclude_no_changes.
The identity crosses both boundaries it has to. Refusal.String() renders it into
the text the model reads, because a code the model never sees is one it cannot
cite; refusalCode rides toolOutcome to event.Tool.RefusalCode structurally,
never recovered from the words. No sink reads that field yet — this commit
claims that the producer owns the identity and that it survives the pipeline,
not that anything has been shown to act on it.
The registry tests pin which tool refuses under which code. Nothing about a
tool's name says which host fact stops it, and two tools sharing a code is a
claim that one predicate stops both, so a new contextual tool has to enter the
table and make that claim in the diff.
The narrowed standards gate built its universe from `git diff --name-only
HEAD`, which answers what the worktree changed against HEAD and says nothing
about a file git has not started tracking. Three new files reached `make check`
as clean while the full sweep found a violation in one of them. Not a wrong
judgement — a measurement universe missing a piece, and a green meaning only
that the gate never opened the file.
The universe moves into Go as `-changed` rather than growing another expression
in the recipe, because the defect was in the universe and a universe computed in
a Makefile cannot be tested. `trackedChangedPaths` is kept as its own function
though nothing in production calls it: it is the incomplete universe, and a test
that cannot express the incomplete one cannot prove the complete one fixed
anything. That is what the second test does — one finding, two universes, two
verdicts — and the first fails on purpose if `git diff` ever starts reporting
untracked files, because the witness would be gone.
Deleted paths stay out. A path the change removed cannot be scanned, and handing
one to the scanner asks it to fail on an absence the change intended.
REASONIX.md now names `make check` as the owner of that universe rather than
naming the flags behind it. The rule being preserved is that the evidence entry
point is the make target; which flags implement it is not the contract, and
writing them down is how the document went stale the first time.
CI is unaffected: it runs the full sweep with no narrowing, so the hole existed
only in the local check cited as evidence that a change owed nothing.
The catalogue could answer when a change takes effect and not who it
reaches, so ownership was read off the page a block happened to be filed
under — and the model page alone holds one value stored per provider
entry, three stored machine-wide, and one stored nowhere at all.
Every scope here came from reading the endpoint behind the control and
the authority it writes. Three findings the screen could not have shown:
the compaction threshold sits on the model page and is one [agent] key
every session on this computer reads; 执行设定 and 计划模式 reach the
controller and persist nothing, while 工具批准 and 模型 look identical on
screen and are written as the default every later session starts from;
and four blocks — hooks, MCP, skills, memory — take the authority as a
kernel parameter the reader chooses per write, so naming one owner for
them would be wrong half the time.
Scope and apply stay two fields, joined only where they are drawn: a
pre-joined sentence would give search, filtering and export nothing to
read. Both come from the one catalogue, so the block and the search
result that leads to it cannot disagree about what a setting owns — and
search is where it is worth most, since a proxy found under 网络 with no
page around it says nothing about whose proxy it is.
Ownership is a fact, so it rides the weak line the timing already used.
No badges, no accent: thirty of them down a page must not read as thirty
alarms.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_013UmAThRKnRPWvBouHWHkQ3
Three kernel facts were recited on every turn, including every turn where
none of them was unusual — so a shelf that already carries a model, a plan
toggle and an attachment row spent its remaining attention saying that
nothing had been changed. It now spends one word on a session nobody has
configured, and the whole reading stays on hover: baseline recedes, it is
not deleted.
What recedes is decided by the kernel's own defaults, not by length. ask
is the only approval mode that changes nothing about what happens without
being asked, so it is the only one allowed to be quiet: auto lets calls
through unasked, dontAsk refuses what it would have asked about, and yolo
asks about nothing and carries its own tone, because it is the one state
that costs a workspace if it is forgotten. The summary says 自动批准 where
the menu says 自动 — under a 工具权限 heading that word is unambiguous, and
on the shelf it stands next to a reasoning rung.
The projection reads committed fact only. A field still in flight shows
its pending state inside the open menu, where the person who clicked is
looking; a shelf that moved first would name a posture the kernel has not
accepted and may refuse. With nothing read yet it names the control rather
than the posture the kernel usually answers.
The rail's own 运行详情 becomes 运行指标: it reports throughput, calls and
files changed, and the pane's detail menu now owns the other name.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_013UmAThRKnRPWvBouHWHkQ3
Two navigations sat one above the other speaking the same grammar — a row
of tabs under a row of tabs, both drawing the same travelling marker — so
which row changed the session and which changed the view had to be worked
out on every glance. The inner one now projects the five views onto three
standing purposes: the transcript, the task board, and one entry for the
three that are diagnosis.
Demoting that entrance must not hide the position, so the trigger carries
the category alone while nobody is inside any of the three, and the open
lens's name alone once somebody is — at every width, which is why nothing
here arbitrates between the two by container width. What pins it is three
renders, one per lens, each a first render: that is also how a pane
arriving from somewhere other than this menu reaches the projection, since
it keeps no memory to consult and can only draw the identity it was
handed. The other gate is that opening and closing the menu picks nothing.
An entrance that reopens the last lens, or defaults into one, is a state
machine with no place on screen to show itself.
The five view identities are untouched, and so is everything that reaches
them without going through the bar: a graph node still lands on its call
in the transcript, the task board still reaches the trajectory and the
latest turn, and a run that loses its graph still takes its timeline with
it — the menu offers no timeline there is no graph to draw. Each
diagnostic view is still mounted only while it is on screen; that
asymmetry is a performance contract, not markup nobody tidied, and a test
now reads it off the source so unifying them fails rather than quietly
costing a transcript's worth of work per streamed delta.
The travelling marker is PaneTabs' alone. The transcript's item count is
gone — the largest number on the bar and the one that changed nothing —
while task progress stays and the diagnostic counts move into the menu.
Two bounds decide when a session folds and only the lower one fires. The
window was the one on screen, so a 1M session drew a bar 16% full at the
moment maintenance happened, and the setting behind it was the kernel's
configuration language: one signed integer, where a negative retired the
economic bound and left the window share firing at 85% under a label that
read as off.
ContextBreakdown now carries the boundary in force, read from the rule
that fires it rather than recomputed by whoever draws it. The panel leads
with the distance to it and keeps the window as a quieter second figure —
capacity answers whether the model is too small, and is still the only
place a relay's wrong window is corrected. The two rungs the kernel
already tells the model about, 75% and 92%, are the two the panel shows,
so the screen and the conversation are never under different pressures;
both read as accent, because a routine fold painted as a warning makes
every long session look broken.
The setting states the three intents instead of asking for a sign, names
which of them is in force while collapsed, and says capacity still
applies when the economic bound is retired.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_013UmAThRKnRPWvBouHWHkQ3
Renaming a session, moving where compaction starts, and renaming a pane all
saved on blur and nowhere else. Blur fires when focus moves for reasons
nobody aimed at — a click elsewhere, a Tab, a window going away, an element
being removed — which is why the census counts it as a runtime event and
never as an interaction root. So three host writes had no root at all, and
Seal A's "every proven write has an identity" was true over a universe that
could not see them.
Enter now commits, and carries the identity. Blur still saves, because
clicking away is an answer and taking that away would be a worse product
for a cleaner number; what changed is that it is no longer the only way in.
Each of the three guards against sending the same value twice, since Enter
commits and then blurs — for the compaction threshold that matters more
than tidiness, because declaring it rebuilds the runtime.
One id for two places: the sidebar's tree and the pane tabs rename the same
session through the same host call, so session.rename covers both and says
which on data-target. compaction.threshold is new. The sandbox's workspace
root turned out to be fine already — its Enter has committed and been named
all along, and it is in this only as the shape the other three now have.
There is a guard now, and it is about the rule rather than these three: a
field whose blur handler reaches outside the component — a port or hub
call, or a callback handed in from above — must declare a user input on the
same element. Blur closing a menu or clearing a local flag is untouched,
which the check demonstrates on both a commit it must see and a local write
it must not.
Found while adjudicating the workspace rail, and worth saying that the
first count was wrong: a four-line grep found three of these and there were
five. The two it missed committed through a local function rather than
inline. Queue's was already named and Sandbox's already committed on Enter,
so three needed the change.
Seal B 79 to 76, unnamed 231 to 228, Seal A still held — now over a
universe that includes what it is claiming about.
Ten unnamed inputs across onboarding, the remote list and the composer, and
four of them do something outside this window.
Opening the vendor's console during setup and opening a link in the
transcript are one thing to do, so both sites take external.open. It is
shell-native and not a mutation: the reader is handed to a browser and no
state on either side moves.
Probing a remote asks a machine whether it answers. Nothing changes, and
asking again is the point when the first answer was "not yet", so it is
repeatable and carries the host it is about on data-target.
Choosing an image uploads it before anything is sent — the picker's own
button only opens a dialog, and the bytes reach the host on the change.
That is where session.attach goes, and naming the button instead would have
put the identity one step away from the write.
The other six stay unnamed on purpose. Picking a vendor, typing a URL or a
key, and choosing a model all edit onboarding's draft until
onboarding.connect sends it. Setting or dropping a remote's default folder
edits a draft the save reads. Restoring or discarding a long paste moves
text in and out of the box you are still writing in.
Seal B 83 to 79, unnamed 235 to 231, ratchet lowered, roots unchanged at
418. Three ids for four roots, and six looked at and left, which is the
same discipline both ways: an id is what a person did, and there is nothing
to name where nothing was done to anything.
Two of the four unnamed inputs on the workspace rail really do change the
host: the folder picker and the typed-path form both end at addWorkspace.
They take the id the empty transcript's own button already carries, because
which of two ways you named the folder is not a different thing to have
done.
The other two do not, and are left alone. Folding a workspace row writes a
Set in the window and nothing else. Renaming a session commits on blur —
its keydown only blurs the field, so naming that would name the trigger and
not the write.
That blur is worth stating plainly, because it is a hole in a number this
tree quotes. Three host mutations in the desktop commit from onBlur — two
renames and the sandbox's workspace root — and blur is classified as a
runtime event, so none of them can ever be an interaction root. Seal A
reads held over a universe that cannot see them. Reclassifying blur is not
obviously right (it fires for reasons nobody aimed at) and giving these an
explicit commit control is a product change, so this records the gap rather
than closing it.
ModelChoice is refused as identity debt, and that is the other half of this
change. Its four inputs — the model ticks, the vision flag, the default,
and adding a name the endpoint never reported — all write React state that
lives until someone presses save. The canonical mutation is already owned
by provider.add and provider.save, and inventing model.enabled or model.add
would have said something untrue: typing a model name and then cancelling
changes no provider config at all. It would also have sat one word away
from model.select, which switches the model this session is running on.
So this is two roots named out of eight looked at. Seal B 85 to 83, unnamed
237 to 235, and the ratchet lowered to match. The rule the earlier census
should have been applying, and now is: a root earns product identity when
it triggers the host mutation itself, not when it edits a draft some later,
already-named commit will read.
Thirteen inputs on the appearance page changed durable state and had no
identity — the interface language, the interface and reading scale, four
background parameters, weight, contrast, light-or-dark, and two font slots.
The same file already declared five other actions, so this was a gap in the
vocabulary rather than a page nobody had reached yet.
Eight names for thirteen controls, and the difference is the point. The
interface scale has a row of presets and a slider beside it: two element
types, one thing a person is doing. The four background sliders edit four
fields of one background — changing how much it is darkened is not a
different capability from changing how opaque it is — so they share
appearance.background and say which parameter on data-value, the way
pane.close already says which panes on one. Naming each control would have
been the DOM renamed, not a vocabulary.
Three boundaries kept on purpose. theme.activate installs a palette pack
and appearance.scheme is light, dark or follow-the-system. wallpaper.change
and wallpaper.remove decide which image is there; appearance.background is
how the image that is already there is drawn. Weight and contrast look
alike in CSS and are two different things a reader wants.
The surface stays out of the id. These are reached from the settings sheet
today, and an id that said so would need a second one the day onboarding or
a command palette can change the same setting — which is the rule
chrome.preset was already keeping when the composer started rendering it.
Where they land decides their kind rather than how they look: the scale,
the reading size, the background, the fonts and the language all reach
saveAppearance, while light-or-dark, weight and contrast are this browser's
and stay view, which is what chrome.theme already is.
Two controls, one of which must not fail. Swapping the opacity slider for a
number input leaves every guard green — the identity is not the widget's.
Giving each background parameter its own id turns the vocabulary contract
red, which is the shape this was most likely to drift into.
Measured, and every root accounted for: Seal B 98 to 85, and the thirteen
that left are exactly the thirteen named here — the appearance page now has
none in that population. Actions 112 to 120, unnamed 250 to 237, the root
count unchanged at 418, and Seal A still held. What remains in Seal B is
not this kind of debt: it is dominated by an identity axis whose unresolved
provenance is one list shared across fifty-seven roots, and by callees the
analyzer has no verdict vocabulary for.
Seven changes to the desktop's presentation layer, and what is worth keeping
from them is not the diff. Each rule below is held by a guard that fails
when it is broken, which is why they are standing instructions rather than a
changelog:
38c1477 transcript visual hierarchy
49b5746 turn-policy ownership
637c0ff certified primitive callback roots
47e518f anchored pane-close confirmation
3966791 settings discovery and apply truth
b0af1d1 motion has explicit causes
2ebfff6 lifecycle-aware inspector composition
Seal A of the action census stayed held throughout, and the one time Seal B
moved it was the instrument being corrected rather than debt being added:
certifying a primitive's callbacks brought the Picker call sites into the
universe, one of which switches the model and had never been counted.
The rail drew the same ten panels in the same order whether the turn was
running or long finished. While it runs the questions are "is it alive,
what is it doing, how much room is left, where is it in the plan"; once it
is over they are "what changed, what came of it, what did it cost" — and
the answer to the second set sat below six answers to the first.
Two postures, and deliberately only two. A rail that reorders itself on
every change of fact is not lifecycle-aware, it is unstable, and a reader
who has to find the same panel twice in one turn has lost more than the
ordering gave. Working leads with context, runtime, agents and the plan;
review leads with files, plan and jobs, and context drops — how full the
window is matters while there is a turn to fit in it and is forensic once
there is not.
The plan moves up rather than staying with the after-the-fact group. While
a turn runs it answers where it is and what is next, which is orientation,
not an audit trail.
Posture comes off the run and never off what the panels hold. It is derived
beside runState because "halt" answers two different questions — a turn
waiting on a decision has not finished, and a turn that ended badly has —
so blocked is asked separately rather than read back out of the state that
already collapsed them. The rail was reading `!running`, which called a
turn waiting on your approval finished.
One list of panels, keyed, reordered. Two branches of JSX would be the
obvious way and the wrong one: the same panel under a different parent is a
different element to React, so changing posture would tear every panel down
and build it again — losing whatever was open inside and asking again for
whatever it reads. Changing which reading the rail is for is not a change
to any panel's lifetime, and there is a guard that fails if it becomes one.
Priority is not presence. Whether a panel appears is still its own
contract, in both directions: Plan draws nothing without steps, and Jobs
reports zero on purpose so the order does not move under the reader every
time the last background task finishes. Composition decides where something
goes, never whether there is something.
The diagnostics drawer this was going to grow is not here, and that is a
finding rather than an omission. Mcp already speaks only when a server has
failed or has never been answered for — a drawer would add an empty one to
every healthy rail and shut it over the one thing worth seeing on a rail
that is not. Ordering it last is the whole of what it needed.
Three panels gained the id the others already had, so what the rail put
where can be read off the document instead of guessed from the words
inside it. Three sabotages: two conditional subtrees, an order that follows
the data, and a wrapper that overrules a panel's own silence.
Also recorded rather than fixed: there is no head card. Three comments in
this rail describe one, and Context still carries a row=true form for it
that nothing passes. That is panel API, which this change does not touch —
but the comment that sent readers looking for it is gone.
Seal A held, Seal B 98, and the action universe unchanged at 418 inputs and
250 unnamed. Reordering what is already there gives nobody a new thing to
do, which is what this should have cost.
Two places took a DOM node coming into existence for something happening.
A transcript card animates in whenever it mounts, while blocks of 48 mount
and unmount as the reader scrolls — so a fact from an hour ago arrives
again every time its block comes back. A settings block does the same on
every section change, and four of them flying in says four new things
appeared when the reader only walked to another page.
Entrance is now a debt, owed once and spent by the render that draws it.
The projection keeps it, because only the projection knows whether a card
is arriving or being replayed: a restored transcript owes nothing, a card
the live reducer first materialises owes exactly one, and a delta rewriting
a message it already made, a dispatch settling into its result, or a block
scrolling back into the document are all the same card and none of them is
a new fact. Kept beside Item rather than on it — what a card is does not
depend on whether its arrival has been shown yet.
Provenance would not have been enough, and that is the trap this is written
against. A card that was live three hours ago is still live-origin when
virtualization brings it back, and a mark meaning "this came in live" would
animate it a second time. What has to be asked is whether the entrance is
still owed, which is a question with an answer that changes.
The debt is spent by render and never by the animation. Reduced motion runs
no animation at all, an element can leave the document before one ends, and
either would leave the debt standing for a card to arrive again later.
Motion does not get to own the state machine.
The mark rides a display:contents frame around each row rather than a prop
threaded into twelve card components. Measured rather than assumed: every
card still has its block's exact box, content-visibility still applies, and
the turn anchor's margin still collapses to the same 28px.
The settings sheet gets the same treatment from the other end. Its blocks
stop animating and the column is keyed on the section, so changing section
is one movement of the thing that changed — the view — instead of a stagger
of everything mounted beneath it.
The rule is written down twice where it will be read: beside the motion
tokens, and as a guard over the stylesheet itself. That guard is the only
thing standing between this and someone writing `.call { animation: card }`
again, and it needed vitest to stop stubbing CSS — through ?raw it was
handed an empty string, which every rule in it would have passed.
Four sabotages, each reddening its own half: not spending the debt, giving
it to a restored transcript, re-owing it on every revision, and putting the
settings rule back. Seal A stays held, Seal B stays at 98, and the action
universe is unchanged at 418 inputs and 250 unnamed — this adds no way for
a person to act on anything, which is what a motion change should cost.
testkit gains an IntersectionObserver: jsdom has no viewport and therefore
no intersections, and the transcript asks one which block is near.
The comment over the composer's pending state said every control on that
shelf rebuilds the runtime. Reading the endpoints for UX-2D showed it is
true of the model and the effort ladder and of nothing else there: preset,
plan mode and tool approval set kernel state and return, with no rebuild in
the path.
Behaviour is untouched — the pending state is worth having either way,
because a control that looks dead for half a second is the thing it fixes.
What changes is that the next reader is not told something the kernel
disagrees with, and is pointed at the kernel rather than at this file.
Two questions the settings screen could not answer about itself. Finding a
setting meant already knowing which of fourteen pages it was filed under.
And what a change would do was one sentence at the top of the whole sheet —
"takes effect immediately; things that rebuild the runtime cannot be changed
while a turn is running" — which speaks for two of the three answers and
leaves the reader to work out which one they are holding.
Both are now facts in a table, not something to work out.
The search corpus is that table and never the page. Sections mount one at a
time, so reading the DOM could only ever search the page already open, and
mounting the rest to search them is how a page nobody asked for starts
making requests. Typing 代理 finds the network page without opening it, and
the guard measures exactly that: the block is absent from the document and
the port is asked nothing it was not already asked.
Keywords buy a way in and nothing else. 代理 is not what that setting is
called, the result says the setting's own name, and no alias may be spelled
like some other setting's title — the same line R3 drew between what makes
something discoverable and what makes it what it is.
When a change lands is declared per block, from what the endpoint behind it
really does. Every value here was read off whether that handler reaches the
kernel's rebuild, not off a hint's wording or a handler's name: model,
effort, roles, permissions, sandbox, shell and the context bounds rebuild;
preset, plan mode and tool approval do not, whatever the composer's comment
said. Storage and the interface language are the third answer, and that one
has to say both halves — saved already, in force after a restart — or
closing the sheet reads as losing what was just typed.
Group's id is required, so a settings block cannot be written without
naming itself, and a name the catalogue does not carry fails. That is the
whole of "no setting may be silent about its cost": there is no default to
fall back to and nowhere to leave it out. The appearance page builds its
nine blocks by hand rather than through Group, so ApplyNote is separate
from it and those blocks answer the same question the same way. What counts
as a block is having a heading — Storage draws three frames with none, and
they belong to the block above them.
Three sabotages. Searching only the open page, deleting a catalogue row,
and defaulting the cost to "immediate" each turn their own guards red; the
last one is checked by two blocks alike in title, shape and children that
say different things because the table says different things.
The search is a view and stays one. Its results jump through
settings.section, the id the nav already uses, because arriving from a
search is the same arrival — no second identity for finding a thing. Seal A
stays held and Seal B stays at 98.
Not done here, and not silently: the preset block's hint still explains
that it takes effect immediately, which the label under it now also says.
Trimming duplicated copy is worth doing and is not what this change is
about.
Closing a pane that is still working asked first, and asked by replacing
the tab strip with the question. Three tabs became one sentence, so the one
thing needed to answer it — which of them this is about — left the screen
along with everything else. The answer also acted on what was running when
the question went up, which is not the same set as what is running when it
is answered.
The question is now a bubble under the tab it is about, through the same
viewport seam the context menu already uses, and the strip stays exactly
where it was. Escape and a press outside cancel it, changing nothing, and
put the keyboard back on the close button that asked — found on the tab
rather than held since it was pressed, because the pane it sits on may have
gone in the meantime.
What is still live stopped being something the question owns. Only the ids
are kept; which of them still exist and which are still running are read
off the current tabs on every render and again when the answer comes. A
pane that finishes while the question is up is closed without the sentence
about stopping it, one closed from somewhere else is never handed back to
the host, and a question whose panes have all gone takes itself away rather
than offering to stop what is not there. The wording follows the same
derivation, so it cannot say "3 panes" about two.
Closing panes keeps one identity. The confirmation is a view; pane.close
is answered where it was asked, with one|others|all still on data-value,
and cancelling names no action because it performs none.
Three sabotages, because a confirmation that merely looks calmer is the
easy thing to ship here. Trusting the open-time live set, sending the
unfiltered ids, and putting the strip-replacing shape back each turn their
own fixture red — the last one takes five of the ten with it, which is a
fair measure of how much that shape was hiding.
Two things the census caught that a screenshot would not. The effect that
withdraws a dead question first declared its dependency on present.length,
a value derived in that render and traceable from nowhere else; the census
lost the whole cell's provenance with it and five unrelated handlers in
this file went from read-only to "might write". Depending on the sources
instead — the confirmation and the tabs — is both the honest edge and the
resolvable one. Seal A stays held and Seal B stays at 98.
The English catalogue reached the tree's 800-line ceiling on the way, and
the usage and cost section moves out whole rather than the budget moving.
The dialog is named by the question it renders, which is one key fewer and
a name that cannot drift from what is on screen.
testkit gains scrollIntoView. jsdom implements no scrolling, so the strip
keeping the selected tab in view was throwing inside a requestAnimationFrame
on every one of these guards — outside React, reported as an unhandled error
the file still passes with, which is how a real one would go unseen.
The action census placed a certified primitive's call site by the DOM event
its handler prop is named after. Picker's is onPick, which names no event,
so every Picker call site sat outside the interaction universe — and one of
them switches the model, a kernel write with no identity. Seal A read as
held the whole time. It was true, over a denominator that had a hole in it,
which is the shape of assurance this tree exists to refuse.
What a callback means is now the primitive's to declare. One list says
which components are primitives and, for each, which props carry a
person's interaction and which DOM event inside the component raises them.
onPick is an interaction because Menu says so and its body does it, never
because the name starts with "on".
The declaration is checked rather than believed. primitives.test.ts parses
each primitive and requires a handler for the declared event from which the
declared prop is actually reachable, so a certified callback with nothing
behind it fails. Its own negative control asks the same question about a
prop no body raises and requires the answer to be no.
There were two copies of the primitive list, the vitest gate's and the
census tool's, and adding Seg to one of them is what broke a seal at 1 —
reported as an input proven to write the host that the product names no
action for, which is a true sentence about a bookkeeping slip. There is now
one declaration, both callers pass nothing, and Options has no skip to pass:
the way to keep two lists in agreement is to have one. A third list, CTL,
went with them; nothing had read it.
Three fixtures and three sabotages, because a rule nobody has seen fail is
not a rule. A certified call site becomes a root; an ordinary component
with a prop spelled the same does not; a prop the primitive does not
declare does not. Each was broken in turn — spelling restored, every
component promoted, undeclared props admitted — and each turned its own
fixture red. The tool's own options are held to naming a resolver and
nothing else, which reddens the moment it starts deciding this again.
One of those fixtures was testing nothing and passed a sabotage that
promoted every component in the tree. It resolved its imports against the
product's files, where its ordinary component does not exist, so a test
about ordinary components was a test about unresolved ones. Fixtures now
resolve within their own universe.
The frozen fixture corpus caught the first implementation. Anchoring a
primitive's identity to a literal "/src/" un-certified the corpus's own
Switch, whose two call sites lost their separate actions to one root inside
the component — the exact rule that corpus was written to hold. A primitive
is matched by its path within whichever tree is being scanned, and those
reports are byte-identical again rather than rewritten.
The denominator moves and does not compare across this change: 413 inputs
to 415, unnamed 249 to 250, Seal B 97 to 98. The two arrivals are the
Picker call sites that were never visible. One is the composer's model
switch, which takes model.select — the id the settings sheet has always
rendered for the same intent — and Seal A is held over the corrected
universe rather than the incomplete one. The other is onboarding's, and it
joins the 98 that Seal B is still open on.
Three values decide how a turn executes, and they were kept in two places.
The preset sat in the title bar; effort and tool approval sat under the
box. Someone writing the next message had to look at opposite ends of the
window to know what would happen when they pressed send, and neither end
said the other existed.
They are one question, so they are one surface. The composer's shelf now
reads: attach, model, plan, and the three current values themselves —
均衡 · high · 询问 — which open one panel holding all three. Not the word
"settings": a summary that does not say what is set answers nothing, and
the shelf is where the question is asked.
Model and plan stay outside it. The model is the most-changed and most
recognisable choice on the shelf, and plan states an intent for this turn
rather than a preference that persists.
The settings sheet keeps its full version of all three and is not a second
owner: it is the complete, explained surface, and the composer is the
turn-local projection of the same canonical state.
No identity was invented for the move. The preset keeps chrome.preset,
which the settings sheet has always rendered too — where a control is
drawn was never its identity. Effort and approval reuse reasoning.effort
and tool-approval.mode, which that sheet already owned. One new id, for
opening the panel.
Three fields drawn together must not become one call. The kernel has three
effects and the panel makes three, each with its own pending value and its
own refusal, so a rung this endpoint will not take says so under the
ladder it belongs to and leaves the preset that did land alone. The shelf
itself stops greying as a whole for the same reason: "nothing here can be
changed" was never true, and only the control actually waiting is marked.
Seg is the second interaction primitive after Switch — a group whose call
site owns the action, with data-* passed through to each button and the
answer on data-value. Its handler is called onClick rather than onPick
because the action census places a primitive's call site by the DOM event
its handler stands for, and a prop the DOM has no event for makes that
call site invisible. That is not hypothetical: every Picker in the tree is
uncounted today for exactly this reason, which is a gap worth its own
look. The primitive has to be declared twice, in the vitest guard and in
tools/ui-census, because those two keep separate lists of the same fact —
also worth its own look, and not widened here for anything but a real
primitive.
Three things the move orphaned are removed rather than left: the menu
item's meter, and the level bars and gate ring the two pickers drew with.
Nothing produces them now, and a zero-consumer field is the shape this
tree keeps deleting.
Verified rather than asserted: the interaction proof that covered the
preset in the chrome moves with it and grows the two guarantees the old
placement could not have — that one field waiting leaves the others live,
and that picking one calls one setter and not the others. Seal A of the
action census returns to held; it broke at 1 while Seg was undeclared, and
Seal B is unchanged at 97.
Six kinds of fact share one card: what you asked, what it did, what it
finally said, what it needs decided. They shared the weight too, so a turn
scrolled back through read as one long list of the same row in different
colours, and the answer — the thing the turn was for — was drawn in the
grey reserved for process text.
Four weights now, and only the weight moves. Membership is untouched,
semantic projection is untouched, and no card shows less than it did.
The answer stops being a timeline entry. Its body takes --text where the
transcript's process text keeps --muted, it gets the panel's vertical air
instead of the card's, and its symbol loses the ring and ground that say
"there is a control here". The turn anchor keeps its rule and gets a
paragraph's distance above it rather than a line's. Work rows are one line
each: a long argument gives up characters now instead of folding the row
in two, because rows of unequal height cannot be scanned for structure,
only read one at a time.
The raw tool id leaves the ordinary card, on a criterion rather than a
list. It is shown when it says something the name above it does not — the
interpreter a shell call really went to, the remote tool a capability
resolved to — and dropped when tagFor would only hand back the string
labelFor was computed from. "Read" beside read_file is one fact printed
twice and it was on every card in the record. A list of tools to hide it
for would have to be maintained against a registry that grows; the
derivability test does not. The exact id stays one hover away on the name,
so nothing became unauditable.
The reading measure is deliberately not narrowed. That was settled
already: fencing the prose at 68ch while terminal blocks and diffs stay
full width puts two column widths on one screen, and the tier is carried
by colour and air instead.
Measured against the same markup through the real compiled stylesheet, not
asserted: the answer's body moves from --muted to --text, its padding from
11px to 17px; Read and Search drop a header element each and stop
wrapping; Bash keeps bash and an MCP call keeps its server and remote
name.
What this does not do is fix the entrance animation. Every .call animates
on mount while blocks of 48 mount and unmount as they scroll, so a fact
from an hour ago re-enters as though it just happened. Telling those apart
needs provenance carried to each card — the DOM's shape cannot say it,
since only an unfinished say is rendered outside a block — and that is its
own change.
The protocol said the sample is ordinary use and leaves out benchmark and
fixture runs. Nothing enforced it. The only thing keeping the twelve designed
turns out was that they happened before the freeze, which says nothing at all
about the next scripted run — and the session store already holds 481 project
directories from past automated ones, every future sibling of which would have
walked straight into a sample that calls itself natural.
A driven run lives in a scratch directory. So a workspace under a temp root is
not ordinary use, and its sessions never enter the sample. The check asks the
host for the slug it writes such a path as, rather than looking for words in a
directory name: the encoding is the host's own and reading it back is a fact,
while matching "scratch" or "tmp" would be a guess about how someone names
things.
Seven of 488 project directories survive it, and they are the ones a person
actually works in. The count of what was turned away is printed with the rest,
so a sample that stays empty says why.
Twelve turns from a written task list said singletons were 17% of groups and
two thirds of turns had three or more calls to fold. Those numbers answer "how
good can this be where it fits", and they cannot answer "how often does
ordinary use have anything to fold" — the task list decided how many tools
each turn needed, half of it was routed plan-first when nothing in ordinary
use routes that way without being asked, and every one of the twelve called at
least one tool, which no real day does.
So that assay is closed rather than continued. It is recorded as a reference
condition with its raw trajectory kept outside the tree, and the natural
sample starts from its own freeze, after it, from zero. Folding the designed
turns into the natural denominator would put two sampling mechanisms in one
number and neither question would come back out.
The gate is untouched. It was written before any sample existed and has now
seen one; redrawing it here is exactly what would spend that.
Two things the natural sample reports that the designed one had no room for. A
turn with no tool call at all is in the sample, because a fold that has nothing
to show is evidence about coverage rather than a turn to exclude. And coverage
itself is printed and deliberately not gated: adding it to the verdict after
seeing a sample is redrawing the line, while leaving it out of the report lets
a low singleton rate read as broad reach when a fold might touch half the
turns.
The package's own doc now carries what the twelve turns actually established,
which was not a number: three call lifecycles reach a fold and only two of them
are calls, because Partial=true says arguments are still arriving and never
promises that a completion frame follows.
Twelve real turns broke the partition on the ninth. A group closed while one
of its members was still running, which the semantics pass had said could not
happen — and the member was `conclude_no_changes`, dispatched as a streaming
partial and never settled, because calling it is what ends the round. No full
dispatch, no result, and the id stayed open for the rest of the record, so
every later boundary sealed a group over a call still in flight.
The frame's own contract already said this: a partial marks a dispatch whose
arguments are still arriving and promises a full one when they land. For a
tool that ends the round that promise is never kept. So a Call materializes
from a full dispatch or a result, never from a partial alone.
Ten fixtures missed it for one reason worth recording: the stub provider
answers with complete tool calls and never streams one, so an entire class of
frame was absent from every turn the semantics pass ever saw. The fixture
added here drives ChunkToolCallStart with nothing after it and asserts the
record really holds a partial-only id before folding it — a shape test that
never sees the shape proves nothing.
The rule was written after the sample was collected, which is worth saying
plainly. What had been seen at that point was the legality failure and the
frame shapes behind it: 175 calls, 2 never resulted, both partial-only, no
discarded attempts anywhere. None of the assay's five numbers had been
printed, and the rule is read off the field's documented meaning rather than
off anything the numbers do.
Whether a turn's execution is worth offering as one foldable unit is a
question about ordinary use, and the only honest way to answer it is to watch
ordinary use. Designing tasks to cover the interesting cases would put the
task designer's choices into the granularity being measured, which is the one
thing this cannot afford.
So the protocol is fixed now, while no sample exists to fit it to. The first
twenty eligible authored turns after the freeze timestamp, in the order they
happen — not the last twenty, not a chosen twenty, and not twenty-four because
the answer landed near a line. Eligible means the turn carries a named
authored turn, which only the current schema emits and a synthetic
continuation never gets, and that its trajectory reads complete, because a
prefix cannot answer a question about a whole turn.
A turn with no tool calls is in the sample. The question is how much of
ordinary use has something to fold, and dropping the quiet turns would answer
a different one and flatter the feature. There are no route quotas either: the
mix of one-model and two-model turns is reported as a description of what
happened, never selected for.
The tool refuses to say anything but the count until the sample is whole.
Reading a partial result and acting on it is the sequential decision the
freeze exists to prevent, so there is nothing to read.
The verdict is one gate with both halves required — most groups holding a
single call AND few turns having three or more to fold — and failing it is not
an automatic go: a partition can be coarse and still rare, or common and still
thin, and those are different products.
The fold this measures with is the one the semantics pass settled, moved out
of that test rather than copied: two implementations of a partition drift, and
the assay and the fixtures have to be reading the same rules. The gate itself
runs on samples built to sit on each side of it, because an instrument nobody
has seen produce a number is one nobody has checked.
A partition was being argued about frame by frame, which is how a barrier
landing between a dispatch and its result came to look like a boundary between
two calls. It is not: it interrupts one. So the fold now atomizes first — a
tool call is one Call however many rounds it spans and however many decisions
it waits on — and only then groups.
That reordering settled the duplication on its own. Six of seventy-six calls
appeared in two candidate episodes on a real corpus; admitting a call once, at
its first frame, makes that unreachable regardless of where boundaries fall.
What a misplaced boundary leaves behind instead is a group sealed while a
member is still running, whose result then belongs to no group at all, and
that is what the invariant now names.
The candidate grouped here is not the round. Rounds are a structural authority
and two of every three held a single call, which makes them an internal step
group rather than something to offer a reader. WorkGroup-v1 is one producer's
consecutive assistant-owned work across rounds: the producer cuts, a line the
user typed cuts, a turn cuts; a round does not, a settled say does not, and
the host advancing its own task list neither counts as a step nor cuts.
Membership is AssistantWork, not ModelWork. A provider-executed call is not
something the model issued and is still the assistant working, so it needed a
second predicate rather than a widened first one — collapsing them is how the
taxonomy the issuer axis exists for gets folded back up.
Ten rules, each with a turn the production assembly really produced, and six
sabotages that switch one rule off and require a fixture to notice. Two of the
sabotages did not fire when first written, and both were findings rather than
test bugs: one because atomization had already removed the defect it was
looking for, the other because the fixture had no work after the host's
advance for a boundary to cut from.
Two rules are marked as mechanism given the state rather than production
shapes, because they are: a user-issued call admits under its own guard today
and lands between turns, and a turn that never closes is real in the record —
12 of 80 — but not something this harness can produce on demand.
Nothing here ships. It answers which partitions are legal, not whether the
natural granularity is worth an interaction, and scripted turns cannot answer
that second question.
The record and the stream had never been compared. A frontend rebuilding a
conversation from /trajectory was trusted to see what a connected client saw,
and the only evidence was that both came from the same broadcaster — which
says nothing, because the durable log deliberately keeps less: stream deltas,
phase markers and progress ticks never reach it, so any fact that lived only
in one of those is lost on the way back and nothing noticed.
So the two readings are now taken from the same turn and compared. Six turns
are driven through the production assembly — control, eventwire, broadcaster,
wire log, the real /trajectory handler — with a stubbed provider and nothing
else stubbed: one model saying and calling in turn, two models in one turn, a
host advancing a list beside the model's own calls, a provider-side call that
reports a result and never a dispatch, and an approval and an ask landing
between a call's dispatch and its result.
What is compared is what a partition would be computed FROM — turn identity,
producer, issuer, round, call lifecycle, interruptions, settled says — and
never a partition. Grouping is the thing under study, and comparing it here
would only have proved both readings ran the same algorithm.
The asymmetry is the point: the live reading knows a say's text from its
deltas, the cold one has only the settled frame. Three destructive controls
hold that the gate is reading the fields it claims to: strip the producer, the
issuer, or a settled say's text from the cold reading and it must fail. It
does, on both layers.
The second layer is the desktop's own reducer, fed the same turns through a
committed file the kernel regenerates — a fresh store each time, never one
cleared and reused, so a reload cannot pass by borrowing turn-local state the
live run left behind. A staleness gate fails the file when it stops being what
the kernel emits, because a reducer checked against a shape nothing produces
is checked against nothing.
A tool frame said what ran and never who asked for it. Three provenances
share one id namespace and one shape: calls the model issued, calls the host
minted for it — seeding an approved plan's list, advancing a step, closing a
goal, expanding one delegation call into its items — and calls the provider
ran on its own side. A person's slash command and inline shell line are a
fourth. Reading a real corpus, 5 of 51 candidate execution episodes were
headed by `plan-seed`, the host's own bookkeeping, which any fold counting
steps would have credited to the model.
Nothing downstream can recover this. The shapes that look like provenance are
transport facts: a provider-side call has no dispatch because it never had one
to emit, and an attempt id marks a speculative partial, not an author — the
provider-side result carries one and was not issued by the model. What is left
is matching id spellings, which is what this tree does not build.
So the issuer is set where the invocation is decided, and it is a second axis
rather than a widening of Source: Source says who wrote the frame, Issuer says
who asked for the call, and one executor frame can carry any of the four. It
holds for a call's lifetime — a dispatch and its result cannot disagree about
who asked — and a result-only call carries it alone, with no dispatch invented
to hang it on.
ToolIssuer.ModelWork is where "is this the model working" lives, so an unset
issuer answers false rather than guess: guessing model is what counts a seeded
task list as a step. The gate is checked destructively — flip the host's
issuer to model and the count changes, which is what makes the field, and not
the call's shape, the thing being read.
/trajectory answered with a bare array, and three different states produced
the same empty one: a run nothing records, a log the capacity cap stopped
extending, and a recorded session that had produced no frames. A consumer
reading the last frame as the end of the run was right two times in three and
had no way to know which.
The read model now carries its own coverage. complete means no frame was
refused between the session's start and what is durable now — and an empty
events list under it means the session produced none. truncated means the
frames are a prefix and nothing more. not_recorded means nothing recorded this
run at all, which is what a studio pane is before its first turn.
Truncation is a durable fact or it is not a fact: the refusal happens in one
process and nothing in the bytes it leaves behind records it, so the cap writes
a witness beside the log. A log's own size is not consulted — past the cap the
next frame will be refused, but until one is nothing has been dropped, and
reading truncation off the size reports a session that grew large as one that
lost frames. not_recorded likewise comes from the writer's own precondition,
never from a missing file, which cannot tell a run with no recorder from one
that has not written yet. A log that cannot be read is refused rather than
answered: an empty array is a claim, and a failed read supports none.
The pane says which of the three it is holding, and the exported file carries
it too, since that file outlives the window that made it.
A two-model turn put two producers on one stream and said nothing about
which was which. The kernel knew — the planner's sink has labelled its
events all along — but eventwire had no field for it, so the label died at
the transport. Everything downstream was left with the same guess: read
the last phase marker before the frame. That is an adjacency, not a fact,
and the record does not even keep phase frames, so a rebuilt transcript
could not make the guess at all.
Producers now name themselves. An agent is built for a role and labels the
frames it settles; a forwarder that re-parents another agent's work
relabels on the way through, because in the parent's stream a sub-agent's
call is the sub-agent's whatever role the child plays in its own. The
field crosses eventwire, so it is on the frames the record keeps, and a
card rebuilt from those frames carries it.
Streaming deltas stay unlabelled, and finding out why was the useful part
of this cut. Coalescing merges only deltas that carry nothing but text —
it decides that with a zero-probe, so any new field on a delta silently
turns the whole optimisation off, which is exactly what labelling every
frame did: forty provider chunks reached the frontend as forty events. A
delta is a fragment of a message whose settled frame names its producer,
so naming the fragment says nothing new and costs the stream. The boot
effect test is what caught it, at the boundary it was written for.
That leaves one asymmetry already in the tree: the planner's own text
deltas have carried a source since before this change, so they have never
coalesced. Not touched here — it is the coordinator's direct emissions,
not this seam, and the card takes its producer from the settled frame
either way.
The destructive control runs both ends. Strip the field from the transport
and a real two-model turn fails on the frames themselves; strip it from
the frames and the cards go unattributed rather than falling back to the
nearest phase marker — which would look right in the fixture and be wrong
the moment a frame arrives out of the order the markers suggest.
Tool cards do not carry it yet. The fact is on the frame they fold from,
so that is a projection when episode membership needs it, not another
fact to establish.
A reopened session lost every answer the planner ever wrote. The record
keeps no streamed deltas — one frame per chunk, most of the file, nothing
to read back — so a replay has only the settled `message` frame, and the
reducer could not build a card from one: it knew how to seal a card the
stream had already opened, and nothing else. Feed it the record and it
produced tools with no answers between them.
The frame is the assistant turn in its settled form, so one fold now
serves both directions: it settles the open card when the stream opened
one, and builds the card when nothing did. Measured on the recorded
routes, a two-model turn's replay goes from two items to six — the same
six the live stream drew, planner's plan text included — and the
conclude-no-changes route from two to five.
The frame also wins on content, which it had already earned: it carries
the display-correct text with the host's own markers stripped, and the
reasoning an extension may have replaced, emitted precisely so what is
shown and what is persisted agree. So a stream that lost a chunk is
repaired by it rather than left short. An empty field is not content and
overwrites nothing: a tool-call round settles with reasoning only, and it
must not wipe the answer already on screen.
That closes the fork this series was heading for. The durable execution
trajectory does not need building — it exists, and it already carries the
planner's work; what was missing was a reducer that could read it.
The say card's lifecycle moves to its own file with the fold, and the id
sequence to another. Both files were at the 800-line ceiling, and the
streaming, sealing and materialising of one card is a single concern that
had been living inside the reducer. The sequence had to come out for the
new file to mint an id without importing the reducer back.
Reopening a session with an approved plan in it drew a user bubble nobody
had typed. The host writes a continuation into the transcript to carry
approved execution — "Plan approved — plan mode is off…" — and the rebuild
turned every user-role message with text into a card, so a line the host
wrote came back attributed to the person. Live it was never a bubble at
all, which is the shape of the problem: one message, two truths, and the
one that survives a reload is the wrong one.
Authorship is now declared where it is known. The host composes those
lines, so the host says so: the turn boundary control already hands the
runner — it says whether this run continues a turn already announced —
gains the other fact it had all along, and the landing seam stamps it onto
the message. /history projects it, and the rebuild draws no bubble for it.
Declared, not recognised. There is a prefix table in this tree that spots
host-injected text, and it would have been one line to reuse — and wrong
in both directions: a user who types the sentence the host injects loses
their own message, and a continuation phrased any other way keeps
impersonating them. The control runs both ways at the kernel and again at
the rebuild, and the two cases differ only in the flag, never in what they
say.
The two facts stay apart on purpose. A turn that opens no authored turn is
not the same as a message the host wrote: a user's line only has to read
like one of the host's to open no turn, and it is still theirs. So the
boundary carries them as separate fields rather than reading one off the
other's absence.
At the HTTP boundary an approved plan now leaves exactly one user line in
the record, and it is the one that was typed. Measured on the real thing:
the live/reload census fixture for that route dropped its phantom row.
ParseImageDataURL moves to its own file. provider.go was at its recorded
ceiling and a struct field cannot be added to a file that may not grow;
the parser was the piece with least to do with the message model around
it, and moving it is what made room rather than widening the budget.
Sessions recorded before this carry no declaration, so their host lines
still draw a bubble. Nothing reads the wording to guess at them.
A turn had as many starts as it had model runs. The coordinator opened one
before planning, the executor opened another before working, and a plan
approved mid-turn opened a third — so "a turn began" meant "an agent run
began", and the only thing telling the two apart was whether the event
happened to carry an identity.
The route that made this worse than untidy is production-reachable. When
the planner concludes no changes are needed, no executor ever runs: the
user's message is written straight into the transcript by the coordinator,
and the turn's only start was the bare one from before planning. So a
durable authored message existed that the live stream had never named —
the row got no rewind entry until the session was reopened and the
transcript rebuilt. Two truths about the same message, which is the thing
this series exists to remove.
Control now opens the boundary. It already had both numbers before any
work could produce the message: the index it opens the checkpoint at and
marks the turn in flight with, and the raw authored text it puts in the
context itself. It publishes them as one TurnStarted before the runner is
called, and hands the runner the identity to land on. Four seams take it:
the orchestrated turn, the headless one, a synthetic continuation (which
carries ownership with no identity, because it belongs to a turn already
announced), and the slash-invoked subagent skill — that last one was a
fourth start emitter and a third place that appended the user's message,
found while doing the work rather than in the preflight that preceded it.
Identity is the host's; representation stays with whoever writes the
message. A plan-and-execute turn still persists the handoff as Content
while the user's own words stay in RawContent, and that distinction is
worth keeping. What the seam takes away is the freedom to disagree about
which message the turn was about: the raw authored text comes from the
published identity, and the landing is checked against it. The check
detects and cannot repair — the name is already out — so a break is an
operator notice with a code, and the durable index stays the authority a
reload reads.
persistExecutorNoOp lands through that seam now rather than composing its
own message beside it. It had been setting RawContent empty whenever
nothing wrapped the input, which left the classification reading a
different field on that path than on every other; it agreed with the
others by coincidence, and the coincidence is now a contract.
Suppression is declared, not observed. A run reads a host boundary out of
its context; nothing infers that it has been announced because an event
already reached the sink. A standalone Agent.Run is still its own
lifecycle owner and still announces — that contract is not collateral to
a desktop fix.
The coordinator's filter on planner lifecycle events is NOT dead and was
kept. Under a host boundary the planner announces nothing, but standalone
it still opens a turn over its own session, and that name would reach the
parent as a second answer to which message the turn is about. A test runs
both ways rather than a grep deciding it.
Six production routes are now a matrix rather than an observation:
executor-only, plan-and-execute, conclude-no-changes, an approval the user
denied, planner failure falling back to the executor, and the subagent
skill. Each asserts one named start, no bare one, one end, that the start
precedes every visible piece of work, and that the message it named
classifies as the authored turn it said. Each also asserts whether the
executor ran, so a route that quietly took another branch cannot satisfy
the matrix. The negative control holds the other end: an approved plan's
execution opens neither a start nor a done of its own.
Two deliberate behavior changes come with the ownership move. The text
renderer resets its per-stream state on a phase marker instead of on a
second turn start, so the executor's thinking still gets its own header
now that planner and executor are one turn; a byte-exact dual-model
fixture pins that boundary. And telemetry's turn count changes meaning: it
counted starts, so a two-model turn counted twice and an approved plan
counted again. It now counts authored turns, which is what the metric was
always named after.
Not in this cut: which items belong to a turn, and where an execution
episode begins inside one.
turn_started carried nothing, so a client that mints its own user row had
no way to learn which message the kernel had just written for it. The row
and the snapshot taken for it were paired by position and confirmed by
prompt text — which is why two identical prompts could only be told apart
by luck, and why a steer sitting in the transcript shifted every pairing
after it.
The event now carries the message's provenance: AuthoredTurn, the number
the conversation gives the turn this message opens, and MsgIndex, the
session index it takes. They are two namespaces and neither is the
checkpoint's Turn, which numbers snapshots — the first authored turn is 1
while the first checkpoint turn is 0, and TestCheckpointTurnIsNotTheAuthored-
Turn reads both off one real run so an implementation that sourced one from
the other cannot pass.
One rule answers both projections. ClassifyTurn is what the display-index
sidecar already counted a transcript with, now named and exported, and the
live path asks it the same question about the message it is about to
append. The message is composed before the turn is announced so the
announcement can classify what actually goes out rather than a stand-in
for it, and the prior count is re-derived from the transcript rather than
tracked beside it — a second counter is a second thing to be wrong. A turn
that opens no authored message (a steer, a host-injected turn) names none
rather than minting a number.
The join then goes structural on both sides. checkpoint.Meta carries the
boundary it was opened at, /checkpoints and /history publish it, and
pairCheckpoints is a lookup on that index — no position, no prompt
equality. A row that names no message gets no rewind entry at all, which
is the right refusal: a rewind cannot be undone, and an entry against the
wrong turn throws away work nobody asked to lose.
The client joins by causation, not by adjacency: a send is remembered
until the kernel names a message for it, in the order the sends were made,
and a name that no longer names a row — taken back, or replaced by a
rebuild — is dropped rather than handed to the next turn. Guidance queued
mid-turn never joins that line, because it starts no turn of its own.
Six proofs, at the three boundaries: the agent alone names its turn (that
layer cannot import control, so no checkpoint state can reach the number);
the live number and the durable display index agree about the same message;
a steer and a synthetic turn each mint nothing and leave the number for the
next real turn; the checkpoint boundary equals the index the event named;
and at the HTTP boundary two identical prompts pair with their own
snapshots.
Not in this cut: the other eleven item kinds still carry no turn. Which
items belong to a turn, and where an execution episode begins inside one,
is a separate question — this only establishes the boundary it would be
asked about.
classify follows the callbacks a .then/.catch/.finally is handed, and only
where the fact proves the receiver. The edge is deferred, because a
handler that mutates when the request comes back is not one that mutates
now. .then's second slot is the rejection handler and carries the edge
.catch carries, so which member was written decides nothing. And an
optional continuation keeps MayCall at the hop that may skip it rather
than flattening it — the first draft reached the write and lost the
evidence, which is the failure the optional-call round was about.
Eight roots move, every one UNRESOLVED to READ_ONLY, and every one inside
the thirteen whose only open cause was this selector. No MUTATION became
READ_ONLY and no READ_ONLY became MUTATION. 410 roots, MUTATION 146
unchanged, UNRESOLVED 112 to 104, READ_ONLY 152 to 160; the selector falls
from twenty-one sites to eight, and those eight are exactly the sources
this cut declined to build — a static factory, an async function's return,
a binding typed Promise, a prop call — rather than anything it should have
proven and did not.
The sixteenth invariant holds the boundary: a continuation the walk
executes must trace to a declared return type. Adding an opaque call
result as a source turns it red on both trees and turns PC4 and PC6 into
mutations the corpus is not declared to have. PC6 is the case that
matters — the receiver is PC1's proven type and the member is spelled the
same, and only the declared return type differs.
One thing was wrong for the right reason and is fixed with it. A mutation
reached only through a continuation or a timer was reported as a direct
call on the interaction axis, which is a claim that pressing the control
writes; the family now comes from the edges the walk recorded. It changes
no production count today — no root here writes only behind a deferred
edge — and it is what the day one does will say.
promises.mjs answers one question and refuses to answer a second. A value
is proven to be a Promise by a return type the source declares on a member
of the type its receiver is annotated with, or by being a continuation on
something already proven — a fixpoint over the receiver chain with no hop
limit. Only a literal Promise<T> counts: a union that may not be one, an
alias nothing here follows, PromiseLike, any, and a tree that declares its
own Promise all state nothing. Which type a receiver has comes from the
authority that already answers it, lifted out of receiverKind so the two
readers cannot drift apart.
The order is the point. Taking `.then` off the member and concluding the
receiver was a Promise is a circular proof, and it would buy an execution
edge into whatever that call was handed. Every receiver that stays
unproven is reported with the mechanism behind it — an opaque call result,
a binding the source types Promise, a member the declared type does not
have, a receiver nothing types — because naming a shape is not claiming
it, and the next cut is chosen off that table.
Nothing consumes the fact yet. All twenty-nine reports over both trees are
byte-identical to the revision before this one, which is what will make
the verdicts that move when a continuation becomes an execution edge
attributable to that and to nothing else.
tools/ui-census reads the interface and answers which inputs can change
host state, which of those the product names an action for, and why the
rest cannot be decided. Twenty-two modules over one certified universe:
410 interaction roots, and every verdict carries either a positive
witness or the open edges that stopped it.
Fifteen invariants run in CI. UNDECLARED_MUTATION == 0 is the one this
exists for — an input proven to write with no identity — and it has
reopened three times under real defects rather than sitting decorative:
a memo alias that hid a prop chain, a JSX spread that hid another, and an
optional call the walk could not see. Three more hold holes that are
measured and empty rather than argued: a platform scheduler, a prop
heuristic, and a spread that a later attribute may override.
Judgements read structure. A listener registration, an event parameter,
a promise receiver and a component identity are facts certified once and
consumed by every reader, because the alternative is a member name
deciding what a value is — and this series found that reader disagreeing
with itself three separate times.
_fx is the corpus the rules are exercised against, and its reports are
frozen: the product's name every root by file and line and are stale the
moment a button moves, so only the fixture's can be a permanent gate. The
invariants it breaks on purpose are declared, and it is held to exactly
that set.
Ninety data-action declarations across the interface, and the registry
that says what each id claims to be. Identity is the product's: an id is
<surface>.<intent>, written as a literal at the control and written again
in actions.ts, so the two can disagree and be caught — sharing a constant
would make the check compare a value with itself.
The attribute carries membership only. Which entry a click is about rides
on data-target and which of several answers it gives rides on data-value,
so a row rendered seventy times is still one contract and 「取消」 is
never an identity. An element carrying several handlers takes a scoped
data-action-<event>, because a single declaration there cannot say which
input it names.
Six of these ids exist because a census proved the input writes and the
product named nothing: session.open and remote.open for the workspace and
remote trees, workspace.add, extensions.submit, and file-revert and
rewind's prepare/commit pairs — planning a revert and performing one are
two contracts, and a person who stops between them has done nothing.
roots.ts answers a question two readers were answering differently: the
repository's gate looked at onClick and onDoubleClick, which left every
onChange, every keydown and every DOM listener outside the set it was
meant to be guarding. Certification is two independent questions and
neither may answer the other — what the registration is on, and whether
the event is something a person does to the page — so a data-action says
which action an input belongs to and never whether it is one.
listen.ts is where a DOM listener can carry that declaration. A button
has an attribute and the shortcut table has a field; a listener had
nowhere to put one, so every keyboard entry point was outside the action
vocabulary. The declaration belongs to the registration rather than the
callback: one function registered on two targets is two entry points.
Nothing references either yet. They land first because everything that
does — the vocabulary, its census, and the gate over both — cannot
compile without them.
Every version's notes live in release-notes/studio/<semver>.md and this
one was tagged without them, so the release published the standing text
and a warning. The file lands here for the line's own record; the
published body is set from it separately, because the workflow reads the
notes out of the tagged commit and this is not in it.
studio-v2.13.0 built every package and then failed at "Collect artifacts":
`find: 'staging/cli-archives': No such file or directory`.
The previous change was right about the rule and could not hold under the
download it was written against. Taking the CLI archives by name matched
the reasonix-studio-host.exe the signing flow leaves behind, so it moved
to taking them from their artifact directory — but the download asked for
merge-multiple, which is exactly the option that flattens those
directories away. The path it looked in never existed, and only a tag
runs this workflow, so nothing said so until a release.
Both sets now come from their own artifact. Dropping merge-multiple is
what makes that possible, and it closes the same hole on the other line:
the SignPath flow uploads the unsigned installer it hands over, that file
is named ReasonixStudio-* too, and a flattened staging directory let
whichever move ran last decide which one shipped.
actionlint's shellcheck reads `.deb` inside a single-quoted printf format
as a command substitution that will not expand (SC2016). They are Markdown
for the notes, so the string says so instead: double quotes with the
backticks escaped produce the same bytes and no warning. Verified against
the same actionlint invocation CI runs, with shellcheck 0.11.0; restoring
the single-quoted form reports the issue again.
Nothing in this repository changed to cause it — the runner's shellcheck
did — which is why it appeared on a workflow no commit had touched.
The windows-latest crash moved rather than went away: 1.26.6 found a bad
pointer in the heap during a Green Tea mark; 1.26.8 threw
"runtime.preemptM: duplicatehandle failed; errno=6" — ERROR_INVALID_HANDLE
on a thread handle the runtime owns. That is not a runtime bug. It is what
a process looks like after it closes a handle it does not own.
internal/extension/sidecar closed the Job Object twice. kill() called
proc.KillTracked, which releases the handle, and then finishJob(), whose
sync.Once had not fired yet and released it again. kill() is reached from
four places, two of them `go c.proc.kill()`, so it also raced with itself.
Windows reissues a freed handle value, so the second close lands on
whatever now holds it — a thread handle, and preemption then fails.
internal/extension/sidecar is the package the crash reported.
internal/plugin had the other half: close() is not guarded, so two calls
took KillTracked twice; and its graceful path returned without releasing
at all, leaving a KILL_ON_JOB_CLOSE handle open for the life of the
process and reaping nothing the server had detached.
Rather than ask three callers to remember, the handle now owns its own
release. StartTracked returns a *TrackedJob whose Kill and Finish share
one sync.Once; killTracked and finishTracked are unexported, so no caller
outside this package holds a raw handle to close twice. internal/proc's
own TrackedCommand, which had hand-rolled the same guard, uses it too.
The test counts releases through a substituted release func: off Windows
the real one is a no-op, so a test that watched the handle would pass on
the platform where the bug cannot happen. Restoring the old shape — a
release outside the one-shot — makes it report nine releases where one is
owed.
The windows-latest crash is the GC finding a bad pointer while marking:
runtime.scanObject in mgcmark_greenteagc.go, under gcDrain. Green Tea is
the detector, not the cause — turning it off would move where the
corruption surfaces, not stop it, so this does not do that.
Two things in that binary can produce it and were both behind. The Go
toolchain moves 1.26.6 -> 1.26.8, which carries compiler and runtime
fixes; and modernc.org/sqlite moves 1.57.0 -> 1.58.0, taking libc from
1.74.4 to 1.75.6. libc is the only unsafe-heavy code linked into that
test binary that is not the standard library, and internal/bot reaches
it through historycatalog and projectiondb. Neither upgrade is proven to
be the fix: one crash cannot attribute itself, and golang/go#81238 —
windows/amd64 exception recovery writing below a goroutine stack — is
open, unfixed, and the same class. If it recurs on these versions, that
issue is where it goes.
covergate was red on a third path this had not read: internal/sandbox is
78.0% on linux against a 78.1% floor, while the same tree measures 78.1%
on darwin. The package compiles a different set of files per GOOS, so a
floor recorded on one platform can be unreachable on the one the gate
runs on. Rather than lower it, three statements nothing reached are now
covered — podman's per-user socket, an authority the table does not
govern, and a nil context carrying no escape approver — which takes
darwin to 78.9% and lifts linux above its floor by the same edges.
covergate now names the lines it is short of. A percentage alone left
whoever has to restore it measuring a package by hand on a platform they
may not be on, which is how this one sat red across three runs.
go.mod tidy in desktop/ failed because the root module moved x/crypto to
v0.56.0 and the nested one still pinned v0.55.0. The dependency is
indirect there, so nothing local reads it — and nothing local runs that
tidy either, which is why the root gates passed while the desktop job
did not.
third_party/go-webview2 is left alone: it is a vendored fork with its
own module, CI runs only its tests, and tidying it would rewrite a sum
nobody asked to move.
govulncheck: x/crypto v0.55.0 reaches the advisory through
remote.newSSHClient. Bumped to v0.56.0, which is where it is fixed.
race: matrixSink folds graph deltas in place, and a fan-out publishes
from every worker's own goroutine. The sink now holds its own lock;
agentgraph.Graph is a pair of slices, and the production reader that
folds deltas does it on one goroutine.
covergate: two branches added with the adjudication barrier were never
reached. liveBarrierIDs was only ever asked about asks, so a live tool
approval read as an abandoned obligation; and Ask's refusal when the
barrier cannot be recorded had no case at all. Both are now tests, not
a lowered floor.
macOS: TestDeniedAuthorityIsNotInheritedThroughADescriptor read the
inherited socket once, immediately after dialling, while the peer writes
the marker only after its Accept returns. The positive control lost that
race and the test correctly refused to pass vacuously. The scan now
retries for five seconds, which is also the stronger claim: a clean
sandboxed result means seconds of trying found nothing, rather than one
instant. Reproduced by delaying the peer's write, and the fix holds with
that delay still in place.
The windows-latest crash in internal/bot is not addressed here: it is a
runtime GC fault in a package with no unsafe and no cgo, it passed on
the three preceding runs, and nothing in this tree explains it.
Thirteen more Tier A sites, taken as a cluster rather than in file order so
naming drift shows up while the vocabulary is still in hand: everything that
writes a permission rule, everything that moves the sandbox, everything that
changes what an endpoint is asked to do.
The resolver that found them was wrong, and one of its answers is what said so.
It reported a fold toggle in the rules panel as reaching savePermissions, which
is not something a fold does. The cause was that it followed every identifier a
handler mentions, against a table of locals collected file-wide with no regard
for scope — so a closure parameter named n, or s, or g, resolved to whatever
else in that file happened to share the name. A click reaches a mutation by
calling something, not by mentioning it, and that is what it now follows.
So the Tier A count in the previous change was inflated. Five of the fifty-nine
were that mistake. The number is not the finding here; what the number counts
is, and it had been counting coincidences of spelling.
Two ids stayed two segments rather than three. permissions.add-rule reads as one
surface with one intent, which is the rule; permissions.rule.add reads as a
sub-surface, and inventing those is how a vocabulary starts describing the code's
layout instead of the user's intent.
Four of the thirteen are the sandbox's own controls and one is a permission
rule's removal, so they carry authority-effect: what these claim to change is
what the host is allowed to do, and a promise resolving is not evidence of it.
Nothing proves that yet — the proof column is what the contracts will have to
satisfy, not a claim that they already do.
Naming the two hundred and forty-nine anonymous controls in one pass would have
been labelling, not census. What the risk tiers needed was a fact, and the one
available is what a click reaches: not the button, not its wording, but the port
method behind it and whether that method's own transport posts or gets.
So the resolver follows a handler through the locals of its file and then out
through its props — every place the component is rendered, what the parent
passes for that prop, up to four hops — and lands on the port calls a click can
actually reach. Then the port's implementation classifies itself: a method whose
body reaches post, patch or delete changes canonical state, one that reaches get
does not. A name says nothing here and a return type says almost nothing, since
an enqueue answers with a receipt.
Of the two hundred and forty-nine, a hundred and sixty-five never leave the
page, twenty-five only read, and fifty-nine write across thirty-nine
capabilities. That is the Tier A set, and it is derived rather than judged.
Eleven of them are named here, with the ids the registry now carries: the two
account switches, the ask card's two answers, memory's save, restore and forget,
the config repair, the extension reload, the storage move and the network probe.
The queued line's take-back in the transcript turned out to be queue.cancel
already — the same action the pending strip renders, which is the point of an id
being a semantic class rather than a place.
The ceiling falls to two hundred and thirty-seven and the rest of Tier A is next.
One site in it will stay anonymous on purpose: the switch primitive resolves to
six different capabilities because it is whatever its caller is, and its identity
belongs at those call sites, which already pass it.
A token the endpoint had just turned down was retried unchanged, because the
forced refresh asked the wrong question. It reloaded the stored credential, saw
that the local clock still liked it, and returned — so the retry went out with
the one that had already been refused, and the failure that followed looked like
the server's rather than ours.
The judgement it should have been making needs an identity the call did not
carry. forceRefresh was a bool: it said "refresh" without saying which
credential had been refused, so "the server rejected what I hold" and "someone
else already replaced what I hold" arrived as the same request with the same
argument. No condition written inside could have told them apart. That is why
this is a signature and not an if.
So the ask names the credential that actually went out. Not the one in the store
by the time the 401 came back — that is precisely the one another actor may
have replaced it with, and re-reading it there erases the fact the decision
turns on. Two call faces rather than a nullable at every call site: the ordinary
one, and the one that has a refusal to report.
Under the lock, the stored credential is used instead of refreshing only when it
is both usable and not the one that was refused. Identity alone would send a
replacement that had itself expired; freshness alone is what let a refused token
through, since a server saying no is a fact about the credential that this
machine's opinion of its expiry cannot answer.
Five arms, and each was checked by breaking it. Restoring the old shortcut turns
the refused-token arm and the end-to-end recovery red together. Making a
rejection refresh unconditionally — the fix that looks right — turns the
concurrency arm red instead, a refresh storm caught before it was written. An
expired replacement is refreshed rather than sent. A rejection naming a
credential this client never sent changes nothing. And the ordinary request
still touches no endpoint and leaves the store byte-identical, because this is a
fix to the rejection path and daily traffic should not have got more expensive.
The tripwires from the previous two changes are gone, replaced in place by the
contracts they were holding open: a 401 the transport recovered from is now
proven never to become a failure, which is the negative control any future
classification of terminal auth outcomes has to sit on.
Still not claimed: what a refresh that genuinely fails means for the reader. No
refresh token, an authorisation server that declines, an endpoint that is down,
a 401 that survives a successful refresh — four different things to do next, and
the row goes on offering to reconnect rather than guessing between them.
No production change. This is the slice that decides what the fix has to be,
because the obvious one is wrong and the tests below are what say so.
The credential's identity is the access token. It is the bytes the server was
shown and refused, nothing else in the stored state names a generation, and
none is wanted: a refresh that handed back the same access token would not have
moved the state either. So the question a forced refresh answers is not "is
this token stale by my clock" — which is what it asks today — but "is the one
the server just refused still the canonical one".
Three arms, and two of them already hold. An unrefused token the clock likes is
sent as it is, and a token another actor replaced while we waited for the lock
is used rather than refreshed again — that second one is the concurrency the
existing short-circuit was carrying, and it is now a test rather than a side
effect. Both were checked against the fix that looks obvious: making a forced
refresh unconditional turns the concurrency arm red, which is a refresh storm
caught before it was written.
The third arm is the gap, asserted as it behaves. A refused token that is still
canonical is handed straight back and the endpoint hears nothing — pinned at
the primitive, and again through the production chain, where a real 401 is
retried with the very credential the server just declined. Two requests, two
identical Authorization headers, no refresh. The coarser tripwire from the
previous change is retired into these, which say the same thing with the
witness spelled out.
And the reason a one-line fix cannot do it: nothing tells the refresh which
credential was refused, so the arm that must change and the arm that must not
arrive as the same call with the same argument. That is pinned too. The
signature is where this gets settled, not an if.
What is still not answered, deliberately: whether a refresh that genuinely fails
means the user must authorise again. Invalid refresh token, an authorisation
server that declines, no refresh token at all, an endpoint that is down, a 401
that survives a successful refresh — those are five different things to do next,
and the corrective action stays unclaimed until they are told apart.
The reconnect button said 「重新授权」 when a regex found 401, 403 or the word
auth in the failure text — and that text is what an external MCP server wrote
about itself, which this host then sanitised and truncated to four hundred
graphemes on the way through. A repair the user is told to perform was chosen by
a stranger's prose, and truncation could take the word out from under it either
way.
The status now travels as the number the host held: httpStatusError, read once
at RecordFailure where a failure is known to be terminal, onto Failure and
across the wire to the row. mcpEntry and McpEntry are a declared mirrored pair
now, so a status one side sends and the other cannot read fails wire-parity in
both directions.
It arrives as a fact and stays one. The row prints HTTP 401 beside the transport
and offers 「重连」, because whether a 401 means the reader must authorise again
depends on whether the automatic refresh actually ran — and it does not, for a
token the server rejected while the local clock still likes it. Claiming
otherwise would swap a regex nobody trusted for a typed judgement everybody
would. So no reason is derived, no enum is introduced, and 401 and 403 are not
folded together on the strength of HTTP folklore. Fewer claims than the old row
made, and every one of them true.
The four counterfactuals are what this is for. Prose carrying every word the old
regex looked for buys no repair offer; a typed 401 next to the detail "banana"
prints the status and still claims nothing; the detail is displayed and never
branched on; and a failure that was not an HTTP one says nothing about a status
at all.
Two guards came out of breaking it. wire-parity compares type declarations, so
deleting the assignment that fills the field passes every check in the tree —
that arm is now a real 401 driven through a host, a controller and the endpoint,
and it fails with the sentence the row would have been reduced to reading. And
the forced refresh that does not force is a tripwire in internal/plugin: it
passes today by handing back the refused token, and the day it fails is the day
someone fixed the recovery and owes the real negative control.
plugin.go was one line over its budget with the field in it, so the failure
record moved out whole — the type, RecordFailure and its two neighbours — into
failures.go. The file gives back sixty-six lines it had been carrying.
Five places turned a non-2xx answer into fmt.Errorf("... http %d ..."), and the
host knew the status at every one of them. Downstream nobody did: a failure
record keeps prose, the settings row above it keeps a sanitised and truncated
copy of that prose, and the frontend was left running /401|403|unauthorized/
over text an external server had a hand in writing — recovering, by regex, a
number this package had held one frame earlier.
So the status travels as a number. Error() renders exactly what it rendered
before, because everything that only displays this — diagnostics, the redaction
pass, the row — should see no change at all; what changes is that reading it no
longer means parsing it. Only the identity was added: no Method field, no
classification, nothing without a reader yet.
The session-expired answer keeps its own identity, and that is the arm this
change could have swallowed: a 404 carrying rpc code -32001 is something the
host silently re-establishes rather than a failure to report, and it is now
pinned as not also reading as a plain status.
Nothing classifies on this yet. Deriving a reason at RecordFailure is the next
step and it has a blocker of its own, found by trying to write its negative
control: the reactive refresh does not fire for a token the server rejected but
the local clock still considers valid, because refresh() returns early on
oauthAccessTokenUsable before it looks at whether forceRefresh was asked for. So
a 401 reaching the terminal path today does not yet mean "the user must
authorise again", and a classifier built on it would say so anyway. That is a
credential-path behaviour change and its own decision, not a detail of this one.
Seven exits in catalog.go answered 400 for everything, and behind each of them
were at least two different things: a skill nobody declared and an activation
file that would not open, a server that would not start and a lock another
process held. The endpoint was not the owner of any of it — it was reading
whatever error arrived and picking one status — so a failed disk told the user
their request was wrong, and a frontend had nothing to tell the two apart by.
The census came first and it changed what this fixes. There is no stable domain
family here to code: exactly two domain conditions exist, both fmt.Errorf, and
one of them was spelled out in three separate files. And they are the same fact
— a named thing is not there — which this tree already carries an identity for.
So the domain half needed no new codes at all. It needed the owners to say what
they meant: skill.NotFoundError where skills are resolved, config.ServerNotFoundError
where configured servers are, and serve's second copy of the MCP judgement
deleted rather than typed a second time.
Deliberately not one ErrUnknownCapability. Skills and MCP servers both happen to
have an unknown-name condition today; that is a similarity in wording, not a
shared owner, lifecycle or namespace. If a third and fourth turn up with the
same lookup contract, that is when it is a fact worth merging.
The activation store now says which way it failed. A malformed file is
UnparsedFile — the identity that already carries a path, a line and an excerpt,
because it is the one internal-looking failure a person can go and fix — and
read, write and lock failures are one sentinel, because they are one answer to
whoever flipped the switch: it did not stick, and none of them is their doing.
Notably the malformed arm is fixed by this alone: reverting the transport
classifier leaves that test green, which is what "the owner is where this
belongs" looks like from the outside.
The join in SetMCPServerEnabled kept one fact and lost the worse one. A server
that will not start and whose switch was put back, and one whose switch could
not be put back, are not the same place to be left standing — the second is
persisted state disagreeing with the runtime, and it is now checked before the
failure it accompanies rather than folded into it.
Dependency answers 409 rather than a status invented for it. The request was
fine and the world does not satisfy it, which is what this tree's other "not a
fault" refusals answer; whether a server that will not start deserves a class of
its own is for the MCP failure taxonomy to settle, and that is its own probe.
An unclassified failure is now internal rather than a bad request. A failure
nobody named is not evidence that the request was wrong, and the old default
said it was.
One stale claim came out of the same file: skillEnabled's doc still said the
runtime serves the old prompt index until a rebuild, which stopped being true
before this branch started and was fixed in four other places.
Nothing in this tree could say which actions Studio offers. A hundred buttons
answered to their own handler and to nothing else, so "does every button work"
had no subject to range over — the question needs a set before it can have an
answer, and any set kept by hand would be wrong within a month.
The census found 280 interactive sites across seventy files, and three things
worth having found. Only sixty of them are anything but a plain <button>, so a
check that looked for buttons would have missed a fifth of the surface. Five
kernel capabilities are driven from two components each — preset, plan mode,
pickFolder, probeProvider, checkProvider — and only the first was inconsistent,
which the previous change had already fixed; the others were checked one by one
rather than assumed. And the wording is useless as identity: 「取消」 is
seventeen buttons reaching eight destinations, 「关闭」 five reaching a panel, a
dialog and the window itself.
So an id is <surface>.<intent>, written as a literal at the control and again in
a registry that production may not import. Two spellings that can disagree is
the entire reason the check is worth running; one shared constant would compare
a value with itself. The instance rides on data-target and the answer on
data-value, so a row rendered seventy times is one contract, and an approval is
decision.tool with a verdict rather than three ids named after button text —
the kernel takes one decision with an answer, and the id follows the port, not
the label.
A control that is genuinely two actions may branch, as long as both are written
down: send and stop share a button, and Escape is the same pair on one key. The
window's shortcuts became a table for this reason. They were a chain of ifs,
which is a set nothing can enumerate; now each names the action it performs, and
it is the same id the control on screen carries, because they are the same thing
asked for two ways. No action here is reachable from the keyboard alone, so
there is no flag saying one is — the day that changes, it is a field with a
reader.
Twenty-five actions, thirty-four sites. The remaining two hundred and forty-nine
are counted and ceilinged rather than left uncounted: a registry that covered an
eighth of the surface while nothing said so would read as the whole set, which
is the failure this was built to prevent. The ceiling may fall and never rise.
Every direction was checked by breaking it: an unregistered id, a registry entry
nothing renders, an id assembled at runtime, one more anonymous button, a
production file importing the oracle. A sixth arm came out of that pass — the
parser recovers from some breakage rather than throwing, and a file that stopped
parsing would contribute no sites while every count above it read as an
improvement. Hard breakage throws and fails the run; the recoverable kind is now
named per file.
The tree spent two changes giving refusals an identity — dotted codes at the
HTTP boundary, a sentinel family behind them — and then twenty-five panels
printed the caught error's own message, which is the English that rode along for
the log. A coded refusal arrived untranslated; worse, a kernel that was simply
not there arrived as an internal path and a status number, because HttpError's
undetailed case is exactly what message cannot say.
Every one of them was the same expression, and every one of them was a sink a
reader looks at: an errbar, a .why line, a panel's failure row. No developer
sink and no control-flow read among them, so the migration is uniform —
reason(), which is a superset: it says a coded refusal in this window's
language, gives the undetailed case a sentence of its own, and falls through to
exactly what these wrote for everything else. The twenty-fifth was found by the
guard rather than by the census: it is main.tsx's boot failure, a .then's
rejection half, and the only thing on screen when the kernel cannot be reached.
reason() is pinned as the boundary it now is. The gate among those is that
rewording the kernel's English must not move what a reader sees for the same
code — without it the codes bought nothing and wording authority never left the
kernel. Language is pinned rather than defaulted: with nothing stored the window
follows the machine, and on an English runner every assertion about a Chinese
sentence would have been about the runner.
The guard reads structure, not spelling. What counts as an error is a catch
binding, a .catch callback's single parameter, or the rejection half of
.then(ok, err) — nothing else is known to be one, and a rule that guessed from
a name would be reading spelling again. It carries its own regression in both
directions: five shapes it must find, and four it must leave alone, including a
field that merely happens to be spelled message. Ceiling zero.
@babel/parser is a direct dependency now. It was already in the tree under the
React plugin, but pnpm does not expose what a package did not ask for, and the
installed TypeScript is the Go port, whose only parse entry points are behind
an unstable path — a CI gate is not the place to hold one of those.
The skill seed says what it stopped short of saying: a coded refusal reaches the
panel as this window's sentence, and a dead kernel as one sentence about the
request rather than the route it took.
Two things this does not close, both older than it. ServerRow decides whether a
failure was an authorisation problem by matching /401|403|unauthorized/ against
the message — HttpError.status has carried that all along. And catalog.go still
refuses skill and MCP switches with writeErr prose; those are not a declared
sentinel family, so the inbox treatment does not transfer to them.
Every UI assertion in this tree was renderToStaticMarkup or a Playwright guard,
and the gap between them is where a control's contract lives. Nothing could ask
what happens between the click and the answer — pending, refused, clicked twice
— so the three fixes that just landed were pinned by whichever end could be made
to reach them, and one arm could not be reached at all: the queue's positive
case needs an inbox_changed the bench's own subscription swallows.
jsdom is chosen over the alternatives for its DOM and event semantics, not its
speed: nothing here measures layout, and the browser guards keep every question
that depends on one. It is opted into per file rather than globally, so the
thirty-six static tests keep running under node and none of their behaviour
moves on the way in.
Three seeds, one per fix. The queue opens on the whole instruction and not on
the row, refuses to open at all when the body cannot be read, says why in this
window's language, and does not let one failure outlive its click. The preset
asks once, marks the call it has out, turns down a second while the first is
unanswered, hands the selection back to the kernel's own answer, and on a
refusal keeps the old one and asks for no re-read. The skill switch names this
skill at this project's layer, holds still while unanswered, and reports a
refusal without flipping.
All three were checked by breaking their subject: swallowing the read again
fails three assertions, dropping the preset group's disabled fails one, removing
the switch's busy fails one.
The skill seed stops short of asserting how a refusal is worded, and says so
where a reader will find it. That row hands on err.message rather than going
through reason(), so a coded refusal arrives untranslated and a dead kernel
arrives as a path and a status — and so do some twenty other catch sites,
including the settings panel's own helper. It is one pattern and belongs in one
change, not in whichever guard happened to walk past it.
The inbox store refuses eleven distinct conditions and the boundary named one
of them. Five shared a status and were told apart only by reading English, which
no frontend does; three — closed, schema-readonly, idempotency conflict — had no
case at all and went out as 500, so a known answer about the request was
reported to the user as their machine having failed. This is the rule the tree
already holds everywhere else: an error a caller must tell apart carries an
identity, and across HTTP that identity is a dotted code.
So each condition has its own case and its own code, and the sentence rides
along as the English fallback a log keeps. Statuses are unchanged on purpose —
not_found answering 409 is arguable, but the code is what carries the identity
now, and moving a status is a wire change no caller asked for. The default
branch still delegates to writeErr, which renders an identity a deeper layer
assigned and otherwise falls back to prose: for a condition this package cannot
name, prose is a diagnostic, and inventing a code would be the same lie pointing
the other way.
Two guards, because neither is enough alone. A test runs every sentinel through
the writer wrapped the way the store hands one over, and fails a code that is
missing, wrong, or shared by two conditions — but its table is hand-kept, so it
cannot notice a twelfth sentinel. repolint reads the family out of its own
declaration and the switch out of its AST: a sentinel with no case, or one whose
branch writes prose, fails there. Both were checked by breaking them, in all
four directions.
The frontend now has wording for all ten, which is what closes the loop: the
codes guard already required it, and could not have asked before, because it
reads codes at their emit site and there were none to read.
The chrome's 均衡/交付 pair sent the call and dropped the promise: no pending
state, no catch, and the selection moved only if onChanged happened to run. A
call that never lands therefore left the pair reading as the state it did not
reach, and the rejection went nowhere — a click with no answer at all, which is
the one outcome a control must not have.
The settings panel drives the same capability and has always handled it: busy
while the call is out, the refusal shown, the old state kept. That the two
disagreed is the defect; the chrome now holds the same two facts. The preset
being asked for is marked while it is out, the group refuses a second click
until the first settles — a pair of one-of-two buttons has no meaning for two
concurrent answers — and a refusal appears next to them instead of being
swallowed.
What can refuse today is narrow: /preset turns down a malformed body or a preset
that does not exist, and neither is reachable from a fixed list of two. Transport
is what actually fails here — a kernel that is gone, a pane whose runtime went
with it — so this is a dead click and an unhandled rejection being closed, not a
refusal path that was going unreported. It is written the way the settings panel
writes it because a second shape for the same capability is how the first one
came to be missing this.
The switch in settings has been live for a while: SetSkillEnabled writes the
activation store, the live store consults it per call, so the session that flips
one loses it at once — a slash invocation stops resolving, and the next eligible
turn owes the model a catalogue without it. Both halves are pinned in
internal/boot, one by invocation and one by projection.
Four places still described the old mechanism. Two of them were on screen: the
skills group told the reader changes enter the model's index "the next time you
start a session", and the discovery-off variant said the same in fewer words.
So the panel asked for a restart the product had stopped needing, and a reader
who took it at its word would keep a skill they had just switched off — the one
reading of it that is worse than saying nothing.
The other two were comments, and they are what let the screen drift: AgentPort
told the next reader the switch reaches the model on the next rebuild, and
skillSet justified its absence of a lock with "a preference a rebuild picks up".
The lock argument holds and is kept — SetSkillEnabled touches none of those
fields — but the reason it gave was the same wrong mechanism, and the true one
is why there is nothing to synchronise.
The pending strip's 「改」 reads the whole instruction back before it opens an
editor, because the row shows a preview and saving the preview back would file
a cut-off line as the entire message. That read could fail, and the failure was
spelled `.catch(() => "")`: an entry the kernel no longer holds — dispatched
between the render and the click — opened a box with nothing in it. Empty is a
state a body can genuinely be in, so nothing about the screen said the read had
failed. Whatever the user then typed replaced, in full, a line they had never
seen.
So the editor stays shut. The row keeps its own text, and the reason the read
failed is on the row rather than in the box. Two layers collapsed the same way
and both are closed: the port returned "" for an answer carrying no envelope,
which is a shape the kernel does not send and therefore an answer we do not
understand, not an empty instruction.
The fixture refused where the kernel refuses. MockPort.readQueued answered ""
for an id it does not hold, so the path a reader actually hits could not be
reached from any guard — the seeded rows ?queue= draws are exactly that state,
a row still on screen whose entry is gone.
perf/queue.mjs pins it in the browser, and it was written against the old code
first: opening an empty box, losing the row's text and saying nothing were three
separate failures before, and are three passes now. It also records what it does
not cover. The positive arm — a body that does read back opens the editor with
it — needs an inbox_changed to reach the panel, and BenchPort owns the
subscription the fixture emits into, so that arm belongs to a component-level
harness rather than to a change in the bench's event model.
Three ledger states read identically through the readiness result: a review
report filed by a run granted no such authority, one the host could not join
back to any run, and no report at all. Missing said structured_review for all
of them — or, in the fixture that isolates it, said exactly the same list for
all of them — and the classification the ledger already computes existed only
inside a sentence written for the model.
So the proofs are their own dimension beside Missing rather than an entry in
it. Missing names obligations that are unmet; Proofs names candidates that
cannot close one, and only the second is something a person can act on: "file a
review" and "the report execution-3 filed carries no grant for this" are
different instructions. An obligation with no candidate at all has no entry,
which is how the third state stays distinct from the other two.
The gap carries the run that filed it, read in the same walk that classifies it
— two passes over the ledger could disagree about which receipt they were
describing, and the id is the half that makes the gap actionable.
The parity this needs is not about wording. The completion gate and the
readiness projection share one evaluator today, and the guard is what fails if
either grows arithmetic of its own: for one fixture, whether the gate refuses
and whether the projection says ready must be the same answer, over the same
missing ids and the same proofs. Reason is excluded on purpose. Both halves were
checked by breaking them — folding the proofs into Missing fails orthogonality
and parity together, and letting the projection decide readiness on its own
count fails three arms of the parity table.
Nothing is exposed to a port, the wire or a window yet. Two lifecycle questions
have to be settled before a read called "current" can be published: the evidence
ledger is constructed empty per agent with no rebuild path found, and the
acceptance-criteria input is turn-local, so a read taken outside a turn answers
from the last one's flag. Both are probes of their own.
agent.go crossed its budgets on the way, so the result type moved next to the
evaluator that produces it rather than the budgets moving.
A falsifier ran first, because the question was not which field replaces the
label but what the label was standing for. Eight arms through the reducer,
recording the frame that ended the turn and the state the session was actually
in: a new turn already clears the label, and nothing in the background moves it,
so what it stood for was the current turn's ending rather than a memory that one
had ever ended. That answer is what makes a state machine in the reducer the
right owner, and it ruled out asking /status for a Finished bool.
The same matrix found a defect the label was hiding. It asked only whether an
error was attached, so a turn that ended because its obligations were not met —
outcome final_readiness, no error — read exactly like one that finished the
work, tick and all. The comment three lines above it already said the opposite:
anything but a clean finish keeps the run amber rather than claiming the tick.
The code now agrees with it.
So terminal is typed and not a flag: completed, failed, cancelled, incomplete.
Cancellation is separated from a dropped connection by the flag the kernel sends
for exactly that, which nothing was reading. runState asks for the terminal
rather than a boolean, and only a completed one claims the tick — the other
three stay amber, which is what they always meant.
Two rules make it a state instead of a history, and both are pinned: a turn
starting clears it, and nothing behind the session moves it in either direction.
Reverting the first makes an hour-old tick sit over running work and turns that
arm red; folding the readiness outcome back in with a clean finish turns the
other one red.
The counterfactual is the same one the decision list got, in both directions.
The label may say 已完成 with no terminal fact and the turn is not done; it may
say anything at all over a completed one and the turn is. Neither selector can
see it — with this, no selector in the pane takes a label at all.
Five labels in the rail stayed in the source language in an English window. The
table naming them was built at module scope, and t() answers out of a dictionary
that boot() installs — a module body runs before that, so the labels captured
the empty default and never followed the interface again. Switching the language
reloads the window, which meant the same thing happened on the way back: the one
place in this tree where the fix is not "re-render on change" but "do not
compute this until you are drawing it".
They are computed in a function now. The literals stay inside t() at the call
site so the catalogue scanner still sees them — the alternative, a table of
keys resolved later, is the shape that made t(TABLE[key]) invisible to it before.
A scan of the whole tree for the same mistake found no second instance: two
other candidates are a memoised component and a regex with a tab escape in it.
perf/lang.mjs was four more red beside it, and none of those were the product.
It looked for three panel headings — Metrics, Pending changes, Agents and tools
— that no longer appear anywhere under src/ui and survive only in the catalogue,
so the oracle had been asking after names the panels stopped using. It now names
what they render.
The flip itself is pinned where it broke: the legend is read in both windows, its
labels must be wholly English in one and wholly Chinese in the other, and its
numbers must be identical across the pair — translation moves the labels and
nothing else. Restoring the module-scope table turns that assertion and the
stray-Chinese one red together.
One guard bug came out of the same edit: the check that rendered Chinese goes
through the catalogue treats a fat arrow as a tag opening, so any arrow
returning Chinese before the next "<" reads as markup. It no longer matches
after "=".
perf/models.mjs threw where it should have failed. Its wait for the connection
editor timed out and the stack went to node, so the exit code and the message
both stopped belonging to the guard — and "this screen is not this shape any
more" is precisely what it exists to be able to say. Missing targets are named
failures now, the way side.mjs's became.
The reason it could not find them was the same one verify.mjs had: the oracle
matches Chinese against the DOM and the page was opened in whatever language the
machine runs in. Three guards were in that position — models, look and panes —
and two of them pass today only because their Chinese comparisons happen to sit
on paths that do not decide anything yet. All three now open a context with a
locale, which is what locale.mjs has always done.
Checked both ways: pointing the wait at a selector that does not exist reports
one named failure and exits 1 rather than throwing, and the three guards pass
with the locale pinned.
Whether the run reads as moving was settled by comparing the label on screen
against two Chinese literals. Both are also translation keys — one of them is
"Waiting for approval" in the English catalogue — so a rewrite of the wording
was a rewrite of the verdict, and the presentation owned a fact the kernel
already publishes.
It publishes it better than the string did. Decisions() answers with typed
entries whose Kind names the owner that resolves them — tool_approval,
plan_approval, recovery_approval, ask — and all four need a person, so the
condition is the list's length rather than anything inside it. Which kind it is
says who answers, and that is what an explanation would render; this only says
that someone has to. Absent is false and never a fallback: a kernel that does
not answer leaves this window unable to claim anyone is waiting, and quietly
reading the label instead would put presentation back in charge with nothing
saying so.
The guard is a counterfactual in both directions, because only one direction
proves anything on its own. The old wording present with an empty list must read
as running — that is what says the string has lost its authority. A typed
decision present with a label that reads like progress, or like nothing, must
read as halt — that is what says the typed fact carries the verdict alone. Every
kind is driven through the second, so narrowing the condition to some of them
fails; every label is driven through both, so no test pins a word. Neither
selector can see the label at all, which is the strongest form of the claim.
runState is separated out so it takes facts and never a label. One label test
remains at the call site — whether the turn finished — and it is left visible
rather than folded into a function that would then be wording-free only in name.
It is the next instance of this, and it needs a canonical source of its own.
Two fixture repairs ride along, both the same shape as the last round's. The
mock never published decisions at all, so the whole chain would have measured as
"nobody is ever waiting"; it now sets the list where it raises the card and
clears it where it answers, and driver-fed frames go through the same door as
scripted ones. And verify.mjs now asserts the chain end to end: the card and a
halted run appear together, which is what proves the projection reaches the real
Pane rather than only the selector.
The status read is pulled forward too. Nothing but the 250ms poll would have
noticed a prompt opening, so the glow outlived the card by up to a quarter
second; a prompt event now re-reads /status, the same content-free event plus
authoritative pull the queue already uses.
mock.ts crossed the 800-line ceiling on the way, so the memory shelf's fixture
data moved out beside the other six mock_* modules rather than the budget moving.
Three owners decide whether a column is on screen, and they are kept apart
because collapsing them is the only way this feature can go wrong. What the user
chose is theirs; what the viewport allows is the layout's; whether the
surroundings are put away for a moment is this. They are multiplied where they
are used — effective = wanted && allowed && !focus — and focus never calls the
setters for the other two. Writing a temporary state back into a preference is
how "leave focus" stops restoring anything.
So focus stores one boolean and nothing else. Not the previous layout, not the
width it was entered at: both would be a saved projection, and the point of
keeping the owners separate is that everything is asked again. A window narrowed
while focused leaves focus with the columns the new width allows, not the ones
it had before — the responsive rule never stopped running.
The columns are collapsed, not unmounted. Taking them out of the tree would lose
the sidebar's scroll, the inspector's open sections and whichever panel was
selected, and this is a state you step out of. Collapsing goes through the same
path the existing close does, so the transition, the borders and the fade are
the ones already there. inert is the other half: a column that is only hidden to
the eye can still be tabbed into, and a guard that checks pixels would not
notice.
What stays is everything belonging to the turn in front of you: the transcript,
the queue, approvals and asks, the composer, the stop button, and what the run
is doing. Focus is not a reading mode — it is the same session with less around
it. The run header loses its description and its timestamp through the rules the
short-window fold already uses, rather than a second header component that would
drift from the first.
Escape follows the convention useDismiss set: a transient surface takes the press
in the capture phase and stops it there, so the window's handler only sees a
press nothing else wanted. Stopping a turn stays ahead of leaving focus, because
doing both on one press would be neither. The overflow bubble now stops it too —
it was listening in the bubble phase, which would have closed the bubble and
dropped focus mode together.
perf/focus.mjs holds it, and the two easiest things to fake are the two it was
checked against. Removing inert leaves every assertion about pixels green and
fails only the one that puts focus into the hidden columns. Making the toggle
write the columns closed turns four of them red at once, including the one that
reads the preference straight out of storage. It also pins the geometry both
ways: the transcript grows from 884px to 1394px on the way in and is 884px again
on the way out, which is the whole promise stated as a number.
Both were found while checking that the composer-budget change had broken
nothing. Neither had.
side.mjs crashed rather than failed. It read .why out of the MCP rows, and the
panel no longer has one — the reason moved into a title and the row now carries
a name and a way out — so getComputedStyle was handed null and the script threw
before any assertion ran. A guard that dies says nothing about what it saw, and
"the panel is not this shape any more" is exactly what it should be able to say,
so a missing target is now a named failure and the wait for one is too. Its
subject is unchanged: endpoint-authored text does not get to widen a fixed
column. What it asserts about has moved to the name, which is what the row
renders now, and to the way out beside it, which is the only thing on that row
you can press and therefore the thing that must not be squeezed away.
verify.mjs was five red on a clean checkout, and every one of them compared a
string on screen against a Chinese literal while opening the page in whatever
language the machine happened to be in. locale.mjs has always opened its context
with a locale for this reason; this one never did, so on an English machine a
whole group of plan-gate assertions failed over wording that was in fact correct.
Pinning it left one, and that one was the fixture too. data-plan is read from
/status, and MockPort's planDecision was an empty method: approving a plan could
not turn plan mode off in the harness no matter what the product did. The three
plan outcomes are three different kernel transitions rather than an allow/deny
pair, so the mock now makes the distinction it always described — revise stays,
the other two leave. Verified on an unmodified origin/studio worktree: five red
before, none after, with no change to any product file.
So neither is UI debt, and neither was fixed by moving an oracle to meet the
code. The fixture is dev-only and never reaches a shipped bundle.
The queue was the instance; this is the class. Everything stacked around the
composer — the pending queue, extension views, the error bar, runtime notices —
shared a container that is flex: none and therefore takes whatever height its
children ask for. Only the extension rail had ever bounded itself. Fixing the
queue alone left the next child to do the same thing.
So the two regions are named and share one number. Above the box, .composeaux
holds the queue and the extension rail; below it, .composenotes holds the error
and runtime bars, which arrive unbidden and are dismissed one at a time. Both
read from a single --aux-budget on .compose, split .72/.28, because the
invariant is singular: the transcript must not be squeezed out. Two independent
ceilings do not compose — the first version of this had them at 30vh and 16vh,
and 64 queued rows with twelve notices still measured the transcript at 36% of
a 900px pane.
The queue's own ceiling is gone with it. What it needs is not a height but a
shape: the header stays put and the rows scroll, so the count and the pause
control are still there while you read what is waiting.
Height now folds the way width does. Everything around the transcript is
budgeted as a fraction of the window, and on a short one those fractions are
the transcript; under the existing "side" fold the metrics column is one of
them, sitting under the flow with 40vh of its own. A window 720px or shorter
reports "short", which tightens the composer budget, caps that column further,
and takes the description and the timestamp out of the run header.
The queue's preview carried a native title, whose delay, placement, size and
scrollability all belong to the browser — a long one is an uncontrollable sheet
over the page, which is how it appeared in the report this came from. Dropping
it alone would have taken the full text away from settled rows, which have no
edit button to read it back, so it is replaced rather than removed: Overflow
shows the whole string, and only where the string is actually cut. It is bounded
and scrolls inside itself, its text can be selected, it closes on Escape, blur
or any scroll, and it takes a tab stop only on the rows that have something
behind them. Long titles and job commands can use it next.
It renders through a portal for a reason worth writing down: a finished entry
animation with fill-mode: both leaves transform as the identity matrix rather
than none, and an identity matrix is still a containing block for a fixed child.
Both .queue and .qi carry one, and the bubble's inline left/top were correct
while it rendered 675px below the window.
perf/budget.mjs is the guard, and it reads geometry rather than class names: 64
queued rows (the kernel's own admission ceiling) plus twelve runtime notices, at
three window sizes, asserting the transcript keeps 40% of the pane, the textarea
stays wholly on screen, and the region that gives way is the auxiliary one. The
floor is not a product truth — it is "never zero again", with the measurement
that motivated it at 48%. Removing --aux-budget puts 1440x900 back to a 0%
transcript and a composer off the bottom of the window, which is the report this
came from.
It guards the bubble on the same terms. One seeded row is short, and must draw
nothing; one is longer than any preview the kernel will ever produce, because
previews are cut at 120 runes and the bubble's own ceiling would otherwise never
be reached — a bound no fixture can cross is not a bound anything checks.
And .qi was outside the reduced-motion list while carrying an entry animation,
so a burst of rows was a burst of movement for a reader who asked for none.
A failing cargo build finished thirty-two background jobs in a few seconds. Each
one became its own queued turn whose text was the composed <background-jobs>
block, and the pending-queue panel — which had no height of its own — rendered
all of them. Measured against the real stylesheet in a 900px pane with the 41
rows from the report: the transcript is 466px with the ceiling this adds and 0px
without it, the composer pushed off the bottom along with it.
Three places treated the host's own account of a job as something a person had
said. backgroundCompletionPrompt built one string and handed it to both Display
and Submit, and Display is persisted as the turn's RawContent — so the queue row
and the transcript were given the markup meant for the model. UserMessageText
returned RawContent verbatim on the grounds that it holds what a person typed,
which is true of every producer but this one; the comment at its ACP call site
already claimed it stripped. And the page's own control-block regex named three
of the thirteen tags the kernel prepends, so the stripping that did run missed
this block anyway.
That last list has now drifted twice — internal/history/strip.go records its own
copy having named five of eleven — so the two are held to each other by repolint
under wire-parity, compared as sets and failing both ways. A tag the page cannot
strip is markup it prints at the reader; a tag only the page knows is a copy
that has gone stale.
The burst is a separate fact. A completion gives its session a turn so the work
it unblocked continues without waiting for the user, but thirty of them are one
interruption, not thirty. While a continuation is still unread, later
completions are refused through the error path publishCompletion already had,
and the manager keeps its note — which the next turn's <background-jobs> block
folds in whole.
The queue's ceiling is layout, not semantics: 30vh at most, and what does not
fit scrolls inside it. Its item count was already bounded at 64; its height was
bounded by nothing, and the two are not the same limit. The input box is the one
thing nothing may push off the screen, and the transcript is the second.
The last open row in the projection rules. Standing instructions rode the turn
already — they were never in the prefix, which is why classifying them as prefix
configuration would have been a move rather than a description — but they
reached a live session only through the writers that published them. An edit by
an editor, a script or a branch switch was in the canonical set and not in the
next turn.
They are now rendered from disk each turn and compared with what the model has,
the same shape the skills listing took. Discovery is the narrow one: the
instruction documents, not the fact store and its recall index, at 272µs p50
against a turn measured in seconds. A session that never resolved a workspace
renders nothing rather than discovering from the process directory, which is
what it was accidentally doing the moment discovery moved onto the turn.
Two rows this closes are not edits. A removal is owed once as a removal: silence
would leave the rules the model already holds reading as current, which is the
failure a deletion is most likely to cause and the one nothing would report. And
a rewrite of the same bytes is not a change — the comparison is against the
rendered block, so touching the file costs nothing.
Delivery, not composition, settles a debt. A turn can still be blocked by a hook
or refused by an extension after it composed, and clearing the debt there would
leave the model holding state nobody sent it; runSettled is the hand-off point
because everything that can refuse the turn has already run. A provider failure
after that is not a lost delivery — the composed message is in the session and
rides the next request, which was measured rather than assumed.
Two tests changed because they measured the old contract. Both composed twice
without running a turn and expected the second compose to be silent; under
delivery-settles they correctly owe it again, so one now pins exactly that and
the other settles explicitly where a real turn would.
13a made the durable skill switch a live registry input, which is the same rule
the out-of-band file write already forced and worth stating once rather than
rediscovering per input: a switch flipped, a file edited past every API and a
plugin dropped into a directory are one question, and the registry answers it
from canonical state.
Its second half matters as much and is easy to lose: a change no projection
renders is not a change. Without it, "detect every mutation" invites mtime and
event streams back in, and both re-send listings nobody's model would read
differently — freshness bought out of the cache stability it rides on.
The section also stops implying the original hypothesis was right. Moving memory
and skills out of the prefix was the plan this phase started with; measurement
found them already there and freshness ownership missing instead.
Enable/disable is registry configuration, not a build-time constant, so a user
who turns a skill off should not have to restart an agent to be rid of it. The
fix is not a republish after the setter — 12b settled that the registry answers
for itself — it is that the disabled set stops being a snapshot. Options take a
function, resolved once per discovery pass, and the pass is what every surface
already goes through: the listing, slash resolution, run_skill, Inspect.
Everything downstream follows without being told. The catalog is rendered from
the registry each turn, so a toggle changes the block and the block is owed; a
toggle that changes no listing — turning on what is already on — writes its
durable row and owes nothing, because the debt is against what the model would
be sent and not against the file that decides it.
The boundary is dispatch. A child already running keeps the skill it was
dispatched with: resolution happens once, the run holds what it resolved, and a
registry consulted again mid-run would cancel work the user asked for. The arm
that pins this fails without a witness that a child actually ran, since a turn
that dispatched nothing would otherwise satisfy every other assertion in it.
The two surfaces now say what is true: restartRequired is false and the CLI
notice says the change is in effect from the next message. That order is
deliberate — the promise moved after the behaviour did, not before it, which is
how it became false in the first place.
Cost of asking per pass rather than binding once: 23µs with no overrides, 63µs
with twenty, against the 166µs-2.4ms the listing already costs to render and a
turn measured in seconds.
The listing's freshness was already owned by the registry, but the state behind
it was three inline lines on skillSet: a pointer, a comparison, a store. That
names the operations and not the fact, and the fact is the part another
projection will need — the standing-instructions block is the same shape and is
the open row in the rules.
projectionDebt holds one thing: what the model has of a block that is delivered
once. Rendering is the caller's, and so is invalidation, which is the boundary
worth keeping — a debt that decided for itself when to invalidate would be back
to guessing at canonical state it does not own.
The delivered value is the version rather than a digest of it. A digest is a
second representation that can drift from the thing it stands for, and the block
is a couple of kilobytes; there is nothing to buy by hashing it.
12a and 12b were one question asked twice. The prefix design was already right;
what was missing both times was the rule for when a once-delivered projection
becomes owed again, and both times the answer had been left to whoever happened
to write the state.
The four rules are what the matrix in internal/boot/context_projection_test.go
now holds, written down so they bind the next dynamic fact rather than being
rediscovered by it. Prefix ownership names pinned memory as the one declared
exception rather than leaving it as an unexplained violation, which a rule
phrased as "no canonical fact may move the prefix" would have made it. Freshness
says what "eventually" is not. Ownership is the one this phase actually cost:
the owner of a fact owns the invalidation, because a projection kept fresh by
callers remembering is one forgotten call from stale. Determinism is already
true and is frozen before something makes it accidentally false.
The open row is stated rather than quietly carried: standing instructions still
reach a live session only through the writers that publish them, so an edit to
REASONIX.md made outside them waits for the next build. That is measured, not
assumed — the same probe that closed the skills row shows this one open — and it
is the shape the listing had before it started asking. Fixing it is a decision
about memory, not a consequence of this phase.
The cache-first convention loses "memory" from its parenthetical: the index left
the prefix some time ago and only pinned bodies remain, so the list was naming a
fact that had moved.
Falsifying the activation lifecycle turned up something else. `/skill disable`
and the Studio switch write a durable override, `SkillEnabled` reads it back,
and the panel duly shows the skill as off — while discovery is configured from
`skills.disabled_skills` alone, which that switch has never written. The skill
therefore stayed in the model's listing and stayed runnable. Not until the next
turn, or the next session: permanently. Both surfaces answer `restartRequired`
and the CLI says "restart or refresh the session", and a restart did nothing
either, so the promise was not late — it was false.
Discovery now reads the durable decision: the hand-written config list, plus
what the switch turned off for this workspace, minus what it turned back on.
The switch answers by name, so a name the user turned on beats a config file
that declares it off, which is the order every reporting surface already used.
The arm is written as the lifecycle contract rather than as a freshness row,
because that is what it is: the change takes effect on the next build, both
surfaces say so, and the live session's silence is the boundary. Its second
half is what gives the first half meaning — after a rebuild the skill is gone,
so the live session not moving is a boundary rather than a switch doing
nothing. If that boundary ever moves, the arm fails and the two surfaces have
to stop promising a restart.
Whether the switch should apply to the live session is now a product question
and no longer an implementation one: 12b left the listing being rebuilt from
the registry each turn, so the only thing between here and immediate effect is
the store's construction-time disabled set.
One measurement note, because it cost a debugging round: the index preamble
names a built-in as its own call example, so a test matching a bare skill name
in that block matches the boilerplate. The arm matches the entry line.
The listing was owed by being told: publishCatalog on construction, on a
completed fold, on a command reload, and — after the last change — on each of
the three skill writers. Every one of those is a caller remembering, and the
probe beside this had already shown what the remembering misses: a skill file
written by an editor, a script or the model's own write tool is in the canonical
registry and announces nothing.
So the question moves to where the answer lives. owedCatalog renders the listing
from the registry and compares it with what the model was last sent; the writers
stop announcing themselves entirely, because there is no longer anything to
announce to. A fold does not re-publish either — it forgets what the model has,
which is the truthful statement: the bytes it was sent are no longer in the
context it samples from.
That the comparison is against the rendered listing rather than the files is
what makes the reverse hold. A touched mtime and an edited body both change the
registry's inputs and neither changes a line the model reads, so neither
re-sends anything. Freshness bought by re-sending on every filesystem event
would pay for itself out of the cache stability the block rides on.
The cost of asking instead of being told is the walk, measured before this was
written rather than assumed: 166µs on a workspace with no skills of its own,
2.4ms at fifty, against a turn that costs seconds. The old comment said a fresh
List() per turn was what the once-only delivery existed to avoid. It was
avoiding 0.1% of a turn.
12a fixed the skills listing by having each writer announce itself, which is
correct and does not scale: the same probe showed a skill file written past
those writers — an editor, a script, the model's own write tool — is in the
canonical registry and still owes nothing. A contract that reads "every writer
remembers to announce" is one forgotten call from the defect it just fixed.
So this measures the three candidates rather than picking one. Rebuild the
projection and compare it; fingerprint path, size and mtime; or trust that every
write announced itself. Owed is measured, not declared: the block is rendered
before and after each transition, and owed means those differ. Under that
definition rebuilding the projection is not an estimate of the truth, it is the
truth, and what the arms establish is where the two cheap detectors diverge
from it.
Both diverge, in opposite directions. Metadata misses a change whose length and
mtime are preserved, which is not exotic — a branch switch restores content and
stamps it with the mtime the file had — and it fires on a touch and on a body
edit, neither of which changes a line the model sees. Observed-write is blind to
every out-of-band write by construction; it can be an optimization, never the
owner of correctness.
The cost argument for the cheap ones then mostly evaporates. Rebuilding the
projection costs 166µs on a workspace with no skills of its own, 668µs at ten,
2.4ms at fifty and 6.4ms at two hundred; metadata saves 25% of that at two
hundred and 60% at ten, because the walk is the cost and reading the files is
not. A turn costs seconds. Paying the truth once per turn is noise, and it was
avoided on an assumption nobody had measured.
Two measurement traps are worth naming. Timing a detector with its own
accounting inside it measures the accounting: attaching the file/byte counter to
the projection detector reported it 2.5x slower than it is. And pointing the
project root and the home root at one directory walks it twice, which doubled
every number until they were separated.
Canonical host state — the memory store, the skill registry — belongs to its
own owner, and what reaches the model is a projection of it onto each request.
Nothing measured that end to end, so this file does, through the real Build
assembly against a recording provider: five rows, each reading bytes that
actually reached the wire.
The two failures are named apart because their fixes are opposite. A
cache-boundary violation is canonical state reaching the system prefix, where
changing it re-sends every byte after it. A freshness violation is canonical
state not reaching the next turn, where the model acts on a registry the host
has already replaced. Both would otherwise be reported as "stale context",
which says nothing about what to do.
Four rows hold. The same canonical state projects byte-identically in a second
session, so a difference elsewhere is the change under test rather than the
assembly's own nondeterminism. A memory write reaches the very next request,
leaves the prefix alone, and survives the session that made it. A fold re-owes
the listing it summarised away, and re-owes the registry as it is now rather
than replaying the bytes it dropped. Pinning is the declared exception, stated
here so moving it later is a decision and not drift: a pinned body folds into
the prefix, which costs one cold start and is what pinning means.
One row failed. A skill written through the controller's own writers is in the
canonical registry immediately — RunSkill finds it by name — and the listing is
owed once, so nothing told the model it exists until a fold or the next session
happened to re-owe it. The write re-owes it now. That is on the write and not
on the turn deliberately: the listing costs a disk walk, and paying it per turn
is what the once-only delivery was built to avoid.
Getting the measurement right took three definitions, and the two that were
wrong are the useful part. Read the whole history and a listing delivered on
turn one is present forever, so every row passes while measuring nothing. Read
the last user message and under context pressure it is a host notice appended
after the turn, not the turn. Only the message carrying this turn's own text is
this turn's projection. A fourth trap sits next to those: the host makes
provider calls of its own, so a cursor carried between turns reads the
compaction summarizer's prompt as the model's context.
Known gap, measured and not closed here: a skill file written by anything other
than those writers — the model's own write tool, an editor, a script — is in the
canonical registry and still does not re-owe the listing, because nothing
observes the write. Closing it means either a fingerprint walk per turn or
routing observed write paths back to the registry, and that is a different cut
from this one.
The skill write methods move to skill.go rather than widening controller.go's
budget by the twenty lines this added.
`go build ./tools/repolint` writes the binary into the working directory, and
two of those — repolint and covergate — had been committed. Nothing builds them
that way on purpose: every caller, Makefile target and CI step runs them with
`go run`. So any probe, agent or script that builds one produced a diff on a
tracked file that had nothing to do with what it was doing.
Untracking them is half of it. The other half is that the same accident is
available to all thirteen commands in the root module, and only three were
ignored, so the ignore list is completed from the package list rather than from
the two names that happened to get caught.
`build-artifact` holds the two lists together: every main package in the root
module must have its output name covered by a root-anchored .gitignore entry.
It reads the package list, so a command added tomorrow fails before anyone
builds it, and it passes on a clean checkout where there is nothing lying around
to observe — a rule that only fired on a dirtied tree would be silent in CI,
which is the one place this needs to hold. A pattern that is not root-anchored,
or that names a directory, does not count as covering the drop.
The walk stops at a nested go.mod: a command in another module builds into that
module's directory, and the root .gitignore is not what covers it.
review_report's `kind` carried two facts at once: which review this was, and
which obligation it closed. The first is the worker's to state — it is the
payload it was asked for. The second never was, and reading it out of the same
field made the label the capability: a run contracted for one kind could submit
the other, and every gate downstream accepted it, because by the time a gate
looked there was nothing left but the word the model had written.
So the permission is issued before the run and stamped from outside it.
ReviewAuthority says which obligations a report from this execution may close;
the host binds it to the report tool at mount time, the receipt records it off
the mounted instrument, and ReceiptProves asks that question instead of reading
the payload. The kind stays, as the delivery fact it always was: a submission
naming a kind other than the one assigned is refused at the tool, before a
receipt exists, rather than downstream where a gate has to unpick it.
Authority is separate from Delivery all the way up — on the skill, on the
profile, in the spec — because a worker can owe a report it may prove nothing
with, and one did. Both come from the worker's own declaration, so no entry
point widens either by asking differently, and the built-in security reviewer
declares only the security obligation: whether a security review also answers
for an ordinary one is undecided, and an undecided grant is not asserted.
Two consequences are deliberate. The report tool leaves subRegistryFor and is
mounted where the execution id exists, since a permission issued to a run that
does not exist yet is not one — there is now no reachable state in which the
instrument is present unbound. And read_only_skill, which runs outside the
delegation lifecycle and has no execution to name, gets a grant with no
authority: the verdict is still owed, a block from it still stops delivery, but
evidence nothing can be joined back to does not close an obligation.
The gate says which of these happened. ReviewProofGap separates "no report",
"submitted by a run the host cannot name" and "submitted by a run granted no
such authority", and the refusal names the one that occurred. Without that the
model reads a demand for a review it believes it just delivered, and the rule
it invents to explain the contradiction outlives the turn.
Reporting is accepted once rather than called once: a refused attempt records
nothing, so a run that got the schema or the kind wrong can still correct
itself, while one that already has an accepted verdict cannot file a second.
Split returned one flat map for every frontmatter block, collapsing nested
mappings onto their leaf keys: `metadata:\n type: user` and a top-level
`type: user` were the same fact by the time any caller saw it. That is fine for
the vocabularies it was written for — they are flat — and fatal for a namespace,
because the one thing a namespace is made of is which key a field was written
under, and flattening is exactly the step that drops it.
So the parse keeps the shape the author wrote. Document holds fields in order
with their kind, Lookup walks a path, and Has answers whether the author reached
for a namespace at all — an empty mapping, an empty sequence and a bare key all
count, three states the flat map cannot tell apart from absence.
The flat view is not deleted, it is demoted: Split becomes SplitLegacy, defined
as Parse followed by LegacyFlat, so the historic vocabularies keep their exact
behaviour including last-write-wins and the argument-hint bracketing. Nothing
about their parse changes; only the direction of the derivation does.
A rename alone would not hold. The reason the old shape survived this long is
that reaching for the flat map is the easy call, so `flat-view` names the ten
files allowed to make it. A vocabulary that migrates to the document comes off
the list and the boundary only tightens; a new caller fails. Asking instead
whether a read "looks new" would judge intent, which the source does not record.
11a proved one member of this enum live after the plan had it down as cleanup.
That made the method the finding: a name that reads like history is not evidence
of anything, and the same doubt applies to the six members beside it. So the
family is classified by evidence, once, and the scope stops there.
Six now have a witness — nothing between head and tail, one transaction with
none of it closed, a reachable region that ends inside the body, something new
that is not worth folding, a pinned head already over the trigger, and an
extension that rewrote the fold to nothing. Each is a concrete state, not an
argument that the branch exists.
Two of them are worth reading twice. fixed_prefix_above_trigger reports its
verdict together with a rejection error, so refusing to fold and failing to are
one answer to "why was nothing folded" and the reader takes the verdict either
way. fold_empty_after_hooks needs raw JSON rather than a marshalled payload: the
messages field is omitempty, so a Go value cannot express an empty fold at all,
while an extension is a separate process and sends its own bytes. A witness
built from the host's own struct would have concluded the branch was dead.
input_unchanged is stated and not reached. It fires when the current view hashes
to the one a previous applied fold consumed, and a fold changes that view — so
the match needs the projection to stop being used while the canonical and the
receipt both survive, which is what a resume does and what a second process
would be needed to show. It is recorded as unwitnessed with the reason rather
than as dead, because failing to reach a verdict is not evidence that nothing
reaches it. That distinction is the whole point of the exercise.
The classification is data rather than prose: a member with neither a witness
nor a stated reason fails, so a verdict added later cannot arrive unclassified.
Nothing is deleted — no member of this family turned out to be dead.
11a asked whether NoopNoNewClosedPrefix is still something production produces,
because the plan had it down as cleanup. It is. Deleting it would have removed a
live branch on the strength of a name that reads like history.
Reaching it took three tries, and the two that failed are the useful part. With
no growth after a fold the attempt never happens: the prompt is back under the
trigger. With growth big enough to reach the trigger again, the foldable region
starts past the body and the verdict is the economics of folding it. The state
that reaches this one is narrower than either: a fold, then a small increment,
with a recent-tail budget wide enough to reach back past the tail and into the
body the checkpoint already holds. The tail is measured in tokens, so the window
is what decides how far back it reaches — which is why the fixture varies the
window rather than the message count.
That also explains why the two neighbouring verdicts are not substitutes for it.
NoopInputUnchanged answers when nothing changed and cannot answer here; the
input did change, by one message. NoopFoldBelowEconomics answers when there is
something new to fold and it is not worth folding. This one answers when there
is nothing new inside reach at all, and the three would be one sentence if the
verdict were a sentence.
The test covers the two reachable verdicts it has a fixture for rather than
claiming the whole vocabulary. Its value is the shape: a code is proven live by
reaching it, and a code that resists reaching gets investigated before it gets
deleted.
10a found the typed-review requirement had no owner: neither the skill nor the
profile could express it, and what decided it was a switch on the worker's name
consulted by one compiler. That made two independent errors at once — a reviewer
renamed lost its obligation, and an ordinary worker that borrowed the name
gained one — and left task(profile=review) with nothing to inherit.
So the fix is a declaration, not parity. DeliveryContract lives on the
definition, the built-in reviewers declare their own verdict there, and it
projects into the execution spec the same way a tool ceiling does. Both entry
points read only that projection. The name switch is deleted rather than moved:
putting it in the task compiler too would have made the accident look like a
design.
task(profile=review) therefore changes behaviour and is meant to. The same
reviewer owed different things depending on which button started it, and nothing
about the product justified that — only the compilation path did. Moving the
rule from wording to structure fixes the false negative and the false positive
together; the parity is a consequence.
The contract is declared by built-in definitions and deliberately not parsed
from user frontmatter. Where the fact lives and who may assert it are different
questions, and if a security verdict ever counts as verification evidence, a
line of YAML should not be enough to claim it. That one stays open on purpose.
The guard is the falsifier inverted. What proved the defect — a renamed reviewer
losing its obligation, an impostor gaining one — now proves the fix, through both
surfaces, and the built-ins are read from the store the way a session reads them
so a definition that dropped its declaration fails loudly.
Two files were extracted rather than widening a budget: the contract to its own
file, and the frontmatter key vocabulary out of a 1400-line loader.
10a asked which layer owns the requirement that a reviewer answer with a typed
verdict — the skill, the profile, the worker, the compiler, or the delivery that
enforces it. The answer is none of them.
Neither skill.Skill nor agent.ProfileDefinition has a field that could express
it. That is checked over the types rather than one value, so a field added later
is found whether or not anyone sets it. What remains is a switch on the worker's
name, and the cross-wiring shows the name is the whole of it: an ordinary worker
that borrows the name acquires the obligation, and the reviewer under another
name loses it. Only one surface consults that switch, so the same worker owes a
verdict through run_skill and owes nothing through task(profile=).
The measurement is what each child is actually handed. review_report is attached
exactly when the requirement is set and from the same field the gate reads, so
offering the tool and owing the verdict are one fact, observed without exporting
anything for a test.
This reframes the divergence recorded when the runners converged. It is not a
parity gap: there is nothing for task(profile=review) to inherit, because the
requirement was never a property of the reviewer. It is something one compiler
adds on recognising a word — the phrase-table shape retired everywhere else in
this tree, still standing here because nobody had asked it for its source.
So the tempting fix is the defect. Adding `if worker.Name == "review"` to the
task compiler would not close a gap; it would put the same undeclared derivation
in a second place and make the accident look like a design. An owner has to exist
first, and choosing one is the next cut's question — this one only establishes
that the candidates a reader would consult cannot be it.
The six cells are logged rather than asserted individually. What the table
establishes is where the requirement enters, and a per-cell expectation would be
asserting the answer it exists to find; the two hard assertions are the ones that
would have to change for the finding to stop being true.
9b gave a host-started execution an identity of its own, and left one entry
point into that change unmeasured: the controller's synchronous call, which 9a
had deliberately excluded because its cancellation and session ownership need
not match a slash invocation's. Excluding it from the measurement is right;
leaving it unverified after changing what it produces is not.
Three arms, entered the way that surface's callers enter it and stopped by the
owner it actually has — the caller's own context, never the controller's gate,
which never admitted the call and holds nothing for it. Two premises had baked
in the interactive surface and were corrected: readiness read the gate for a
call the gate had never heard of, and the arm required a synthetic dispatch id
that a synchronous call does not mint. Each surface's premise is now its own,
which is the point of measuring them apart.
Every provenance row matches: the same host-owned execution, the same empty
lineage, the same journal, the same store join, the same restart. Three things
differ and each follows from what the surface is — who owns the stop, whether a
sink exists to draw on, and whether a synthetic id was minted for the screen. So
the contract is narrower than "identical" and stronger than "both work":
Host execution provenance is surface-independent. The live delta stream, the
synthetic dispatch id, and cancellation ownership are surface-specific.
The delta stream belongs in the second sentence rather than in a parity failure
because the authority holds the node on both: the snapshot is rebuilt from
durable facts, and the stream is only where a sink happens to be. The arms
therefore report the two together, so the surface-specific half is visible
instead of read as an absence.
Across 63 arms nothing is violated and no arm is invalid. Four other rows moved,
all in the canonical-transcript and capture-timing family measured as flaky
before; derive-answered moved back to the value three same-build repeats found
dominant, confirming that reading.
9a showed that a host-started execution had no name that could outlive the
process. The store's ref does not exist while the scheduler is holding work
back; the synthetic slash id may never be persisted, because a reader finding it
would take it for a call the model made; and the parent call must stay empty,
because there is none. Three candidates, none of them able to be the answer, so
the answer is a fourth thing.
SubagentMeta now carries ExecutionID beside ParentToolCallID. They are different
questions — which execution this is, and which provider-visible call it descends
from — and they were one field only because every durable execution so far came
from a tool call. A model-delegated run still has them equal. A host-started run
has the first and not the second: an execution the host mints before the work is
opened, a root node with no spawn edge above it, and an empty lineage.
That distinction also removed a conflation in the opener. Descending from a call
and having somewhere to draw are separate facts, and treating them as one made a
run outside any run loop unopenable. It is durable work; it gets an execution.
The picture goes wherever a sink exists.
Reads are lenient, writes are strict. A record naming its own execution is
joined on it; one written before that did is aliased to its parent call only
where the journal opened an execution by exactly that id, because the journal is
what confirms the older writer used one id for both — a parent id alone proves
only what it meant by lineage. A parent naming no execution stays unknown and is
joined on by nothing: a single task once stored the call while the journal opened
the node, and a prefix rule would have joined those two wrong. Six shapes are
pinned as a table. New writes refuse an unnamed execution outright, since that is
the one record no later reader can place.
Nothing historical is rewritten, and this does not promise it will be. The safe
legacy subset resolves losslessly on read; the unsafe one — a host-started record
from before this, which never had an execution — cannot be recovered by any rule
that is not inventing history. Resolving on read forever costs a map lookup and
claims nothing.
9a's four arms rerun exact: what was record-only and LOST-SILENT is now an
execution the journal opened, a root node on the graph, and a restart that can
place the child. Both oracles still hold in every arm — no persisted lineage
names a host event id, and every host-started parent is empty. The frozen matrix
gains the host row and joins on the execution rather than the parent, and across
60 arms nothing is violated.
9a measures one surface and its name says so: a person typing /<skill> into a
live session, routed through Submit to the controller's slash path. The headless
counterpart is deliberately not measured beside it — caller-owned, with its own
cancellation and session ownership — because reading one for the other is how a
real number gets the wrong subject, which has happened twice in this series.
The fourth arm is queued rather than restart. Restart is an axis every arm
already has; what no other arm can answer is whether an identity exists before
the child does, and only work the scheduler is holding back asks that.
Four identities are printed apart, because this is the first surface where they
may not coincide: the synthetic dispatch id the host mints so a child's activity
can nest on screen, the store's own artifact ref, the provider-visible parent
call, and the execution a journal would open. For a model-delegated run the last
two are one string, and that has only ever held because a tool call produced
every durable execution there was.
What it found is narrower and sharper than "a slash skill records nothing". The
store is not empty: since the runner converged, a slash-started child is marked
running before it acts and carries a correct terminal afterwards — completed,
interrupted, cancelled, each measured. What is missing is the execution. Nothing
was ever opened, so nothing places that child, and the arms say exactly that:
record-only, a reader can see a child of this name was cut and cannot say which
invocation it belonged to. LOST-SILENT is reserved for the queued arm, where
work the scheduler had admitted into its domain and then refused leaves nothing
at all.
That is what makes the queued arm decide a linearization. An identity for this
class would have to exist before a child artifact does, and the three candidates
fail by exhaustion rather than by assertion: the synthetic dispatch id may never
be persisted as lineage, the child ref does not exist while the work is queued,
and the parent call must stay empty because there is none. Both oracles held in
every arm — no persisted lineage named a host event id, and every parent was
empty.
Two labels were corrected while building this, both mine. A restart that still
holds a child record is not silence, and calling it LOST-SILENT would have
reported a surviving record as a total loss; and the rebuilt column credited the
holder fleet's nodes to the invocation until it was filtered to the execution it
belongs to.
Nothing is implemented. These arms establish what the candidate identities
cannot do; what replaces them is the next cut's question.
Every surface that spawns a child now belongs to one of two classes, and this
records which — not as a summary of the arms that established it, but as a gate
a new entry point has to pass to join either.
durable delegation task, fleet, parallel_tasks, run_skill (model-invoked)
opened before visible, started before it may act,
stored once it has, reconstructable afterwards
ephemeral research read_only_task, read_only_skill
same scheduler, and no claim a snapshot cannot justify
run_skill is listed as the model-invoked entry point only. A slash invocation
reaches the same runner without a provider-visible parent call, so it is not a
delegation and the table makes no claim about it; saying otherwise would let the
matrix outrun what was measured.
The guard holds the classification where a completed run cannot: what the store
answers at the one instant a child is inside the provider. A check made after the
fact cannot tell a recorded execution from an unrecorded one that happened to
finish, because completion writes a record either way — the first version of this
test had exactly that hole, and a fan-out item that skipped the store passed it.
Two mutations are runnable now and each turns exactly the rows that would drift:
an ephemeral entry point that opens a delegation again, and a fan-out item that
records nothing while it runs.
Two things are left open on purpose rather than tidied away. A slash-invoked
skill records nothing at all; the contract that produced that is narrow and real
— a synthetic event id must not be persisted as though the model had issued the
call — but it is not the claim that host-started work deserves no provenance, and
only the first has been established. And run_skill(review) requires a typed
verdict where task(profile=review) does not; that is about what a profile name
carries, so unifying a lifecycle was the wrong moment to decide it.
Step 8 seals as: every model-delegated durable subagent surface now shares one
lifecycle authority; the ephemeral read-only surfaces are explicitly outside it;
host-initiated top-level execution is not a delegation and its provenance is
deliberately left unresolved.
8d-4 asked whether the execution authority can account for what the two
ephemeral entry points draw, and found them disagreeing. read_only_skill drew
nothing. read_only_task drew a group and a worker that Controller.ExecutionGraph
could not produce, because it is rebuilt from durable facts and an ephemeral run
writes none — so a reader that lost the stream and started from the authority
again lost both nodes while the child they named went on holding a slot.
That is not a lighter kind of node. The graph is a projection of durable facts:
a reader starts from the snapshot and returns to it after every gap, so what the
snapshot cannot produce survives only until the next resync. The node was there
because unifying the lone-delegation path gave every delegation a picture
without asking whether the authority could account for an ephemeral one.
So the picture goes where the record already went. An ephemeral run opens no
delegation at all: no node, no journal, no store, and no lifecycle to hold a
flag about which halves it skips. The flag is gone with it — an entry point that
opens nothing has nothing to make conditional, and three call sites stop asking.
The caller still sees what it delegated. A tool call and its status are honestly
live-only surfaces that claim nothing a later reader is owed, and the test
asserts both halves: no node is drawn, and the parent is still told.
What this does not do is answer who currently occupies a scheduler slot. That is
a real question and a different one — an ephemeral run does hold capacity — and
it belongs to a read model that can say plainly it does not survive the process,
not to a graph whose whole contract is that its contents do.
Both arms now read identically across all five rows, and across 56 arms nothing
is violated. The four other rows that moved are the canonical-transcript family
whose values were already measured as timing-flaky, and each moved back to the
value three same-build repeats found dominant.
8d-2 classified the normal skill runner as a shared delegated execution: it asks
the same scheduler, runs a real child, keeps transcripts and supports
continuation. What it did not do was leave a trace of any of it — an executing
skill was named by no graph, no journal and no store record — and a stop that
reached its child was filed as a failure. Both followed from the same thing: it
had built a second execution owner beside the one every other delegation uses.
So the fix is not to give it a lifecycle. It is to stop it having a loop. A
skill now compiles to a ProfileExecSpec and hands it to RunProfileSpec, which
already owns admission, the child's own run, and how an execution ended. The
runner keeps what only it knows — the body, the workspace facts a child cannot
discover for free, the tool ceiling, the whole-workspace claim a writer skill
carries, the typed verdict a reviewer owes — and nothing about how an execution
is admitted, carried out or ended.
Three semantics had to survive the move, and each has a test rather than a
promise: the prefix is the body plus the workspace facts, not the body alone; a
writer without declared paths still claims the whole workspace so it serializes
against fleet and task writers; and a reviewer still owes a typed report, which
the spec now carries as a worker property because it follows from which profile
this is and never from what one caller asked. That last one is deliberately not
derived from the worker's name: doing so would have handed the same contract to
task(profile=review), which does not have it today, and a convergence must not
change a delivery contract on the way past.
The cancellation defect is fixed by deletion. The legacy runner classified every
error as failed; RunProfileSpec already had the one classifier that tells a
deadline from a cancellation from a failure, so removing the duplicate makes
skill-cancel read cancelled where it read failed. Nothing was written to address
the symptom.
Lineage keeps its existing contract. A host-started run carries a synthetic call
id so the child's UI can nest under it, and that id must not be persisted as
though the model had made the call — so the spec says the run is top-level and
it opens no delegation and is stored under no parent. Whether a slash-invoked
skill should instead join its own host-emitted dispatch is a question this cut
does not answer; it leaves that path recording nothing, as before.
Two gates: a skill must leave the records every delegation leaves — an opening,
a slot grant, a settlement, and a child joined to that execution — and a
host-started one must be filed under no call, including when a synthetic one
exists. Reintroducing the private loop as a mutation turns the first red.
The probe's own criteria are corrected where they were written for the world
before this. A refused item's negative control is about the store alone: an
opening is the orchestration recording that work entered it, which a refused
item did, and demanding journal silence would forbid the record that tells a
restart it was held back rather than lost. The identity row now checks the join
rather than one spelling of it, because a record's parent is the execution's own
identity and comparing it to the bare call id fails the chain that makes them
joinable.
Across 54 arms nothing else moves and nothing is violated. The read-only entry
point is untouched: every one of its rows reads exactly as before, and whether
an ephemeral run that holds a scheduler slot should be drawn stays open.
8d-2 classifies rather than compares. Whether a runAs=subagent skill belongs to
the delegation class the task and fan-out arms established, or is an execution
class of its own, leads to opposite work — converge it onto the shared owner, or
declare an exclusion — and the answer cannot come from which plumbing happens to
exist today.
Two runners are measured apart instead of averaged. The tool a model calls
prepares a transcript, supports continuation and saves a terminal; the read-only
entry point builds a session in memory, refuses continuation and stores nothing.
Asking the second for durability would be demanding it break its own contract,
so those arms ask what it is instead, and answer in a classification —
ephemeral-seen or ephemeral-unseen — rather than a pass.
Seven dimensions, one row each, because a skill can share one domain and not
another: scheduler, graph, journal, store, cancel, restart, identity. The
scheduler has no refusal hook to read, so admission is established as an A/B —
the call is out, unanswered, the ceiling occupied and no child of its own has
reached the provider, against the same dispatch with capacity free whose child
is inside it. Only the slots check is reached that way, and the README says so
rather than letting a writer claim be read as measured.
Identity reads the two entry points apart. A model-invoked skill has a call to
join to; the controller's own drops that id deliberately, so an empty one there
is top-level provenance and not a lost join — both run in one death so the row
compares two lineages rather than a value against an expectation. The cancel row
judges the terminal against an observed cause, never wording: the child's own
context closed, which is what a cancellation does to it and a failure does not.
The queued arm is the negative control and bounds any convergence: an execution
the scheduler never admitted produced nothing, so a change that satisfied the
running arm by preparing a transcript at dispatch would break it.
Three labelling faults were caught while building this and are fixed here rather
than reported later: a journal and a store that were empty on both sides read as
persisted-direct, a restart row credited the holder fleet's interruption to the
skill, and the stop row named a guarded turn caller-owned. Absence now has its
own verdict, evidence is filtered to the execution it belongs to, and the graph
row carries the whole graph's node count so "the filter found nothing" cannot be
read as "there was nothing to find".
PROBE-PARALLEL sat inside PROBE-PARALLEL-IDENTITY, and sentinels are matched by
substring, so the identity arm's prompt opened the cancellation fan-out as well
as its own. The arm then reported a scenario nobody wrote: five extra workers it
never dispatched, appearing or not depending on where the death fell relative to
a fan-out that was never part of its design.
It surfaced as a verdict that moved with an unrelated change, which is the worst
way to find it — a real reading in an arm measuring something else. Removing the
containment returns the row to exact on three runs out of three and takes the
uninvited fan-out out of the arm entirely.
Care had already been tried and was not enough: the child sentinels carry a
comment about exactly this hazard, chosen after it bit once, while the parent
sentinels had no guard at all. So the rule is a test over every sentinel in the
probe rather than a second comment, and it is the containment that is checked,
not the spelling.
8d-1 measured one store answering differently about executions it holds the same
evidence for. A fan-out item whose slot the scheduler had granted, whose child
had reached the provider, and whose start the journal had recorded was absent
from the sub-agent store entirely — live and after a restart — while a lone
delegation in the same death, the same store and the same join read running and
then interrupted. The store is what list_subagents, read_subagent_result and
adopt_ref address, so that item was work nobody could ask the host about.
The cause was where the store's record hung, not what the fan-out is. A lone
delegation marked it from the lifecycle that opened it; an item whose group did
the opening had no lifecycle, so it reached the same runner and none of the same
record. The boundary now belongs to the run rather than to whoever opened it:
every delegated execution crosses beginExecution once it holds a slot and has a
transcript, and there it is recorded, then drawn, and only then may act.
Nothing else moves. The group still owns dependency, adoption, skipping and
settlement; an item the scheduler refused is owed no record and still gets none,
which is the proxy this line of work removed and must not reintroduce. What did
have to move is the picture: the slot grant used to draw a fan-out item running,
which put the drawing ahead of the record, so both entry points' start hooks now
write the journal and nothing more. The item's node travels with the sink it was
drawn on, because a fan-out item's own sink forwards tool events and drops graph
deltas — the picture is reachable only through the group's.
A refused record stops the run at both entry points, and that is now asserted
rather than reasoned about: the child must not act, nothing may be drawn running,
the slot must come back, and the journal keeps the start it honestly wrote. Two
mutations were run against it — the boundary skipping the store for an item whose
node someone else drew, and drawing before recording — and each turns the suite
red, the first only on the fan-out side.
The active-store arm's two cells flip as specified: an executing fan-out item
reads running then interrupted where it read no record twice, list_subagents
shows it, and the refused item stays absent. Across all 47 arms nothing else
changes but the two fan-out arms whose store row now sees the child that was
executing, and parallel_tasks converges on the same contract.
8d-1 asks the narrower question rather than the parity one. Not "does a fan-out
item get what a lone delegation gets", which would be a finding about two code
paths, but: once the scheduler has granted a slot and the child has reached the
provider, is that execution something the sub-agent store can be asked about?
The store is what list_subagents, read_subagent_result and adopt_ref read, so an
execution missing from it is missing from every recovery surface there is.
One death holds four populations under a ceiling of two. The delegation goes out
first and holds a slot to the end, which is what keeps capacity from returning
under the fan-out; the fan-out's first item takes the other, settles, and frees
it for exactly one of the two behind it. Which of those two wins is the
scheduler's, so the arm reads the populations off the journal rather than off the
ids the dispatch declared — naming them would have made a race the premise.
The finding is a conjunction and each part is its own column: the journal proves
the slot was granted, the child proves it arrived at the provider, and the store
is asked about that execution. Any two of them are not it. A grant with no
arrival is an execution nobody has shown happened, and an absent record for work
that never ran is the correct answer.
Two rows are the arm's own falsifier: the settled item and the lone delegation
run the same acknowledgement check against the same store and the same join, so
a green there is what says the check can see a record when one exists. A third
bounds any fix — an item the scheduler refused is owed no record, and a change
that recorded every opening would satisfy the row under measurement by
reintroducing the proxy the delegation arms just removed. A fourth pins
reconstruction: no node comes back running, and both cuts keep their class.
Measured: the settled item is completed in both processes and the delegation is
running then interrupted, while the executing fan-out item is no record in
either, and list_subagents shows the delegation and not the item beside it. The
refused item is absent as it should be, and the rebuild names both cuts without
a ghost. The arm needed the auto gate the other delegation arms already have;
under the denied default a fleet is refused before any child starts.
The last cut reported that a turn's stop reached work already handed to a
background job. It did not. That arm dispatched a foreground delegation: the
task call only sets run_in_background for arms the probe lists as backgrounded,
and this one was not on the list, so the row said "work already handed to a job"
about work that had never been handed anywhere.
Three arms now read both trees at one instant, and they agree:
parent stop, foreground turn ends — child ctx closes record settled
parent stop, backgrounded turn ends job runs child ctx open record still open
the job's own stop turn active job gone child ctx closes record settled
The handoff boundary holds. A stop aimed at the turn does not reach the tree the
turn gave away, and the job's own stop does — which is the ownership this step
built, now measured from both sides rather than assumed from one.
Each reading keeps five facts apart, because a context that closed and a call
that returned are different events: work whose caller stopped waiting leaves the
same absence behind as work that was cancelled, and only one of those is a
cancellation. The two positive controls are what make the middle row mean
anything — without the job-kill arm, a reading that could never see a job's
context close would report the same green.
One question was dropped rather than answered: a second backgrounded run
dispatched after the stop, to ask whether the manager's own root survived. It
reported "refused new work" for a reason the probe could not explain, and an
unexplained failure inside a measurement path is exactly the proxy this line of
work keeps removing. The question is already answered directly — a job still
running with its child's context open is the root — so the experiment went and
the observation stayed.
Two retractions in three cuts, both the same class: the arm was measuring
something other than what its row named. First the wrong owner, now the wrong
subject.
The last cut reported a cancellation defect. It was measuring the wrong owner,
and this A/B retracts it.
A turn the controller admits itself — what Send opens, and what a person's Stop
reaches — carries the cancel the gate holds. A synchronous Run is never admitted
through that gate: the controller holds no cancel for it, and the caller's own
context holds the only one. The probe had been driving Run and then calling
Controller.Cancel, which claims nothing there, and reading Running(), which
answers for a gate that was never told about the turn — so "the turn ended while
its work ran on" was two facts about two different things.
Read the right way round, the interactive surface is correct. An ordinary shell
the turn is waiting on ends the moment the stop arrives. A delegation stopped
while the scheduler still held it back settles with no store record, and one
stopped while its child was executing settles with the child's own cancelled
terminal — the table this step was aiming for, on the path a person actually
uses. On the other surface both halves hold too: the controller leaves the
caller's work alone, and the caller's own cancel ends it.
One arm is red, and it is the one that matters most. Work already handed to a
background job — which the tool result tells the caller runs across turns — is
gone the instant the parent turn is cancelled, with the probe confirming it was
live when the stop was issued. That contradicts the ownership boundary the
handoff exists to draw. The mechanism is not located here: a job's context is
rooted in the manager, not the turn, so something else in the child's chain is
carrying the cancellation, and finding which edge is the next cut's job rather
than a guess in this one.
The readings now say what surface they came from, so neither answer can be read
as the other's again.
8c left one reading unexplained: a cancelled turn ended while its foreground
delegation stayed open and its child kept running. That could have been three
different defects, so this is the probe that tells them apart rather than a fix
aimed at the first guess.
Four readings, and they localize it. A plain shell — `bash sleep 30`, a tool
that derives its context the way every tool does — is still running three
seconds after the stop, with the turn already ended. So the fault is not in how
a delegation derives its context: an ordinary tool loses the same cancellation.
The delegation arms agree from both sides of the slot: one stopped while queued
and one stopped while executing are both left open after the turn is over.
The fourth is the negative control and bounds any fix. Work already handed to a
background job keeps running when a stop is aimed at the turn — which is
correct, and is what a cancel that reached everything the session knows about
would destroy. A fix passes this arm only by cancelling what the turn owns and
nothing further.
The delegation arms now carry this as an invariant instead of a premise: once
the turn has ended, nothing it owned may still be open. An open record implies a
live owner, since nothing else closes one, so the child's liveness rides in the
reading as evidence rather than standing in as the test — a delegation still
waiting for a slot has no child at all and is just as much still owned. That
also fixes a hole in the first version of the row, which read a queued
delegation's absent child as work that had ended.
No production change: this says where to look, and the next cut says what to do
about it.
8c asked one question: on each side of the slot grant, who owns the ending. The
answer the code gave was wrong on the near side. A backgrounded delegation
killed while it was still queued wrote a failed child record — and the store
outranks the lifecycle on a rebuild, so a cancellation before anything ran came
back as a failure that never happened. The journal said it plainly at the same
time: opened, queued on slots, settled, never started.
The cause was not vocabulary. A background run has its transcript before it has
a slot, so "a run object exists" had come to stand in for "a child executed",
and every early exit on that path wrote a terminal for it: a refused admission,
a writer registration that failed, a store that would not mark it running. None
of those is an execution outcome. They now return their error and leave the
store alone, which the journal's opened-queued-settled already accounts for.
Four arms hold the boundary from both sides. Backgrounded, a delegation killed
while queued now leaves no child record and rebuilds as cancelled; one killed
while running keeps its own cancelled terminal and rebuilds exactly. The rows
carry a cross-authority check that refuses the combination neither layer may
produce — a child record for work the journal proves never started — because a
state comparison shows that only as "cancelled came back failed".
The two foreground arms do not establish. Stopped through the turn's own cancel,
the turn ends — running=false, no cancel pending — while the delegation is still
started and never settles: its child keeps waiting on a context the cancel did
not reach. That is a separate question from ownership and is left open rather
than guessed at; the arms report it as their premise failing, with the reading
that produced it. Cancellation at the delegation's own context settles and
records correctly, which a unit test now holds.
8a and 8a.1 measured two failures with one cause. A single task reached the
same runner a fan-out item does and none of the same records — nothing on disk
for a restart to read — and it drew itself running before it had asked the
scheduler for anything, so a delegation the ceiling was holding back appeared,
to the graph and to the parent, as work in progress. Both came from the same
place: states were being inferred from where control flow stood rather than
projected from what the scheduler and the child's own ending had proven.
The lifecycle is now one thing that decides nothing. It opens after every
deterministic refusal has answered — a prompt that would not settle or a
runtime that would not resolve is not work orchestration ever held — and writes
the opening from the same delta the graph is drawn from, journal first. The
node opens pending. Queued and its cause come only from the scheduler's first
refusal; running only from the slot grant, and behind it the store's own record,
so nothing shows a run executing that the store has never heard of.
Two proxies are gone. The foreground no longer announces running before
acquiring a slot, and a background run no longer reports queued because a job
was registered: that word now means the scheduler refused, and an immediate
grant goes straight to running. What tells a caller its work was handed to the
background is the tool result, which says so in words.
A backgrounded delegation is on the graph like any other. Hiding it was the
lexical lifetime of the old opener, not a semantic: run_in_background decides
whether the parent waits, not whether the delegation exists. Ownership moves
with the handoff, exactly as the progress tracker's already does — the caller
settles what it still owns, the job settles what it took.
The store's parent is now the execution's own node. That join is what a rebuild
reads, and with the journal keyed by node and the store by call, a completed
lone delegation rebuilt as skipped: the outcome could not be found. The two
spellings are one identity again.
read_only_task keeps its promise: ephemeral entry points write no journal, so a
research child stays out of the history a restart rebuilds from, while its
caller still sees what it delegated.
Six mutations were run against the new tests: publishing before recording,
opening the node running, marking the store running before the slot, settling a
handed-off run at the outer return, telling the parent running before the slot,
and recording an ephemeral delegation. Each turns the suite red. The five
process-boundary arms now read pending→queued(slots)→before-start and
pending→running→during-execution on both entry points, and a completed
delegation rebuilds exactly.
The boot-wired skill runner prepares its own transcript rather than going
through this path, so it inherits none of it yet; that is 8d's question, not a
gap this closes quietly.
The four arms before this all asked what a restart can say. This one asks about
now: fill the session's ceiling, delegate once in the foreground, and read the
picture while the scheduler is refusing the delegation admission. A graph and a
parent status are claims about the present — a restart cannot correct one,
because by then it describes a moment nobody can observe again.
It is drawn as running. The node reads probe_task/sub-1:running and the parent
is told running, while the child has not reached the provider at all and the
fan-out holding the ceiling has queued=slots on disk. The lone path calls
trk.running() and publishes its node before asking for a slot, and its scheduler
hooks are nil, so nothing later corrects either.
The premise is established from both sides rather than assumed: the ceiling is
proven full by the control fleet's own journal, and the delegation's child
leaves a record when it reaches the provider, so "it never started" is read
rather than inferred. The arm then settles for two seconds and asks again — a
child that was merely slow to start would have arrived, and the death would be
measuring a race instead of a refusal.
The same row is carried by the background queued arm, where it holds: that path
draws no node at all and its parent status is the job's registration rather than
a scheduler verdict. Two different pictures of the same refusal, and only one
of them says something untrue.
A single task is not a second executor. It reaches the same RunProfileSpec a
fleet item does, asks the same scheduler for a slot, and draws its node through
the same publication. So the question these four arms ask is not whether a lone
task has a graph — it does — but where that shared chain stops being wired to
the durable authority the fan-out arms established. No production code changes:
this is the reading, taken before anything is moved.
Four deaths, because they can answer differently. A delegation that finished in
a turn that closed loses nothing to interruption. One killed mid-execution is
the fan-out arms' death, one entry point over. And the two background arms are
the ones the foreground cannot stand in for: a backgrounded run hands its
execution to a job and asks for a slot inside it, so the parent call has already
returned when the refusal lands, and the terminal belongs to the job.
What the matrix says, across all four:
durable opening, queued, started, settled — nothing, in every arm. The
journal is never written for a delegation that did not come from a fan-out.
the rebuild — nothing: no node, no grant, no worker, no wait, no
interruption. A restart reads a session that delegated nothing, even in the
arm where the store still holds a completed child.
the live graph — a foreground run draws its node; a backgrounded one draws
none at all, which is the early return openDelegationGraph takes for a run it
cannot settle. The live parity is already asymmetric.
the sub-agent store — the one layer that survives, unevenly: a completed
foreground child persists directly; a background child is recorded running
and reads back interrupted; and a foreground child killed mid-execution
leaves nothing at all, because nothing is written until it settles.
the identity join — the store's parent call, the call the model made, and the
node's parent are one identity in three arms, and the fourth is only absent
because that death has no store record yet. Step 8 does not need an identity
invented for it.
The queued arm fills its ceiling with a fan-out, and that fleet rides along as
the positive control: same session, same scheduler, same journal, and every
transition recorded. What these rows report missing is missing at the entry
point, not in the machinery.
Two things the harness needed to ask honestly. Rows are filtered to the
delegation under measurement, or the control fleet's own record would have read
as the lone task's and reported the gap closed. And the arm whose turn has to
end signs the host's steps off with complete_step, one per round: a turn that
called a tool cannot deliver while the list is open, and a todo_write that marks
an item completed on its own is refused by design.
read_only_task is deliberately outside this: it declares itself ephemeral, so a
journal entry from it would break a contract rather than close a gap.
Step 6 proved the graph can be rebuilt and 7d proved the view folds it. Both
are value comparisons, and the defect this line of work exists to prevent
agrees with them on every value: a history replayed as live transitions settles
on exactly the right graph and tells the user that work which ended in a dead
process is starting now. Only a sequence separates the two, so `ui-graph-mixed`
records one.
The arm dies holding all seven states at once — a settled fan-out beside a
mid-flight one, which is the only way a skip and a running item coexist, plus a
ceiling of one so something is queued and never admitted. The resumed process
then serves that session on a loopback listener and runs the real client
against it: the production port, the production store, bundled out of the
frontend's own sources with its own toolchain. The probe plays only the part
the shell plays — forwarding the kernel's frames onto a bus with no reconnect,
which is the transport the bootstrap was written for.
Seven rules follow, each a rule rather than a comparison: the first picture is
loading then a snapshot; every execution the dead process opened enters through
that snapshot; none of them is ever drawn as pending, queued or running, not
for one render; the interruptions the view names are the ones the host derived;
work dispatched after the resume arrives as a delta; nothing is introduced
twice; and no delta names work the dead process opened.
That last rule is the one a first-appearance check cannot reach. A republished
history moves no visible state — the fold is idempotent, the snapshot arrived
first — and is still the kernel saying that finished work is happening. It is
also what makes the sabotages fail where they should: `-sabotage publish` fires
a resume that republishes what it rebuilt, and only after the client has read
the snapshot, because what a resume publishes before that is numbered below the
watermark the client resumes past and the bootstrap absorbs it. `-sabotage
trajectory` restores the line 7d deleted, the one that built the graph out of
the recorded trajectory: it fails the republication rule and the ghost rule
together, putting pre-death nodes back on screen as pending and running.
Staging the second one needed the dying process to record what a window
records. A wire log is written by the server, and a headless construct never
had one, so the trajectory it left behind held none of its own frames and the
sabotage was feeding an empty file. The construct now attaches the same
recorder a window attaches, which is what the process being modelled has.
The nine fan-out latches became one named state keyed by sentinel. Each new
fleet was adding another flag to a struct that already carried twelve, and the
one meaning that is not per-sentinel — the arm's own fan-out has gone out, so
the terminal arms hold the turn open — stays a field of its own.
Runs: clean holds=7, publish VIOLATED=1, trajectory VIOLATED=2. The judgement
itself is held by uirows_test.go, because a full arm is three processes and a
live kernel, which is the wrong place to discover a verdict was computed
backwards.
The panel used to build its graph by replaying the trajectory's deltas, which
is what made a resumed session look like a run that had just happened: every
node arrived as a transition, in the order the frames were written. It now
reads /execution-graph and folds the live stream onto that answer. The
trajectory keeps feeding the trajectory pane; it feeds the graph nothing.
Snapshot and delta are kept apart on purpose. A snapshot replaces the model —
the graph, the interruptions, the unrecorded identities and the session it
describes — because the last three have no delta at all: nothing in the stream
can add or retire an interruption, so a merge would keep one the rebuild has
since resolved. A delta carries nodes and edges and nothing else, which is what
stops a live frame from arguing with the authority about the rest.
Two races, two mechanisms, because they are not the same problem. A session
change bumps a generation the read carries, so an answer for a conversation the
view has left cannot be adopted by the one it shows now — "the newest answer
wins" is exactly what loses that race. And the session the answer names decides
what happens to the deltas held while it was in flight: numbered past the cut is
not enough when they describe another run.
The held deltas are this model's own boundary, not the transport's. A first
bootstrap is covered by the stream holding its frames; a gap happens with the
stream running, so the store holds what arrives while it re-reads and then folds
only what the snapshot cannot already account for. A delta numbered at or below
the cut is dropped rather than folded: an older publication would take a settled
node back to what it said on the way there. The watermark is that read's cut and
nothing else — no graph cursor is kept, and none should be.
A session switch clears rather than dimming the old graph. Some hundreds of
milliseconds of "loading" is worth more than the same milliseconds of a picture
that belongs to a conversation nobody is looking at.
What the panel now says out loud: executions whose owner disappeared stand
beside the graph with the two kinds told apart and neither offering to resume;
a node whose worker layer was never recorded says so, rather than showing the
same blank an inherited identity shows; and the queue's refusal is worded as
what was recorded when the node queued, not as what it is waiting for now. The
state also records whether a snapshot or a delta last moved it, which is the
difference a view needs before it can animate anything.
The mock port answers the same contract: it numbers its frames, holds them
while a subscriber reads its snapshot, and answers with the fold of what it has
published. Otherwise the snapshot path would exist only against a real kernel,
which is where it is hardest to see fail.
Two gates were widened to hold this. The four types the desktop re-declares by
hand are now declared mirrors, so a field the kernel sends and the page cannot
read fails; and the route guard's regex could not see a typed read at all —
this.get<T>("/x") matched nothing, hiding 24 of the client's 60 paths from the
check that exists to keep the shell's table honest.
Seven mutations of the store and three of the view were run: dropping the
resync buffer, the watermark cut, the generation check, the foreign-session
rule, merging a snapshot instead of replacing, keeping the old graph across a
reset, answering zero for a failed read, drawing the identity marker without
the list, drawing the old graph while loading, and never rendering an
interruption. Each turns the suite red.
A read model that bootstraps from its own authority needs one thing from the
transport: everything after the frame its snapshot names, exactly once. That is
what the broadcaster already numbers and holds — SubscribeFrom for a reconnect,
Replay for the shell's bus, which has no connection to re-establish. So the
graph gets no cursor and no replay of its own; subscribe takes a bootstrap read
and answers with the same one stream.
The cursor stays the stream's. 101 may be a graph delta, 102 an approval, 103 a
delta again — a cursor that only advanced on the frames one model folds would
read 102 as a hole it never had and ask for everything after it a second time.
The bus is already delivering when a page attaches, so frames are held from
before the transport is wired until the replay lands, and merged with what the
replay brings by number. Both paths reach the same frames: the log holds
everything after the cursor, the frame that exposed the gap included, so a
replay answers with a copy of it. Folding both is what put the same tool result
on screen twice, and the cursor now settles it — a numbered frame at or below
what has been folded is the same fact arriving the other way.
A watermark and a gap frame both state a position, and while a bootstrap is
stating one from a snapshot neither may baseline the cursor: taken here it
would sit ahead of frames still held, which are then dropped as duplicates of
nothing. The hole itself still reaches the caller, because a gap is a transport
fact and which authority each model re-reads to close it is the caller's — the
transcript for one, the run graph for another. The comments that said /history
have been corrected to say that.
Inside Studio /execution-graph answered index.html: 7a registered the route and
taught the dev proxy about it, but not the shell's own table, which the shell's
route-parity test had been failing on along with /adjudications and
/context/window. All three are routed now.
Seven mutations were run against the tests: dropping the replay, dropping the
buffering, dropping the dedupe, advancing the cursor only on graph frames,
letting either meta frame baseline during a bootstrap, and never releasing a
failed one. Each turns the suite red.
Step 6 proved the graph can be recomputed. This is how a reader gets it:
Controller.ExecutionGraph rebuilds from the journal, the store and this
process's own claims, and nothing is emitted. A reader asks; it is not sent
a stream of transitions that already ended, which would tell it a child had
just been spawned and had just completed when neither happened.
The snapshot carries what a graph alone cannot say. Executions whose owner
disappeared ride beside it rather than inside a node state, because the
vocabulary has no word for work nobody is running. So do the executions
whose worker layer was never recorded: their model reads empty for a
different reason than an inheritance does, and showing both alike would
claim an observation the host never made.
Over HTTP the watermark is read before the rebuild, and that order is the
whole contract. Read after, a transition landing in between is numbered
below a watermark the client then resumes past, and the frame is lost with
nothing later to reveal it. Read first, the same transition is replayed onto
a snapshot that may already hold it — which the fold absorbs, because a node
is upserted and an edge added once. Duplicates are safe; gaps are not.
The test drives the real handler and settles a worker during the rebuild, so
inverting the two reads turns it red rather than leaving it a comment about
intent. The snapshot also names its session: frame numbers keep climbing
across a switch while the replay tail is cleared, and a client that merged a
new snapshot with the previous conversation's deltas would fold two graphs
into one.
/graph gives a headless run the same answer. That is not symmetry for its
own sake — after the process that ran a fan-out is gone, this is the only
way to ask what it did, and frontend parity was what pointed out the gap.
GraphDelta is unchanged. It stays the low-latency projection of the same
facts; the snapshot is the authority.
A node's model and effort survived a restart only when a caller had named
them, and the reason was not that the fact was unrecoverable — the store has
a model for every child that ran. It has a different one. The store resolves
inheritance; the graph's field does not, and an empty model there says the
worker layer named nothing and the parent's value stands. Filling one from
the other would have made the rebuild more specific than the picture and
deleted that.
So the opening records it, taken off the same delta the graph is drawn from
rather than resolved a second time, and the rebuild reads it from there and
never from the store.
It is stored whole, present even when both fields are empty, because absence
and "named nothing" are different answers that both read back empty. Only
presence separates them, and without it a sidecar written before this would
report as an exact reconstruction of an inheritance nobody had recorded. An
older entry that has none leaves the identity unknown; it does not borrow the
store's, and it is not migrated.
Measured, all three fan-out arms: states, topology, grants, wait causes, the
interrupted set and identity are exact. The identity arm's four shapes each
come back as they were drawn — an inherited model stays empty beside a named
effort, and an adoption stays empty on both.
Step 6 closes with no vocabulary added beyond this one field.
The rebuild was lossy on model and effort, and the reason given for it was
wrong. This arm names a worker four ways across both producers and reads
every layer:
item graph store
names nothing none/none probe/scripted/none
names a model and effort probe/alt/high probe/alt/high
names only an effort none/low probe/scripted/low
adopts, runs nothing none/none no child at all
fleet and parallel_tasks agree cell for cell. There is no producer
disagreement: the earlier reading that one filled the caller's request and
the other the resolved identity does not survive naming a model and looking.
Both go through the same resolution; what differs is the layer they report.
The graph shows what the sub-agent layer resolved, where empty means inherit
the parent, and the store shows the final identity with those blanks filled.
Which makes the remaining loss one item shape: a caller that named something.
Everything the graph shows for those is in the store, and taking it would
make the rebuild more specific than the picture — an inherited blank becoming
an explicit value, which is how the first attempt at this ended up knowing
more than what it was rebuilding.
So it is a choice, not a gap, and the arm exists to state it rather than
settle it. Either a node's model means the final identity, and the producers
fill it from the store's layer with nothing new recorded; or empty keeps
meaning inherited, and that is a fact only the journal could carry.
Two probe defects fixed on the way: a second model reference, because with
one every layer of the resolution collapses onto the same string and none of
this is visible; and a wait that stopped at the first producer to settle,
leaving the other two unread.
The graph a process draws dies with it. What outlives it is the execution
journal and the store's record of the children that ran, and those two now
fold into the same vocabulary the live graph is drawn in.
It recomputes rather than restores. Nothing reads a file, emits an event, or
knows what an agent is: the inputs are read models the caller loaded, the
output is a value, and the same inputs always give the same picture.
Two states are never rebuilt. An execution that was running or waiting when
its owner disappeared does not come back as running or queued — the owner is
gone and either would describe work nobody is doing. They come back as
identity and topology with no state, named separately as interruptions and
split by whether they had reached a slot.
Measured against what the dying process drew: states, topology, grants, wait
causes and the interrupted set are exact in all three fan-out arms.
One gap remains, and it is narrow: the worker override a caller named for an
item. The store keeps the identity it resolved, which is a different fact —
filling one from the other would put a third meaning on the field — and the
journal records neither. It is also not consistently meant before a restart:
fleet fills it with the override and parallel_tasks with the resolved
identity, so what a rebuild should agree with depends on the producer.
Two probe defects fixed while establishing this. The identity comparison was
green because the arms never named a model, so both sides agreed a field was
empty; it names one now. And PROBE-CHILD-FAIL is a prefix of the sentinel
meant to delay the second failure, which sentinels match by substring, so the
two skip arms had been differing by whatever the runtime chose rather than by
construction. The cause rule survived that — it reads the order that actually
happened — and the arms now hold the second failure until the first is
recorded, and repeat.
The skip-cause row reads three ways: what the picture named, what this
benchmark works out on its own, and what the production fold concludes. A
probe that only asked the implementation would agree with it by construction.
Three arms ask whether skipped, its cause, and the context edge need
records of their own. None of them does.
They stand on one join: a child's metadata names the execution it ran for,
so a restart can ask the store what each item ended as. Answered is then
computable without the graph — an adoption says so on its own opening, and
everything else is the store's terminal.
Skipped state derives. An item released without ever starting, ordered
behind something that did not answer, is exactly the set the picture drew,
in both skip arms and empty in the arm where both upstreams answered.
Context derives, including through an adoption. The dependent receives from
one completed and one adopted upstream and the prediction matches edge for
edge. The adopted half works only because the source rides the opening:
without it that upstream would read as unanswered and the edge would go
missing — which is what the arm before this one measured.
The cause derives too, but not the way it looks. The skip arms leave
identical durable facts and the picture names a different upstream in each,
so declaration order is refuted outright. Earliest release holds both times,
and not by luck: a fan-out cuts a branch when it processes the first result
that did not complete, and the journal releases an item in that same
handler. The order it records is the order the choice was made in. The cause
is a historical fact that is already written down, in the timestamps.
The answered arm waits on a delivery edge rather than a count of completed
items — the warm-up fleet alone satisfied the count, and the observation was
taken before the fan-out under test had started.
An adopted item survived a restart as adopted and could not say what it
adopted. The disposition rode the opening — an adoption is declared before
anything runs — while the source lived only in the edge the graph drew, so
a restart could see reuse and not what paid for it.
The source now rides the opening too, taken from the same delta the adopt
edge comes from. That is what keeps the two from naming different sources:
there is no second place to compute it from, and no terminal transition was
added for a fact that was already true when the item opened.
It is carried through as the graph spells it. What kind of thing a source is
belongs to whoever reads the graph back; a journal that parsed it would be a
second vocabulary for an identity it does not own.
An opening is held to one story about itself: an adoption must name a
source, and an item that is going to run must not carry one. Only new writes
are held to that. An older entry recorded before the source was captured
stays readable as an adoption whose source is unknown — lossy history rather
than corruption, and nothing else in the record could be read to guess it,
the same reason a historical failed status is not reclassified.
Three timestamps lost an omitempty that never worked. It does nothing for
time.Time, so a zero value was emitted as 0001-01-01 under a tag promising
it would be dropped, and a consumer reading the field saw a transition that
had not happened. It read that way here first.
The probe's judgement is unchanged: the adoption-source row flips from lost
to persisted-direct on its own, while the adopted item still records no
queue, no start, and no child in the store.
The run graph tells cancellation from failure. The sub-agent store, which
owns what happened to a child, did not: every error path saved a child as
failed and SubagentStatus had no cancelled to save. The probe measured the
result as graph cancelled=2 completed=1 failed=1 against store completed=1
failed=3, with the journal — which records orchestration, not outcome —
unable to help. The distinction was not un-persisted, it was unkept.
The store now keeps it. A cancelled run persists everything a failed one
does; a transcript is as worth reading when work is cut short as when it
goes wrong, and only what it says happened differs. One status covers both
ways a run is stopped, because the graph maps a cancelled context and an
expired deadline onto one state; which of them it was rides beside it, so
the two owners share a vocabulary instead of splitting one.
Only the two seams where a child actually ran may read a context error as a
terminal outcome. The other four SaveFailed callers — a failed writer
registration, a panic, a refused slot, a transcript that would not save —
are host failures whose chains can carry a cancellation without the work
having been stopped. They keep calling SaveFailed, which takes no error and
therefore has nothing to classify: the negative control holds by shape
rather than by judgement.
Old sidecars are not migrated. A historical status=failed was written by a
store that never knew this distinction, and the same error text can come
from paths that were not cancellations; reclassifying on it would invent
provenance nobody recorded.
The probe's judgement is unchanged and flips on its own, VIOLATED to holds.
Its journal row is part of that gate: teaching the journal about
cancellation would have made the comparison green while breaking the
boundary it exists to protect.
One group reaches all three executed terminals, and the two owners of that
fact are read side by side:
graph: cancelled=2 completed=1 failed=1
store: completed=1 failed=3
journal: all four items open+started+settled
The graph draws cancellation apart from failure. The store, which owns what
happened to a child, folds it in — every error path saves a child as failed
and SubagentStatus has no cancelled to save. The journal cannot help: it
records orchestration, not outcome, and all four items left the same shape.
So the distinction is not un-persisted, it is unkept. No owner has it, and
no journal record could recover it — writing one would create a second
authority for a fact the store already owns, with nothing to settle the
first disagreement.
The arm reuses the terminal family's shape: the fan-out runs, the turn is
held open, and the process still dies inside it. Cancellation comes from
the turn's own context, since the synchronous headless Run does not pass
through the gate Controller.Cancel operates.
SETTLED says an opening is no longer active and nothing else. Four arms
ask what that costs, by putting lifecycles that look identical beside
meanings that are opposite.
Adopted survives, and not by accident: the disposition rides the opening,
because an adoption is declared before anything runs. Its source does not.
The reference whose answer stood in is drawn as an edge and recorded
nowhere, so a restart can say an item was adopted and not what paid for it.
The collapse is elsewhere. open+started+settled covers completed, failed
and cancelled alike. Skipped is distinguishable today only because nothing
else produces open+settled — a distinction by absence rather than by
record — while a cancellation before admission is distinguishable for a
real reason: it left a queue record.
One population turned out not to exist. These arms expected two routes to
skipped, and parallel_tasks' is unreachable: running[idx] is set when an
item is dispatched, not when the scheduler admits one, and every item is
dispatched in one pass, so a cancellation finds all of them running and
marks them cancelled. The arm was renamed to what it reaches instead of
being constructed into the shape it was supposed to have.
Context needs no record of its own. Two samples — an upstream that
answered and one that failed — both show the delivery edges matching what
an ordering edge with an answered upstream predicts. What it does need is
that upstream's disposition, which is exactly what is not durable: after
the boundary the prediction goes empty, because the answered set comes
from the graph and not the journal. Context belongs behind whatever makes
a disposition durable, not beside it.
Controller.Cancel does nothing to a synchronous headless Run — that path
does not pass through turn admission, so the gate has nothing registered
for it. The arm cancels the turn's context, which is how a headless caller
interrupts anyway.
A ready item the scheduler turned away came back correctly classified and
unexplained. Four falsifier arms showed why nothing else could answer it:
the refusal exists only at the moment it is made, and by the time anyone
asks, the constraint is gone.
OnQueued is that moment, and the record goes ahead of it — the third seam
in the same shape as the first two, and fallible for the same reason. A
request whose wait could not be recorded is withdrawn rather than shown
waiting, with the care the cancellation path takes: capacity may have been
granted since the refusal, and a slot nobody releases never comes back.
All three causes are kept. The scheduler knew whether total capacity, the
writer ceiling, or a path conflict turned the item away, and a journal that
folds that into "a ceiling refused it" cannot get the distinction back. A
reader wanting capacity-versus-claim can fold them at the read surface; the
record does not fold them first.
The cause is the one that queued the request, never the one holding the
item now. The transition arm measured the difference: it freed the ceiling
the refusal named while the item stayed queued under a different one, and
the report never moved. So the record is named for entering the queue, a
later cause cannot rewrite the first, and a queue record arriving after the
item started or settled is refused.
A queue record also proves the dependency gate was crossed, which a declared
ordering alone never could: an item reaches the scheduler only once its
upstream is answered. The mixed arm's blocked item reads "open" and nothing
else; a refused one reads "open queued(slots)".
Measured, all four arms: the cause is read back intact after the restart,
and the item blocked by a dependency still records no refusal at all.
STARTED settled the classification: an item that never reached a slot comes
back as interrupted-before-start. It did not settle why. Four arms ask that,
and none of them changes production code.
They are four rather than one because canStartLocked decides in a fixed
order. An arm that let an earlier check fire would report that refusal as
the later one, so each clears everything above what it measures: the slots
arm refuses a reader, which is not a writer at all; the writers arm leaves
total capacity free and gives its two writers disjoint paths; the claim arm
leaves both ceilings free and overlaps the paths. Ceilings come from a
project reasonix.toml, which is where a person sets them.
The claim arm needs two fan-outs. A single fleet's preflight refuses
concurrent writers whose claims overlap, so the holder is dispatched in the
background and the refused writer comes from a later fleet. It and the
transition arm wait on a signal the holder's own child sends once its slot
is granted — reaching a provider call is the first moment the slot is
provably held, and dispatching before it lets the refused item start.
Measured: each refusal is reached in isolation, reported exactly once, and
the restart still classifies the item correctly — while which ceiling
refused it is gone. Nothing carries it and nothing can re-derive it: the
constraint no longer exists by the time anyone asks.
The transition arm answers what a cause means. It frees the ceiling the
refusal named while the item stays queued, now held by a different one, and
the graph still reports the first. One report, not two: the cause is the one
that queued the request, not the one holding it now — so a durable record of
it belongs under a name about entering the queue, not about waiting.
An item that never started is explained by what it was held behind, and
that explanation died with the process. The mixed arm could say fleet-3
was interrupted-before-start and nothing else: the edge naming what it was
ordered behind lived only in the plan the dispatching call held.
The plan is already decided when the fan-out opens, so the ordering rides
the opening rather than waiting for a record of its own. Both the graph
and the journal are now derived from one delta, which is what stops them
drifting: an ordering edge the graph draws is one the journal can be asked
about after a restart, and there is no second place to forget.
Only Depends is read. An adopt edge names reuse and a context edge names
delivery; neither holds an item back, and reading either as ordering would
explain a start that nothing had blocked.
A dependency is deliberately not recorded as scheduler state. An unmet
dependency is why an item is not yet ready; a slot is what a ready item
waits for; agentgraph keeps pending and queued apart for that reason, and
collapsing them into one "waiting" would lose the distinction the
vocabulary was built to carry.
What it still cannot say is written down rather than implied: a declared
dependency does not prove the dependency went unmet. An item whose
upstream finished, which then queued and died waiting for a slot, reads
the same. Separating those needs a durable record of entering the queue,
and the arm that would prove it worth having does not exist yet.
Measured: the mixed arm's restart reads fleet-3 <- fleet-2 unchanged
across the boundary, and still classifies fleet-3 before-start against
fleet-5 during-execution.
An opened delegation and a running one reached the next process as the
same fact. The mixed arm proved the cost: a restart inherited two
interruptions, one that had been executing and one its dependency had
blocked, with nothing on disk able to tell them apart — so the block the
host wrote had to say it could not tell either.
The slot grant is the linearization point, and it is already a shared
seam: fleet and parallel_tasks both reach it through the hook only the
scheduler can fire. STARTED is persisted and synced there, ahead of the
running delta and ahead of anything the child does. OnStart becomes
fallible to make that enforceable rather than merely intended — a start
that cannot be recorded hands the slot straight back and the run never
acts, the same refusal an unrecordable opening already gets.
Settling without ever starting stays ordinary. A branch its dependency
cut is opened, never started, and released when the group ends; treating
that as corruption would reject a path every failed fan-out reaches. A
start with no opening is ignored, a second start does not move the first,
and one arriving after the settling is refused.
Interrupted is still never written, and neither classification offers a
continuation. They differ only in what may already have happened, which
is what the next request is now told instead of "the host cannot tell".
Measured: the mixed arm's restart reads fleet-3 interrupted-before-start
and fleet-5 interrupted-during-execution; the completed arm inherits
nothing; nothing reads as running once its owner is gone.
A turn reaches the transcript only when it ends, so a process that dies
inside one takes the whole turn with it: the request, the dispatch, and
every item the fan-out opened. The resurrection probe measured the result
as LOST-SILENT — the item that was executing had no record anywhere, not
even one saying it had existed.
internal/execjournal writes an opening before the dispatch becomes
observable, the ordering an adjudication barrier already uses. An entry
carries what is known at that moment: the item's identity, the group and
turn it belonged to, its grant, and whether it will execute at all. It
carries nothing about how the item ended. The sub-agent store already owns
that answer, and a second durable copy would be a second authority to
reconcile the first time the two disagree.
Interrupted is never written. It is derived: an open entry with no live
owner in this process. Recording it would mean the dying process wrote
down what it could not know, and a record that claims resumability is
worse than the loss it replaced — the probe ranks a ghost above every
reconstruction for that reason. What the next request is told says only
that work was opened and never settled, and that some of it may never have
started, because an item waiting on a dependency journals exactly like one
holding a slot and the host cannot tell them apart.
The live set is process-wide rather than per-assembly. That is the scope of
the question it answers: two assemblies in one process are still one
process, and a set per assembly would let each report the other's running
work as interrupted.
Measured, all three fan-out arms: the item still executing moves
LOST-SILENT to interrupted-explicit, settled items stay
reconstructed-lossy, and nothing reads as running after its owner is gone.
IsSessionTranscriptName excluded four suffixes by name and missed
.adjudication.jsonl, so every session that recorded a barrier was listed
to the user as a second conversation beside itself — one holding barrier
records rather than messages. Nothing reports this: a directory scan
classifies by name and a wrong answer just appears in the picker.
The chain of conditions is why it was missed. Each new sidecar had to
remember to add itself to a check written somewhere else, and the failure
for forgetting is silent. One list, walked by the check, makes the next
one safe without anyone remembering this file, and the test derives its
cases from that same list rather than restating them.
Three arms drive a real fleet and kill the process at three points in its
life: every item settled, one item still executing, and every reachable
state at once. Phase B loads and inspects without calling a model, so each
reading is what the host can prove before a provider call.
They classify rather than pass or fail, over two populations, because one
label covers the better half: items that had settled own durable child
records, while the item still executing has never been written down. The
readings are reconstructed-lossy and LOST-SILENT respectively, and the
ghost row — anything still drawn as running with no owner — is green only
because nothing is stored at all.
Underneath both sits the row that explains them: the turn that dispatched
the fan-out is absent after the restart. A turn is appended when it ends,
so a process that dies inside one takes the request with it, and a graph
reconstruction would have nothing to attach to even in principle.
skipped is deliberately not among the states the mixed arm demands. A
fan-out publishes a skip only in its closing outcome delta, so nothing
reads skipped while anything is running; the item whose dependency failed
sits at pending, which is what the arm dies holding. Constructing the pair
would have measured a state no live fan-out can reach.
The graph renderings are sorted: the fold keeps first-seen order and two
processes reach it by different routes, so an unsorted comparison reported
a reordering as a changed graph.
The kernel has known since the barrier landed that a run stopped waiting on a
person. Nothing outside it could see that, so a restart showed a conversation
that simply ends. This is the read surface, and only the read surface: no
button, no route that takes an answer.
Snapshot is truth, the frame is only invalidation. GET /adjudications returns
the whole thing — active and history, both present even when empty — and
adjudications_changed carries no payload. A client that missed a frame is
corrected by the next read instead of holding a list assembled from whatever it
happened to see, and a reconnect needs no replay: the notice is on the skip
list because telling a fresh window to re-read what it just read says nothing.
The frame is also the only way to announce a transition that writes nothing.
"Interrupted" is not a record; it is what an open barrier means once nobody is
waiting on it, so the same journal reads differently either side of a process
death. A client cannot derive that — it does not know who is waiting — which is
why state comes from the kernel and not from a flag on a decision.
Which is also why this is not a field on /status. A barrier has a lifecycle, a
disposition and a successor, and the overview is read on every tick.
The barrier id goes out as provenance and nothing accepts it back. An
interrupted barrier has no owner to answer to, so a route that took one would
rebuild exactly the ghost the kernel refuses to offer; a test posts one at
/answer and /approve and checks it stays active. The types stay apart on the
far side too — AdjudicationEntry is not a Decision with a flag.
Parity is one commit, not four. Route, dev-server proxy, wire kind, replay
classification, port method, fixture and the frontend union move together,
because each of those lists is a place this could have shipped half-wired and
only failed on a real desktop.
The CLI reads it too. A terminal resume prints why the last run stopped, which
is the same fact Studio will show — and the alternative was declaring the
capability serve-only and letting the parity ledger carry the difference.
The provenance surface is the sibling of the answerable one, so it sits in
SessionHistory rather than Approvals: what the host asked and how it ended is
history, and the frontends that drive one need not drive the other.
An interruption had no way to stop being current. Open with no owner made it
interrupted, and the only dispositions that ended one belonged to the waiter
that died with the process, so every later request carried context about a
question nobody was going to answer. Three successor arms measured the same
thing three ways.
A turn ends it by taking it over. The edge names which turn, so the journal
answers why the question stopped being asked with a cause rather than with
"someone saw it" — acknowledgement records that a person looked, supersession
records that work moved on, and only the second is a fact about the system.
Which turn is decided by causality, not by reading the message. A turn that
receives the interruption in its request is its successor whether the user
answered the question or asked about something unrelated; guessing at intent
would put a language judgement in a provenance edge.
The handover is recorded from markInFlightTurn: the turn is identified and
durable by then, and the model has not been called. Only barriers the turn is
actually given are claimed, so a barrier nothing showed it is not one it took
over, and a session holding two would hand over exactly what the request
carried.
The successor is read off the in-flight marker on disk rather than remembered,
which is what makes the window safe. A crash between the edge and the response
leaves that marker in place, so the retry — in this process or the next — gets
the same context; the marker clears when the turn commits, and nothing after it
carries the interruption. So a barrier is never both un-inherited and invisible.
nobody does anything still interrupted, 1 block, journal: open
a turn about something else settled, 0 blocks, superseded by that turn
a turn that reads like an answer same, and the write it held back still
did not run
That last line is the one this could have broken. Context continuity is what a
successor inherits. Execution continuation is not, and no edge grants it.
Nothing is exposed over the wire. The read model now has a fourth disposition,
which is exactly the shape that would have had to change under four callers had
it been published a cut earlier.
The derivation has no exit. A barrier is interrupted while it is open with no
owner, and the only things that close one — resolved, cancelled — belong to the
live waiter that died with the process. So the question was whether that
matters in practice, and three successors to the same interrupted barrier
answer it the same way:
nobody does anything still interrupted, 1 block
a turn about something else still interrupted, 1 block
a turn that reads like an answer to it still interrupted, 1 block
The first is correct and the other two are the cost: an interruption outlives
the work that replaced it, and every later request pays for context about a
question nobody is going to answer. Naming it sticky rather than failing it,
because what should end it is the next cut's decision, not this one's.
The answered arm is the reading worth having. A turn that reads like an answer
gets the interruption as context, and the write that question held back still
does not run. Context continuity and execution continuation come apart exactly
where they should, and now that is measured instead of argued.
These arms need a middle process that runs a model — nothing else stands in for
a person carrying on — so the rule moves rather than bends: the phase that
judges what the host knows is still the model-free one after it.
The journal also gets a fold instead of a scan. Only an open record starts an
entry, so a terminal one alone invents no history; the first terminal wins, so
a duplicate cannot restate a settled barrier; a reopen after a terminal is
refused; a torn tail is read past, because that is what a crash leaves.
InterruptedAdjudications now reads off that fold, which is where a later
disposition for a dead continuation will have somewhere to go.
Nothing is exposed over the wire yet. The response shape would have to change
again the moment that disposition exists, and it would change in four places at
once.
The barrier made the interruption durable. Nothing read it. A restart carried
the fact and neither the model nor anyone driving it could see one, so the next
turn began as if the previous run had simply ended.
It reaches the model as provenance and nothing else: what was being asked, that
the suspended response cannot be resumed, and that nothing it deferred ran. No
identity comes with it. An interrupted barrier has no owner left to answer to,
so handing back something that looks answerable is how a model is invited to
continue work whose continuation died — the ghost the previous commit refused
to build. It stays out of Decisions() for the same reason.
It is derived on every request, with no record of having shown it. The task
identity taught that lesson: "already shown" answers for some earlier request,
not the one being built.
Where it rides is not where it was planned to. Controller turn blocks look like
the natural home, but composed text becomes the canonical user message —
StripComposePrefixes exists because frontends have to take those blocks back
out for display — so a block registered there is transcript, and a later fold
would freeze it into a body. That is precisely the shape the last four commits
removed. It rides the request instead, through a narrow port the host fills:
control owns the fact, the agent only asks for it while building a request, and
nothing stores the answer.
So the ordering that fell out of the projection work now has a third layer that
belongs to neither of the first two:
frozen body + canonical tail history, foldable
host request context provenance, derived per request
todo identity tail host state, derived per request
Measured, the arm gains a row and loses none:
what the next request tells the model 0 blocks -> 1 block
the effect the decision held back did not run -> did not run
A settled barrier projects nothing, an interruption is stable across repeated
loads, the block says what was asked without offering a handle for it, and
composing a turn does not carry it — that last one is the test that keeps it
out of the transcript it was nearly written into.
A question the host puts to a person is a historical fact, and the only one in
this system that cannot be re-derived. The task list is current state, so a
restart recomputes it; a wait that happened is not, and once the process
holding it dies nothing about the workspace says it ever did. The falsifier
showed the consequence: an ask open at death, 21 messages in memory, 19 on
disk, and a restart with no way to know a turn had stopped on a person.
So the barrier is written down, and written down first. The record precedes
registration because registration is what makes the question answerable, and a
crash after that must not leave someone having been asked something the host
has no record of owing. Durable before observable is the whole invariant; the
record is appended and never rewritten, so how a wait ended stays readable
beside the fact that it started.
What is deliberately not persisted is the continuation. No blocked tool call,
no remaining reply, nothing that would let a later process pretend it can
resume the suspended response. The contract is that work was interrupted, not
that it can be picked up, and a restored card with no owner behind it would be
worse than an absent one — a question a person can answer into nothing.
Interruption is derived, never written. An open record plus no owner waiting on
it in this process is what makes it interrupted, so the answer does not depend
on a dying process reaching one more line of code. It also means the reading is
stable: a second restart derives the same thing, where a terminal record
written on resume would have made the obligation disappear after one load. The
same fact is why a live wait is not reported as interrupted — this process is
the owner.
InterruptedAdjudications is not Decisions, and the two do not share an
identity. One is a live obligation with someone waiting; the other is evidence
that a wait happened. Offering the second as the first is exactly how the
measured LOST-SILENT becomes a ghost.
The arm moves one cell and the safety row does not move at all:
what the restart inherited LOST-SILENT -> interrupted-explicit
the effect it held back did not run -> did not run
The transcript still loses the unfinished round, and that is left alone. The
fix is not to write half an assistant turn into canonical history; it is that
the host owns the fact separately, the way it owns the goal and the task list.
Decisions are a projection of what each owner is waiting on, derived fresh from
approvalManager's pending maps. Those maps are process state, and a new manager
starts empty, so a question open at the moment a process dies is gone by
construction. What has never been established is what the host believes
afterwards.
The arm does not test that a card comes back. "The same question must survive"
is a requirement nobody has argued for: the goroutine parked on it did not
survive either, and a restored card with no continuation behind it is a
durable-looking state that cannot be answered — worse than an absent one. So
the restart is classified rather than graded: resumable, interrupted-explicit,
or lost-silent, and only the last is a defect.
The reading is lost-silent. The process died with an ask open and 21 messages;
the next one loaded 19. The round carrying the question never reached disk, so
there is no unanswered call, no interruption record, and nothing that says a
turn was cut while waiting on a person. Not a fact recorded and then dropped —
one that was never written.
The row that has only one acceptable answer holds. The scripted reply asks and
tries to write in the same round; calling ask ends the round, so that write is
the effect the decision is holding back. It did not run while the answer was
pending and did not run because a later process loaded the session. Whether the
question survives is a design choice. Whether what it blocked stayed blocked is
not, and a recovery path that let it through would be the more serious defect.
The arm exits instead of shutting down, because a clean close resolves or
cancels the question, which is exactly what a process dying mid-decision does
not do. It wires the interactive approval gate the way chat and desktop do:
without it the ask tool decides for itself and nothing ever blocks, and the arm
would have measured a question that was never asked. It invalidates itself when
no decision was open at the moment of death.
The gate found two notes and one of them was stale. A fold froze the note into
its body; the next fold carried that body's remainder forward, which is what a
body suffix is for — historical material with no canonical counterpart. A step
identity is not that. It is what the host holds now, and a frozen copy outlives
the state it names: the model was shown ids the host had already dropped, and a
restart reproduced them exactly.
So the note is derived for each request and stored nowhere. Owed is recomputed
from the ids the host holds against the history that request actually carries,
which is the judgement withTodoIdentityProjection already made — only against
the wrong thing, at the wrong time, with the answer kept.
todoIdentityShown is deleted rather than redefined. It recorded that some
earlier request showed the ids, which cannot say whether this one can: the same
mistake as validating a projection by a transcript version, a scalar witness
standing in for a fact about content. With the derivation in place there is
nothing for it to answer, and nothing to persist across a restart either.
Both storage paths are gone with it. The compaction producers no longer carry
host state into a body, and the run loop no longer writes the note into the
canonical transcript. What replaces them is one seam:
modelVisibleHistory() frozen body + canonical tail
modelVisibleMessages() that, plus what the host derives for this request
A fold plans on the history. The request carries both. So the note can never
become digest input, kept history, a body suffix, coverage, or sidecar
material, and admission still prices it — a note that cannot be folded is not
free, and counting only the foldable part would make every fold look cheaper
than the request it produces.
The gate now holds, and not vacuously: with the ids folded out of history the
request carries exactly one note, after the live tail, naming the ids the host
holds now — and the same on the far side of a process boundary, derived rather
than restored.
Two things this surfaced. The loop fixture ended a round on "the last message is
a tool result", which a tail note makes false; it now looks past host state,
because that note says nothing about whose turn it is. And the gate itself
demanded a note unconditionally, which would have passed a migration that
appended one to every request — it now reports whether the history still showed
the ids, and expects no note when it did.
todoIdentityProjection calls itself a turn-tail note owed when the host holds
step ids the conversation no longer shows. While the frozen body also held the
recent tail, "tail" and "end of the body" were the same place and the claim was
untestable. They are different places now, so the arm tests it — along with the
two things the note also claims by existing at all: that there is one of it,
and that it names the identity the host holds now.
Identity is moved while a fold sits between the model and it: write a list,
fold, grow, rewrite the list, fold again. One run then separates placement from
duplication from staleness, which three simpler scenarios would not. The
rewrite keeps the in_progress item and replaces the pending work, because the
host refuses to drop an item in flight — the first attempt replaced the whole
list and was rejected, which is a rule about task state, not a probe detail.
All three claims fail, and the process boundary does not change the answer:
notes in the view 2 exactly one reaches the model VIOLATED
where the note sits [6 11] rides the live tail VIOLATED
body ends at 12, view is 22
identity carried 01,02,03 names the host's current ids VIOLATED
01,21,22
host: 01,21,22
The first note is stale: 02 and 03 are ids the host no longer holds. It was
frozen into a body by one fold and carried forward by the next, which is what
the body suffix is for — historical material with no canonical counterpart. A
step identity is not that. It is state the host holds now, and freezing a copy
of it makes the copy outlive the state.
No implementation moved. The gate says which of the three answers we were
guessing at is true: the note is duplicated and stale, not merely misplaced, so
the fix is not a later append position.
Also completes the arm summaries, which listed seven of the eleven verdicts —
contiguous, HOLE, holds and VIOLATED were all missing, so an arm with three
violated contracts summarised as clean.
A fold froze the whole view — stable head, digest, kept history, and a copy of
the recent tail — then declared coverage to be the entire transcript. Nothing
was ever spliced, so the projection and the canonical transcript were never two
things: one owned everything the model could see, and the boundary between them
was a number that could only ever equal a length.
Now the body keeps what only it can hold and the transcript keeps the rest. The
fold's boundary goes through mapFoldBoundary, the body is head + digest + kept,
and the view is that body plus canonical[Covered:]. A boundary landing inside
an older body carries that body's remainder forward, because those messages
have no canonical counterpart to splice them back from — the half the second
fold could lose, and the reason the two halves land together.
Everything that reads the fold's output reads the spliced view, not the body:
token accounting, the acceptance test that decides whether a candidate is worth
installing, and the output fingerprint. Measuring the body alone would have
made every fold look dramatically cheaper while the request it produces stayed
the same size, and the acceptance gate would have believed it.
The compress tool keeps claiming the whole transcript, and says why: it masks a
range instead of cutting a prefix, so its body holds messages from both sides
of the digest and a shorter claim would splice copies of them back in.
Measured, folds now leave a live tail where there was none:
fold 1 body 15 -> 7 covered 19 -> 11 spliced +6 -> +14
fold 2 body 17 -> 11 covered 25 -> 19 spliced +0 -> +6
with the marker oracle still reporting one contiguous run of assistant work
reaching the newest turn, and both negative controls still dropping.
Two things the split moved that were only visible because something checked:
covered-rewind stopped being a control. It aimed at a middle checkpoint, which
was below coverage while coverage meant the whole transcript and above it
afterwards, so the arm quietly began testing the case its sibling already
covers. It now reads the boundary out of the sidecar, and both rewind arms
report which side of the fold they landed on and invalidate themselves when
that is not the side they claim.
A fold can now reach the tail the previous fold kept, because that tail lives
in the transcript rather than inside the body. So growth that never closes is
no longer "nothing new to reach": the newly reachable region is real history
and the verdict is what folding it would cost. NoopNoNewClosedPrefix now marks
the narrower case where the live tail holds nothing closed at all, and no test
reaches it any more.
Two places answered "where does this projection's coverage end". The planner
knew, and the writer worked it out again from len(commit.canonical). They
agreed only because a fold currently freezes the whole view into the body, so
coverage and transcript length happen to coincide. The moment a fold claims
less than the whole transcript, a planner saying 19 and a writer saying 25 are
both authoritative and the sidecar records the wrong one.
So the commit carries the boundary and the writer has no answer of its own.
CoveredCount is what the fold decided, CoveredPrefixHash covers exactly
canonical[:covered], and neither is derived from a length any more. A commit
that names no boundary, or one outside its transcript, is refused rather than
recorded: with the fallback gone, a zero would otherwise persist as a
projection nothing can validate.
The value is unchanged. Both planners still claim the whole transcript, and
say why on the line that does it — nothing is spliced in behind the body while
it still freezes the recent tail. Moving who decides and changing what they
decide are separate commits: this one is a no-op by construction, and the nine
arms of benchmarks/runtime-resume report cell for cell what they reported
before it.
The test that matters is the half-migrated shape: a count that has moved to the
fold boundary beside a hash that still covers the whole transcript would leave
every projection valid against a prefix it does not describe.
A second fold reads the working view — frozen projection body, then
canonical[priorCovered:] — and has to record where it landed in canonical
terms. The two systems agree only past the body: the digest at its head stands
for a range of canonical messages that no single view index names, so a
boundary inside the body cannot be converted by subtraction at all.
Today nothing has to convert anything, because a fold declares coverage to be
the whole transcript and freezes the entire view into the body. Taking the live
tail back out is what creates the second coordinate system, and this is the
translation it will need, landed on its own so the arithmetic is settled before
any producer depends on it. Nothing calls it yet; behavior is unchanged.
Values in, values out. It reads no Agent, Session or projection: what is under
test is a coordinate mapping, and a helper that reaches for runtime state to
answer is one that hides the mapping instead of stating it.
The two answers it gives are coverage and the body remainder that must survive.
A boundary inside the body keeps coverage where the previous fold left it and
returns body[start:] to stay frozen — history a digest already folded is not
uncovered by a later fold, and the part of the body the new digest did not
consume has nowhere else to live. Past the body the systems track offset for
offset. The empty suffix needs no flag: it is the range starting at the body's
end, so no pair of fields can disagree about whether one exists.
The table is the contract, and it is judged on the translation alone — coverage
and suffix range. Token counts, projection reuse and marker continuity answer
later questions, and any of them could let this pass for a reason that is not
the mapping.
A rewind threw the compaction projection away without looking at it. The same
truncation reaching the transcript by any other route kept it: the covered
prefix is untouched, the covered hash still matches, and the projection goes on
serving. Only the path a person actually drives lost it, because
ApplyConversationTruncate decided for itself that a shorter history meant a
changed lineage.
That decision was not the caller's to make. Coverage became a stated contract
one commit ago — CoveredCount plus CoveredPrefixHash, held by the projection
subsystem — and a caller that answers the same question separately is how a
tree ends up with two contracts that drift. So the rewind asks instead:
RevalidateProjection drops the projection exactly when it no longer covers the
current canonical transcript, and control never sees a count, a hash, or a
lineage key.
The truncation that lands exactly on the fold boundary is the case worth
naming. It leaves no live tail at all, and the instinct is that a projection
with nothing after it is the least trustworthy kind. It is the opposite: the
hash then proves the whole provider-visible transcript is the history the
digest folded. The same instinct, encoded as a version check, is what lost
projections across restarts until last week.
Rewind-restore is the same call for the same reason: it replays a longer
history that the folded prefix still sits at the head of.
Measured through benchmarks/runtime-resume, one cell moves and both controls
hold:
tail-rewind dropped -> kept
tail-edit kept -> kept
tail-truncate kept -> kept
covered-rewind dropped -> dropped
covered-mutation dropped -> dropped
revalidate_projection_test.go states the four-row table the caller now gets:
truncation inside the tail and truncation onto the boundary keep it, truncation
below the boundary and a rewritten covered row drop it.
The next cut treats every tail arm as one expected red with one known cause.
Measured, they are two causes, and only one of them is about coverage.
A tail change that reaches the transcript — a row past the fold edited, or the
whole tail dropped — leaves the covered prefix untouched, so the covered hash
still matches and the projection keeps serving. Both arms are green. The same
truncation driven through Controller.Rewind is not: ApplyConversationTruncate
calls InvalidateProjection unconditionally, and the projection is gone before
any coverage question is asked. That red is a caller discarding evidence it
never examined, not a validity rule getting the answer wrong, and it does not
depend on the live-tail split to fix.
covered-rewind is the control that has to exist before that invalidation can
become conditional: a rewind landing below the fold removes history the digest
folded, and no coverage check may excuse it. It targets a middle checkpoint
rather than the first — rewinding to the first empties the conversation, and a
session holding only a system row is never persisted, so the restart read back
the transcript the arm had just removed. That is a different rule answering,
which is exactly the confusion the arm exists to avoid.
The projection-in-use row now turns on whether the next request would ride the
projection, not on the token counts printed beside it. A tail edit legitimately
moves those, and letting them decide reported a surviving projection as a loss
— the same class of mistake as the one-sided marker, caught the same way.
exact in use append-after-fold in use
refold-into-body in use system-swap in use
tail-edit in use tail-truncate in use
tail-rewind DROPPED covered-rewind DROPPED (control)
covered-mutation DROPPED (control)
The tail arms of the next cut all have the same known explanation already —
CoveredCount claims the live tail as frozen coverage — so writing them first
buys answers we have. This arm asks the one question whose answer was unknown,
because it decides how much the next cut has to do: a second fold reads the
provider-visible view, stored body plus live tail, and has to record its new
boundary in canonical terms. The body has no canonical counterpart to map onto.
It does not need one today, and that is the finding:
fold 1: body=15 covered=19 spliced=+6 view=21
fold 2: body=17 covered=25 spliced=+0 view=17
The second fold sets CoveredCount back to len(canonical) and freezes the whole
view into the body, so nothing is spliced and no boundary is ever translated.
The splice only ever covers growth after a fold, never the fold itself, which
is what summaryProjectionState writes by construction. So studio is not losing
anything here — it avoids the problem rather than solving it, and taking the
live tail out of the body is what creates the requirement. This arm is the
guard for that: afterwards spliced must exceed zero while the assistant work
still reaches the newest turn.
The oracle nearly passed for the wrong reason. Tagging a turn once let the
surviving user turn hide the reply folded away beside it, and the first run
reported every turn intact for a fold that had removed four replies. Turns are
now tagged on both sides, the judgement runs on the assistant side where a fold
actually cuts, and the shape it accepts is narrow: an optional pinned head,
then one run of replies reaching the newest turn. The scripted digest carries
no tag, so a summary cannot stand in for a message that should have survived.
refold_test.go holds the oracle to that. A test that cannot fail proves
nothing, so the shapes only a loss produces — a gap inside the kept tail, two
gaps, a tail stopping short of the newest turn, an empty view — are asserted to
be caught.
The README also records what studio shares with main-v2 f60ab17b0 (#8923) and
why that line is ported by contract rather than by file.
A projection that covered the whole transcript did not survive the process that
built it. The sidecar was intact, the covered-prefix hash matched, the lineage
key matched — and projectionCoversTail still refused it, because with n ==
total the only branch that could say yes was a transcript-version equality, and
transcript version is an in-process counter a reload restarts. The append-only
fallback n < total was the sole route across a restart, so a session that was
compacted and then closed lost its projection and reverted to the full
canonical transcript, while a session that happened to take one more turn after
the fold kept it.
That is backwards. The hash is the stronger evidence, not the weaker: it
fingerprints provider-visible canonical[:CoveredCount], so a match says the
history the digest folded is still exactly there. n < total merely adds that
some of the transcript is a live tail the projection splices in anyway. Under
the old rule, having unfolded messages made a projection trustworthy across a
restart and having none made it suspect.
So the version leaves the judgement rather than gaining a restart special case.
projectionValid, projectionContentValid and projectionCoversTail no longer take
transcriptVersion at all — left in the signature it is an invitation to reach
for it again as a cheap pre-check, which is how it got here. The schema fields
stay for compatibility, diagnostics and compaction transaction metadata, and
now say in the type what they are not: durable identity for a projection's
content.
The guard that remains is the one that was doing the work. A rewrite inside the
covered region changes the hash and the projection is rebuilt; a covered count
past the end of the transcript is refused; a legacy sidecar with no hash is
refused. What is gone is a second witness that could only ever agree with the
first, and could not be produced at all by a new process.
Measured through benchmarks/runtime-resume, whose four arms move exactly as the
contract predicts — the safety control included:
exact projection lost -> reused
append-after-fold reused -> reused
system-swap reused -> reused
covered-mutation rebuilt -> rebuilt
projection_authority_test.go states the rule as a table run under four stored
transcript versions, so a verdict that starts depending on one again fails
rather than waits for another restart to reveal it.
Nothing in the tree could say which runtime semantics survive the process that
built them. Every claim about resume was an argument from where a value is
written, and a test that nils an Agent proves less than it looks: package-level
singletons, live sinks, registries and caches all stay standing, and any of
them can revive state a real restart would have lost. So the boundary here is
the OS process. Each phase is a child that exits before the next one starts.
Phase B never calls a model. That is the point, not an optimisation: a model
handed the transcript can reconstruct a step id or a goal the host has in fact
forgotten, and the row would go green while the host could prove nothing. Boot,
load, inspect, stop — so a PASS means the host knew it before a provider call.
The verdicts are not booleans. "A named artifact holds this verbatim" and "a
fold over canonical artifacts happens to agree" are different durability
claims, and a row the construct phase never established supports neither; it
reports not-measured, which is what kept a rejected todo_write from reading as
a lost identity on the first run. Open decisions and the run graph are
not-measured for the same reason and say so, rather than being filled in with a
test seam that would answer a question nobody asked.
The result the arms were built to isolate:
exact fold, then die projection NOT in use
append-after-fold fold, one more turn, then die projection in use
system-swap pinned memory moves the prefix projection in use
covered-mutation SaveRewrite edits a covered row projection NOT in use
Same sidecar, same covered-prefix hash, same stored transcript version 18. The
only difference between the first two arms is 19 messages against 21 — n ==
total against n < total. A session compacted and then closed without another
turn loses its projection at the next process; one that got a single further
turn keeps it. The third arm falsifies the reading this started from: the
composed prefix grew 3376 to 3707 bytes and the projection survived, because a
resumed session carries its persisted system row and the covered hash never
moved.
The fourth arm is the safety control and must stay red. It is the only thing
standing between "restore the projection across a restart" and "restore it over
a transcript that was actually rewritten".
Levers are production-reachable — a saved memory fact, a SaveRewrite — never a
poked field, and each arm demands a clean root: a reused one puts the lever's
effect into the construct phase, where it reads as a lever that did nothing.
macOS self-update has never worked on the Electron shell. applyMac re-executes
os.Executable() with --reasonix-mac-update-handoff and waits on a pipe for the
child to report ready; this host's main declares its own flags and parses them,
so the child met an undefined flag, exited 2, and the parent read EOF:
macOS update helper did not become ready: EOF
MaybeRunMacHandoff's doc has always said every host's main calls it before
startup. The Wails shell does, at main.go:133. The Electron one imports the
package and never calls it — 2.11.0 was the first Electron release, so 2.11.0 →
2.12.0 is the first Electron-to-Electron macOS update, and the first to run it.
The failure is safe: the transaction is cancelled and staging cleaned, so the
installed app is untouched and the message says so. It is also not fixable by
updating. The process that starts the helper is the one already installed, so a
mac on 2.11.0 will keep failing no matter what later releases contain; the fix
arrives only in a build installed by hand, and works for every update after it.
The contract now has a test instead of a sentence. hostMains is declared rather
than discovered — nothing about a main's shape says it is a host's, and this
one was missed by a reader with the comment in front of them.
Two spellings of the same version. `git describe` on this line answers
studio-v2.12.0, and that string went into main.version for every local build
while the release injected v2.12.0 — the tag with its line prefix stripped. The
prefix belongs to the release line, not to the version, and leaving it on broke
both readers of that field: the pattern that decides whether a version names a
published release rejects it, and ParseVersion splits on the first dash and
comes back with nothing. So a locally built CLI could not install from a
release it does in fact have, and installed on a remote it read as versionless
— which the floor waves through, since a version nothing stated is not a
version below it. The Makefile strips what the release strips.
The stray asset is mine. Staging picked the CLI archives out with
`-name 'reasonix-*'`, and the Windows signing flow leaves a
reasonix-studio-host.exe in the same directory: it matched, and 2.12.0 shipped
a 34MB internal component next to the archives, where it reads as a CLI someone
might download and cannot run. Taken from staging/cli-archives now — the job
that produced them — because origin is what was meant and the name was only
ever standing in for it.
The downloaders are bounded. All three had no timeout of any kind, which was
invisible while the routes that use them refused before reaching the network.
On a machine that reaches TCP 443 and never completes TLS — measured on a real
one here, against both GitHub and the Cloudflare mirror — the first route auto
tries would have held every connect for as long as the OS allowed before the
route that works was tried. curl bounds connecting and stalling but not total
time, so a 40MB archive over a slow link is still a download and not a failure;
wget takes the same pair; Invoke-WebRequest has no connect timeout at all, so a
short HEAD runs ahead of it.
FetchCommand and LocateCommand emit shell that no Go test ever executed. The
line they exist for had never published an archive for them to fetch either, so
the whole path — download, digest check, extract, locate, read the version back
— had been reasoned about and never once run. That is the shape of a defect
that passes every review and fails on the first real machine: a quoting slip, a
`find` that matches nothing, a digest line whose checker spells it differently.
Both scripts now run under /bin/sh against an archive actually served over
HTTP, and the test asserts what the caller believes afterwards: the binary is
there, it is executable, the staging directory is gone, and the version the
probe reads back is the one the archive carried. That last assertion is the
claim "the remote runs the version this side asked for", which nothing checked
end to end.
The archive holds a shell script answering --version and `serve --help`, not a
real CLI. A 40MB binary would test the archive's size; the subject here is the
script that installs it, and the payload only has to answer what the probe
asks. The digest case is what proves the check is real rather than skipped: a
mismatched archive fails the script and leaves no binary behind.
PATH is cut to /usr/bin:/bin so a reasonix on the developer's own machine
cannot be probed instead of the one just installed — which would have made this
pass while testing nothing.
Skipped on Windows: that side is WindowsFetchCommand, and it needs the same
treatment against PowerShell before it can claim to have been run.
Every remote kernel's log opened with a failure. The startup balance
diagnostic ran unconditionally, and a bootstrapped serve holds no provider
credentials of its own — they arrive over the broker tunnel — so the lookup
answered 401 every time and wrote it down:
balance: error — wallet credential rejected: status 401
The waste is one round trip. The cost is the line: that log is opened during a
fault and nothing else, and the first thing the reader meets there is a
standing error with no relation to what they came for. A diagnostic that always
fails is not a diagnostic.
The judgement is the broker, not who started the process. --port-file was the
first thing I reached for, since the token share line already reads it, but the
two are different facts: --port-file says a program is waiting for the bound
address, and that program may well have credentials. TestServeStartsWithMissing
ProviderKey caught it — it launches through a port file with no broker, and
asserts the diagnostic runs, because a balance lookup left hanging must not
hold up the serve. Judged on the resolver, both keep their meaning: the test's
serve reads its own config and still reports, a brokered one does not try.
Verified all three ways: brokered writes no balance line and still binds, a
plain serve reports ¥19.68, and the hanging-lookup test passes untouched.
The new frontend was reachable one way: through reasonix-studio-host, behind a
loopback gate that binds 127.0.0.1 and cannot be widened. Anything else that
opened a kernel — reasonix serve, a bootstrapped remote, a phone on the same
network — got the page embedded in serve, which is the old one. Asked to look
at a workspace from a phone, the answer was "that is the 1.x UI", and it was:
the same kernel, a different page, with no way to ask for the other.
The mount is now the hub's, so both hosts inherit it. HubOptions.Page is served
under /_studio/ and everything else is the kernel's — the inverse, a list of
the kernel's routes with the rest falling through to the page, is what has to
be edited every time the kernel grows a route.
It sits inside the auth gate, which is the one thing that had to change in
moving it. The window wraps the page around Handler(), outside hub auth, and
that is sound there: a loopback gate answers first and hub auth is cleared for
it anyway. A serve bound to 0.0.0.0 has no such gate, so a page mounted the
same way is one handed to whoever reaches the port. Handler() now wraps it
between auth and CSRF: through the credential, past the guard that only ever
concerned writes. A test asserts the page refuses an uncredentialed GET,
because that property is invisible in the code that reads correctly either way.
reasonix serve warns and carries on when --page names a directory holding no
page, where the window fails. The window has nothing else to draw; the kernel
has its own page, so a mistyped path should cost the better page and not the
serve.
No baseline was widened for it. runServeWithOptions was one line under its
budget, so the flag it needed came out of the two lines that spelled
`sessionIDValue := ""; sessionID := &sessionIDValue` — a named zero that
existed only to be addressed.
The download route pulls the archive here and pushes it over SFTP, which is the
route for a machine that cannot reach the release itself — an internal network,
the case where you are not installing on one machine but on several. Each of
them paid for the same 16MB.
DownloadCLI now takes a cache directory. A verified copy is kept under
<cache>/cli/<tag>/<goos>-<goarch>, so the second machine on a platform costs
nothing and the package size stays where it is, which is the trade the other
option — shipping the CLI inside Studio — gets backwards: it would add ~30MB to
every install to save one download, and only for same-platform remotes.
The copy is checked against a digest stored beside it. That is an integrity
check on this machine's own disk and it is written down as one: whatever can
write the binary can write the digest, so it catches a truncated write or a bad
sector and claims nothing about anything with access to the directory. A
mismatch is a miss — it downloads, which costs exactly what no cache costs.
Kept as one entry point rather than DownloadCLI beside CachedDownloadCLI. Two
of them left the first with no caller but the tests, which repolint reports as
an orphan, and it is right to: a second spelling of the same operation is a
choice at every call site about something the callers have no opinion on. The
cache is a parameter, and "" is no cache.
The unreleasable-version check runs before the directory is built from the
version, so a source build refuses without having named a path.
The probe asked one flag. `serve --help | grep port-file` decided a located
reasonix was drivable, and that answer stood for a set: the launch also passes
--token-file, --pid-file, and the broker pair that arrived a release line
later. A kernel carrying only the older half answered the probe yes, was
launched with --provider-broker, and exited on a flag it had never defined.
What reached the reader was `serve never reported a port` after a 20s wait —
a machine, a timeout, and an instruction to read a log that cleanupFailedLaunch
had already removed. Nothing pointed at the kernel being from another line,
which is the one thing that was wrong and the one thing this side could see.
LaunchFlags is now the single list both halves read, candidate carries the set
it was answered rather than a bool, and a test asserts the probe's flags equal
the launch's for both shapes of the command line. One flag standing for a set
is an assumption about release history; the list is not.
The same shape twice more. cleanupFailedLaunch and Stop each kept a copy of
what a serve record is made of, and the broker token was added to neither, so
every failed launch left this machine's provider credential on the remote —
removeServeState is now the one list. And `remote test` wired different Options
from `remote connect`, so it called the release route closed for want of a
resolver connect goes on to pass, and called the download route open when the
version would refuse it.
Under all of it the studio line published no CLI at all. releaseasset resolved
/download/v2.11.0/ while the tag is studio-v2.11.0, and the kernel called
itself "dev" because build-host.js injected no version, so both routes that
name a release refused before reaching the network and npm was what remained —
where the package belongs to the 1.x line, below the pane floor. The line now
ships the six archives and their SHA256SUMS, releaseasset.Line carries the tag
namespace, and the version reaches the binary. Line is its own type rather than
update.Line: that one is an install layout, and a single type answering both
questions is how a tag prefix ends up deciding where a .deb installs.
Injecting a semver also makes the floor real for the first time. ParseVersion
could not read "studio-v2.11.0" — it splits on the first dash — so the version
came back empty and meetsMinVersion waved it through as unknown. Every kernel
on this line has been passing the 2.0.0 gate without being read.
Attribution follows: ErrNoReleaseForBuild says a build has nothing published to
install from, ahead of the per-route codes, because a reader told to install
curl would install it and still have no route. The npm route now reports a
version below the floor as exactly that instead of as a PATH that needs fixing.
It keeps its place in the auto order — dropping it would hard-code which line
npm publishes, and that is a fact that can change.
A relay forwards somebody else's model under its own name, so no probe and no
catalogue can say what that model holds. Until someone says, the gauge has no
denominator and automatic compaction is off — and the panel that shows this
could only point at the Connection screen.
It is worse than a missing number. This config has
name = "yyds"
models = [11 models, claude-* and gpt-5.6-*]
context_window = 200000
one figure typed once for eleven models with different ceilings. So the field
is offered against a declared window too, not only a zero one: the denominator
in "24.8k / 200k" is a button, opening the same field prefilled. A dashed
underline marks it — an entry that only appears on hover reads as absent.
POST /context/window writes the window against the model in use, as
model_overrides.<model>.context_window, and leaves the endpoint-wide figure and
the other ten models alone. Zero is the stored "inherit", so clearing it falls
back to the endpoint rather than to no window. It rebuilds in place, because
boot binds the window into the agent and a live session keeps what it was
assembled with — the rule saveShell and savePermissions already follow.
It goes through serve rather than the controller, where editProvider and
setProviderThinking already live: source config is a settings surface only this
frontend drives, and putting it on the controller would book three
frontend-parity edges against cli, acp and bot for capabilities they do not
have a screen for.
Mid-turn the write lands and only the rebuild is refused. That is not a failed
save and it is not a model switch, so it is neither rebuild_failed (which reads
as a malfunction) nor busy.switch_model (which tells the reader to stop and
switch models). It is context.window_after_this_turn: saved, counting from the
next turn. codedRefusal reads the identity off the error to tell them apart —
the code, never the sentence.
In a 296px metrics rail the caption under the hit rate rendered one character
per line, a vertical column beside the number. Removing its second line — the
"越高越省" hint — was the obvious fix and would not have worked.
.big lays out four things on one line: the 28px rate, the caption, and two
pills. .pill is flex: none and the rate has no break opportunity, so the caption
was the only shrinkable item in the row and absorbed the whole overflow. Two
pills fit only when one of them was absent, which is why this appeared when
正文变了/正文未变 joined 前缀变了/前缀未变 — the caption had been the slack all
along, and the second pill spent it.
The caption is now rigid (flex: none, nowrap) and the two pills wrap as one
group, so a narrow rail moves both below the number and a wide one brings them
back up. The hint line is gone as asked — the block heading already says 前缀缓存
and the numbers below it say 命中/未命中 — and its catalogue key goes with it.
.big has one user, so none of this reaches another panel.
An English window rendered them in Chinese. i18n.test.ts had been failing on
them for a while — it names the file and the key, so nothing was hidden, only
unpaid.
Seven are ordinary omissions: the body half of the prefix-cache pills (前缀变了
already had "prefix changed" while 正文变了 had nothing), its carried-message
tooltip, and four in the rail's MCP block that arrived with pending servers.
Each takes the wording of the sibling beside it, so a pair reads as one
judgement about two objects: prefix held / body held, Fix / Approve.
The eighth is not an omission. en_graph.ts still holds the sentence Graph.tsx
used to show — "这一轮没有派出并行的子代理。fleet 或 parallel_tasks 一开跑…" —
and the panel was reworded to cover any dispatch, not only a parallel one. So
the key was replaced rather than added, and the English rebuilt on the new
condition: the waiting/parallel/reused clause now speaks only for a group.
That is the gap this test cannot see. It checks that every key the interface
asks for has wording; nothing checks the other direction, so a translation
whose source text was rewritten sits in the catalogue looking present.
An on-demand connect failed with `MCP startup launch failed after 5ms: context
canceled` — no approval asked, no process started, five milliseconds in. The
launcher was fine the whole time: `doctor capabilities --live` reaches the same
server and reports runtime=probed tools=68.
ensureServerToolsForSpec deliberately launches under the runtime's lifeCtx
rather than the tool call's, so a slow healthy server keeps starting after the
call that asked for it returns. That context comes from boot.Build's ctx, and
serve hands it an *http.Request one: switchWorkspaceLocked takes r.Context(),
switchModel takes r.Context(), and every pane the hub opens takes r.Context().
Each is done the moment its response is written, so from then on every on-demand
connect in that session launched under a context that was already cancelled.
The initial process boot passes signal.NotifyContext, which is why MCP worked
until a workspace was switched and then never again.
boot detaches cancellation at the one place that knows what the context is for,
rather than plumbing a lifetime through three callers that would each have to
remember. Host.Close still cancels every child it started, so teardown is
unchanged — the cancellation removed here was never what performed it.
Seen live: a map_editor session, on a workspace the desktop had switched to.
use_capability's own description tells the model to list, then inspect one
before calling. list shipped every entry's full text: 16 KB of description in a
24 KB listing, and once MCP servers joined it the reply reached 41 KB and
spilled past the 32 KiB cap. A model that asked what it had was handed a pointer
to a file — which is what a session in map_editor did, before going to read
Unity package sources to answer a question about its own configuration.
A row now carries the first sentence, bounded at 160 bytes. Measured on that
session's own recorded listing: 46 entries, 16,335 description bytes to 4,318,
and the whole reply back under the cap. inspect still answers with everything,
which is where the model was already told to look.
The bound cuts on a word, and on a character boundary when there is no word to
cut on — a CJK description is one rune per three bytes, and the first draft of
this left a lead byte with its continuation bytes gone. It reuses the trim
written for the shell-output decoder rather than deriving the rule twice.
Also: a search that succeeded and matched nothing reached the model as an empty
result, which reads exactly like a call that broke. silentExitNote already
existed for that on the failing side — a non-zero exit that printed nothing —
while the succeeding side, the more common one, had nothing. Same note, same
predicate: only for a call that printed nothing and could not have written.
The dependency barrier stops the rest of a tool batch when a mutating call
fails. ToolCallMutates counts MutationUnknown as mutating, and the read-only
classifier is Unix-shaped, so on Windows an ordinary probe the host cannot
read — netsh, ipconfig, curl.exe — was a mutation. Refuse one, or let it time
out, and every later change and the verification were dropped with "an earlier
modification in this tool batch failed or was blocked". No modification had
failed, and the model was told to fix a change it never made.
Across 1684 recorded tool results, 57 of these skips. 22 came from the criteria
capture that could not read D:\System Volume Information — already fixed — and
32 in total came from calls that never executed at all.
The barrier now says how far it reaches. A failed modification still stops
everything: it may have left the workspace half-applied, so what follows may be
built on a change that never landed. A call the host stopped before it ran
changed nothing, so later edits work from a known state — but the check does
not, because it was asked for against a plan one step of which never happened,
and passing it would mean nothing. That case stops verification alone, and says
so in its own words rather than borrowing the modification message.
A writer the host can name keeps the full barrier whether or not it ran. So does
a target it could not classify at all, which is where this fails closed.
Two things this did not do: toolOutcome.executed is never assigned, so the
`if outcomes[i].executed` branch that would set surfaceWriters is dead — the
barrier reads ShellExecution.MutationRisk instead, which is populated. And the
underlying cause is still the classifier's Unix shape; this bounds the damage
rather than removing it.
Extracting the pre-mark into barrierSkip took executeBatch's complexity and size
down far enough to pay for the new level and leave budget behind.
The trust gate landed with three paths that started a repository-declared server
without answering for it — /mcp connect, ReconnectMCPServer, and the manager's
enable action. They are user actions, so nothing started silently, but they
acted as approval without being it: the server connected once and IsEnabled
still said no, so the next session had it off again and the button read as
having not worked.
An explicit connect now records the decision it represents. The approval is
project-scoped like every other one, and a failure to write it is logged rather
than failing a connection the user asked for.
The manager showed pending as "deferred", which means the opposite thing —
deferred connects when needed, pending will not connect at all. It has its own
line now, and its action says "Approve and connect" rather than "Connect",
because naming the effect and hiding the choice is what this state exists to
stop.
TestConnectConfiguredProjectMCPIsTrustedByDefault asserted the belief this
series removed. It is now TestConnectingAProjectMCPRecordsTheDecisionItRepresents
and checks the server waits beforehand, stops waiting after, and that the answer
survives into a second controller.
Still open: the negative answer. "Disable for this session" is offered on a
pending row, but a durable refusal — the thing that stops it asking again — has
no action of its own.
A .mcp.json is checked in, so whoever wrote the repo chose the command and its
arguments. Reasonix started it at the next session in that folder with nothing
asked, and MCPConfigSource.UserAuthorized() reported it as already authorized.
A project reasonix.toml's [[plugins]] is the same file with a different name and
had the same treatment; gating only one of them would be a claim that outruns
its enforcement, since a PR could simply use the other.
The activation store already held per-project enable rows — the missing piece
was the default. IsEnabled now resolves a recorded decision first and, without
one, keeps a repository-declared server off. Everything else is a file only the
user writes and still follows auto_start, including the two ~/.claude.json
scopes.
Undecided is kept apart from disabled throughout. One is waiting for the user
and the other is their answer, and a surface that shows both as off reads as
the project's MCP having quietly gone missing: MCPServerState carries Pending,
the project listing reports "pending" rather than "disabled", and the rail
panel — whose whole purpose is servers that need a decision — lists them beside
the broken ones with "去批准".
A security review of the first draft found four ways it failed open, all fixed
here:
- Every caller answered a store read error with ShouldAutoStart(), which is the
pre-change default and re-enables exactly what the gate is for. A corrupt
activation file was enough. DeclaredDefaultOn is that fallback now, and
AwaitingDecision reports pending rather than settled when it cannot read.
- Source carries toml:"-" and is assigned only by a successful merge, so a
failed one leaves a project file's own entries with none. Unknown provenance
now counts as repository-declared.
- Decide read a global row for an identity ServerOverrideFor pins to the
project, so one row could have approved a repo server in every project.
The global layer is skipped for those.
- `doctor --live` started every auto_start server, which is what a user runs to
find out why their MCP is off — answering the question by running the command.
Left open, and reported rather than fixed: /mcp connect, ReconnectMCPServer and
the manager's enable action start a pending server without recording a decision,
so they act as approval without being it, and the TUI's own status view still
derives from cfg.Plugins and shows pending as "deferred".
mcpjson.go says Reasonix reads .mcp.json "so an MCP server already configured
for Claude works here unchanged". Claude Code writes to three places and that
is the one `claude mcp add` does not use: its default is the per-project map
inside the user's own ~/.claude.json. The reporting machine had three servers
configured, none in a .mcp.json, and Reasonix loaded zero of them for every
workspace on it.
Both ~/.claude.json scopes are now read: the entry for this workspace first,
then the user-wide map, matching Claude Code's own local-over-user order. They
merge last, so a name Reasonix's own configuration claims keeps it — that one is
written for Reasonix, this is a compatibility read.
They auto-start like anything else, and they should: the file is one only the
user writes. A repo's .mcp.json is the one that arrives with a clone, and
Reasonix already starts that without asking — which is the trust asymmetry
inverted, and a separate thing to fix.
CLAUDE_CONFIG_DIR moves the file and is honoured. Project keys are compared as
paths: Claude writes them with forward slashes on Windows, where the same
directory is also spelled with backslashes. An unreadable or malformed file
yields nothing rather than failing the load — it belongs to another tool.
Verified against the reporting machine: D:\tygit\map_editor now resolves
unity-editor-mcp from claude_local, and a name held by both scopes there
resolves to the project's own entry.
A child's bytes became a Go string unchanged. On a Chinese Windows the console
tools answer in cp936, so the string held invalid UTF-8, and JSON coerced every
bad byte to U+FFFD on the way to the transcript — destroying the text before
anything could read it. "FIND: 参数格式不正确" reached the model as a row of
question marks, and a run that failed four times never learned why.
decodeShellOutput reinterprets only bytes that are not UTF-8. The guard matters
more than the decode: the tail buffer keeps the last N bytes and therefore
starts mid-character, so valid UTF-8 output arrives invalid — deciding on those
bytes would invent mojibake where truncation was the only problem. Both edges
are trimmed of a cut character before the question is asked.
Distinct from the grep peek fix: that one misread a file's bytes, this one never
decoded a process's at all.
A call's duration covers the host's preflight — capture, effect scans,
permission — and ShellExecution.DurationMs covers only the command. Both rode
the wire already and nothing subtracted them, so the overhead had no reading
anywhere: not in the run metrics, not in a panel, not in a log line.
Subtracting them over 406 recorded bash calls: one session sat at a 13.0s median
per call with p90 42.5s and a 172s worst case, while the shell answered in
milliseconds — about twenty minutes of one session spent inside the host. On an
ordinary repo the same figure is 0.00s, so this is not a constant to be tuned
away but a cliff that only some workspaces fall off.
A tool that reports no inner duration adds nothing rather than claiming its
whole runtime was overhead.
Which criteria exist is a fact about the workspace, not about the call that
might overwrite them. The evaluation half of this subsystem already reads it
that way — BaselineTestObligations reuses a verdict while its StateEpoch holds —
while the capture half re-derived the whole set per call.
captureCriteriaOnce keys the walk on mutationEpoch, which advances on every
recorded successful mutation. A call the host proved wrote nothing clears that
flag in settleUnchangedWorkspace, so it does not invalidate; one the host could
not prove keeps it, so it does. An unobserved external writer still slips
through, which is the gap the verification model already declares.
Measured over 125 recorded transcripts: 296 walks become 67. The first attempt
at this measured no gain at all — invalidating on "an unknown call ran" is
always dirty, because unknown calls are most of them. The epoch was the
difference, and it was already being computed.
This is also what makes the preceding walk-error fix a win rather than a trade.
Those D:\ calls were aborting the walk partway at the ACL error and still cost a
3.1s median against 0.39s on an ordinary repo; finishing the walk correctly
would have cost the full 6.5s. Now it costs that once per state.
filepath.Base answers the separator for a volume root, and six places named a
workspace with it: the sidebar, the session tab, the capability scope, the
@folder refs and the TUI's git line all showed a workspace opened at "D:\" as a
lone backslash, which names nothing and cannot be told from any other drive.
fileutil.RootName falls back to the volume when Base has nothing to say. One
place already handled this — botProjectName has its own fallback — which is the
shape of a judgement copied into some callers and not the rest.
The external-folder search now matches the name the list shows rather than
filepath.Base's, so typing what is on screen finds it.
The anonymous struct that function spelled out twice becomes externalRootRef:
the import this needed put refs.go one line over, and a type it wrote down two
ways is the line to get back.
Seen live: the Studio sidebar, on a session opened at D:\.
.file .p shrinks and clips its directory, but .f was flex: none and .p had no
overflow, so a filename longer than the row kept its full width inside a box
that no longer had it — and painted straight through the diff counts at the
right edge. At the 214px rail, "capability_discovery_effect_test.go" and
"+128 -0" were drawn on top of each other.
.p clips now, and .f ellipsizes as the last resort. The directory keeps its
priority for being cut through the shrink weights rather than through .f
refusing to shrink at all, so what the old comment promised — the directory may
go, the filename may not — is still what happens: a row with room loses the
directory first and keeps the whole filename.
Verified against the real stylesheet at the real rail width, before and after.
The provider schema hides the dispatchers, so this description and an explicit
action=list are the model's whole discovery surface for them — and it named
only task:subagent. Over 21 sessions the batch dispatchers were reached 6 times
against 74 single delegations, and parallel_tasks not once. A capability
nothing names is one the model has no reason to look for, whatever its own
description says once found.
task:fleet joins the named ids with one line on what separates it from
task:subagent. Two tests hold the pair: the description must name a way to
delegate more than one thing, and every id it names must be in
CapabilityIDExamples, which is what the boot effect test checks actually
resolves.
This is a deliberate prefix change: tool schema tokens go 4545 to 4584 and
ToolsHash moves, so live sessions pay one cold prefix. The golden baselines are
re-recorded for it.
publishGraph had two callers, fleet and parallel_tasks, so every other
delegation — a task, a run_skill, a review capability — published no node at
all. A sub-agent ran eight steps in its own context and the graph tab answered
"这一轮没有派出并行的子代理", which reads as nothing having been delegated.
The graph was a fan-out visualiser; a person opening it is asking what this run
handed work to.
The hook goes on RunProfileSpec, where task.go already states the invariant
every entry point relies on: each one compiles to a spec and runs through it,
so a boundary added there cannot be missed by one caller. The two fan-outs mark
their items with withDeclaredGraphNode — only they can say it, having chosen
the node's id and kind, and without it the shared runner would redraw a fleet
worker as a group of one. A background run draws nothing: it settles after a
handoff this return never sees.
lanesOf needed no change — the group, the parentId and the spawn edge are the
shape it already reads.
Two extractions keep task.go and RunProfileSpec inside their budgets rather
than widening them: subSink/subSinkFor move to nested_sink.go, which is what
they are about, and the spec's prompt validation becomes settleSpecPrompts.
Both hand budget back.
PrefixShape hashes the system prompt and the tool schemas. The conversation is
not in it, so a full miss on a prefix the host itself hashed as unchanged had
no attribution at all: the diagnostic could not tell a dropped cache from a
message the host rewrote behind the boundary. session_types.ts already claimed
the hash "tells changed from the endpoint dropped it" — with the body
unobserved, it could not.
BodyChain hashes the provider-visible messages cumulatively, one entry per
message, so two requests compare at the length of the shorter and a rewrite
anywhere in the carried region moves every entry after it. It is taken from the
request that goes out, not from the conversation: a local-only message never
reaches the provider, and reporting a change to one as a cache change is the
mistake CompareShape's own comment already warns about.
A rewrite the session declared is already named through contentReasons. One it
did not declare gets "body_unreported" — the case this observation exists for,
because nothing else can see it.
Measured over 21 sessions before this: 118 full misses on an unchanged prefix,
10.6M prompt tokens re-paid, with cacheDiagnostics reporting prefixChanged
false on every one and nothing able to say who dropped them.
The desktop panel gets the second pill beside "前缀未变", so the answer reaches
the person who can act on it. event.go was at its 800-line ceiling and
session.ts at exactly 800, so CacheDiagnostics moves to its own file and the
metrics fold joins the usage helpers it belongs with — both lower a budget
rather than widen one.
grep detects a file's encoding from a fixed 8 KiB peek, and the comment said
utf8.Valid over that window was reliable. It is not: the window cuts a
multi-byte character in half, the cut byte alone fails the check, and GB18030 —
which accepts almost any byte string — wins. Over CJK text, where most bytes
are continuation bytes, a fixed window lands mid-character about two times in
three (measured: 2167 of 3000 offsets), so a Chinese UTF-8 source larger than
8 KiB came back as mojibake for its whole length.
TrimPartialRune drops a trailing sequence the window truncated, and only that:
a leading byte declaring more bytes than remain. A byte that is simply invalid
stays, so a file that should fail the check still fails it. read_file was never
affected — it reads whole files, so Detect always saw complete bytes.
Seen live: a grep over "Cocos-MCP进度.md" whose every matched line rendered as
UTF-8 read through GBK.
doublestar.SplitPattern hands back the bare volume for a pattern rooted at one:
"D:\**\*xray*" splits to root "D:", and on Windows "D:" names that drive's
current directory rather than its root. WalkDir therefore started somewhere the
caller never asked for, and every match came back drive-relative —
"D:DeepSeek-Reasonix\benchmarks\..." is not the path it looks like, and a model
handed it back through read_file addresses a different file or none.
globWalkRoot repairs that one root and now owns the split, so the test covers
the wiring rather than a helper the call site could stop using.
Seen live: a workspace at "D:\" where every glob result was drive-relative.
captureCriteriaUnder walks the writable domain before every call whose scope
the host cannot read — every mutating bash — and captureCriterionAt asked the
bytes a question the name already answers. It called os.ReadFile on each file
and then HoldsTestCriteria, whose first line is a "_test.go" suffix check. On a
workspace at a drive root that is the whole drive, read once per bash call.
The suffix check moves ahead of the read. Measured on the same tree (1020
files, 250 MiB of non-test content, page cache warm): 191ms to 3.3ms on the
first broad-scope call, 147ms to 1.6ms on every one after it, with the same 20
criteria held. The doc comment claiming only the first call pays was wrong
about the walk and now says so.
A subtree the walk cannot enter is skipped rather than refused. An unreadable
file was already skipped one function below, and the two disagreeing is what a
workspace at "D:\" ran into: "open D:\System Volume Information: Access is
denied" refused every write for the rest of the session, and the batch cascade
turned each refusal into four more. 14 blocks and 48 cascaded skips in twelve
observed sessions, over a directory nobody can open and nothing can write.
The walk also takes a context and checks it every 512 entries, the way
scanWorkspace already bounds its own: an uninterruptible walk across a drive is
what a user experiences as the stop button not working.
use_capability answered `unknown capability_id "parallel_tasks"` for a
capability the catalog was holding. Lookup matched an entry's id and its
declared aliases — "tool:parallel_tasks", "task:parallel" — but not the tool's
own name, which is what every other description, error message and skill body
calls it, and therefore what a model reaches for first.
The name now resolves when exactly one entry answers to it. Two tools sharing
a name refuse rather than route the call to whichever came first: guessing
sends work somewhere it was not asked for, which is worse than saying no.
Seen live: a run that tried use_capability with "parallel_tasks", was told it
does not exist, and went looking for another way to do what was available.
classifyResponseBoundary drops a trailing tool call the output limit cut in
half, and tells the model the host did it — but only when finish_reason says
"length". A provider that reports "tool_calls" alongside a half-written call
got that call executed, and the model answered for "invalid complete_subtask
JSON: unexpected end of JSON input" as if it had mistyped something.
Arguments that stop mid-value are the host's own evidence, and they do not
depend on a finish reason arriving correctly: a decoder running out of input
inside a token is not what a syntax error or a finished document looks like.
The classifier now reads that directly, so the cut is attributed and the round
is not spent on a call the model never finished writing.
A malformed call the model did finish is still its own to fix — the two need
opposite corrections, send less versus escape correctly, and the existing
normal-terminal test now uses a syntax error rather than a cut so it says which
of the two it is pinning.
Seen live: a three-way parallel_tasks run against this repo, where the first
complete_subtask of a sub-task came back truncated and cost a full round.
complete_subtask answers an unbacked report with needs_work and a count: "1
criterion claim(s) are not backed by anything the host observed". The host had
the list — AdjudicateCompletion returns a reason per criterion, naming it and
why — and threw away everything but its length.
A sub-agent that cannot tell which criterion failed, or what the host looked
for, resubmits with a different evidence shape and hopes. In a real three-way
parallel run against this repo, 6 of 11 complete_subtask calls were needs_work
loops; one sub-task cycled files-evidence -> rejected -> command-evidence ->
accepted with its unresolved count unchanged, which is the shape of guessing.
The verdict now lists the reasons, and the reasons say what the host looked
for rather than that it found nothing: "AC3: no read or write recorded for
internal/control/controller.go, ... (+5 more)", "c2: no successful run of
\"go test ./internal/agent/\"". Paths are capped at three and commands at 80
characters so one rejection cannot become the whole reply, and identical
reasons are said once — two review citations missing the same receipt read as
two problems otherwise.
No claim about the effect: a single run cannot measure a loop this noisy, and
the sample sizes here (11, 4, 9 calls over three runs of the same task) differ
by more than any change would. What is verified is the mechanism — the verdict
now carries what the host knew, checked by a test and seen in a live run.
parallel_tasks and fleet pre-nest the sink they also hand to the call context,
and RunProfileSpec nests again off that context, so every tool id from a child
was prefixed with its parent twice:
call_00_x/sub-3/call_00_x/sub-3/call_00_child
Measured on a real three-way parallel_tasks run against this repo: 317 of 332
tool dispatches — 95% — carried a doubled prefix. After, zero.
An id that does not start with its parent's is a child call that reads as
top-level, which is what a frontend's dispatch-to-result matching, the graph's
nesting, and every trajectory reader key on. It is why analysing that run
attributed all 41 complete_subtask dispatches to the root.
The fix is in the sink rather than the two callers because the invariant is the
type's: it namespaces into a parent, and doing that twice is never right. The
pre-nesting in those two callers is now a redundant layer rather than a bug,
and can go separately.
A failed modification stops later modifications and verifications in the same
batch. Delegation is neither — task, parallel_tasks, run_skill, use_capability
and the review tools spawn work rather than change state — which is why
batchCallIsMutatingFailure exempts them: a failed one does not open the barrier.
Its comment says so, and says why a bare !ReadOnly fallback would be wrong.
batchCallStaticallySkippable, which answers the other half of the same question
— who the barrier skips — used exactly that bare !ReadOnly. TaskTool.ReadOnly()
is false, so one failed edit_file dropped every delegation left in the batch as
a dependent modification, each reported as "skipped because an earlier
modification in this tool batch failed or was blocked".
Both halves now read the same exemption.
I went looking for a redesign of the turn lifecycle and did not find one to
justify. The run state is in better shape than the notes I had: turnGate already
groups the five admission flags into one type with the TOCTOU it closed written
down, and turn_orchestrator.go already owns running a turn. Turning the type's
stated invariant — running and rotating are mutually exclusive — into an
assertion and running the whole suite under it triggers nothing. There is no
bug here, so nothing is being rearranged to look tidier.
What the reading did find is smaller and real: c.cancel sat beside the gate
while having exactly the gate's lifetime. Three sites set `running = true`
and then `cancel` on the next line, verbatim; two cleared them together. Two
fields, one state, and the pairing enforced by everyone remembering it.
cancel moves into turnGate, with begin/end/requestCancel doing what those sites
each spelled out. The Controller loses a field. Behaviour is unchanged — the
methods contain the same assignments in the same order under the same lock, and
finishing stays the caller's to set because whether TurnDone is still fanning
out is a different question from whether the turn is over.
Verified where it counts: `go test -race -count=2 ./internal/control/`, full
suite, and sabotage-checked by making begin forget the cancel, which fails four
existing cancel tests.
applyPlanExec and applyGoalCommand have exactly one caller each, and it is the
command dispatch that moved out last commit. They were left behind because the
move went by name, not by call graph — which is the failure mode of splitting a
file by reading it top to bottom.
Verbatim move, 2 declarations; 161 methods present across both files, none
duplicated, no body changed. controller.go 3,386 -> 3,265.
This is where the splitting stops. What is left is 144 methods averaging 23
lines with no cluster larger than four related names — the facade itself, plus
RunShell and close. Cutting further would make files smaller without making
anything easier to find, which is the point past which this stops paying.
Cancelling is not one act. There is the request, the guarded window a turn runs
inside, and then the harder half: deciding what the conversation should look
like once a turn stopped mid-flight — which visible messages to strip, what
fallback stands in for the interrupted one, and when the session has to be
replaced outright. The 125-line strip is the largest method left in
controller.go and it was sitting nowhere near the Cancel that leads to it.
Verbatim move, 9 declarations: all 153 Controller methods present, none
duplicated, no body differs by a byte. controller.go 3,716 -> 3,386, and
5,837 -> 3,386 across the five splits — a 42% cut with no behaviour change.
Baseline carry-forward as before; finding count holds at 1,669.
I said last round that what was left had no nameable responsibility. That was
wrong, and reading it rather than assuming showed why: turn_orchestrator.go
owns running a turn, but how a turn comes to exist — every Submit variant the
frontends call, resolving its refs, deciding whether the text is a command or a
turn, preparing an invocation — was still spread through controller.go. Two
concerns with the same noun, which is what made them look like one.
Verbatim move, 17 declarations: all 170 Controller methods present, none
duplicated, no body differs by a byte. controller.go 4,092 -> 3,716, and
5,837 -> 3,716 across the four splits.
Baseline carry-forward as before; the finding count holds at 1,669 and repo
file-size falls 39,765 -> 39,388.
What waits on the user and which call answers it — tool approvals, plan
decisions, asks, the pending-prompt replay a reattaching frontend needs, and
the modes that decide whether any of it is reached — is one responsibility, and
it was the last cohesive cluster sharing controller.go with everything else.
approvalManager already owns the bookkeeping; this is the orchestration half,
the part that emits, records a receipt and rebuilds a gate.
Verbatim move, 24 declarations: all 194 Controller methods present, none
duplicated, no body differs by a byte. controller.go 4,649 -> 4,092, which is
5,837 -> 4,092 across the three splits.
The move is only half of it. internal/control/approval.go is a declared
sensitive path, so code leaving it for a file that is not one would drop out of
both effects that declaration has: the review gate, and the coverage floor.
REASONIX.md declares the new file too, which is why this could not be a tidy-up
— and the floor is real, recorded at 90.7% and sabotage-checked by raising it,
which fails the gate.
Two things surfaced while recording it, neither mine:
internal/providerbroker/** was declared sensitive without a floor ever being
recorded, so it has been passing the gate vacuously since it landed. It has one
now. Its coverage flickers between 83.1% and 83.6% across runs (5 and 2 of 7),
so the floor is the observed lower bound: a floor set at the higher number is a
gate that fails at random, which teaches people to rerun CI rather than read it.
internal/sandbox/** rises 73.5% -> 78.1%, which is a ratchet catching up with
coverage already written.
The live tool and plugin surface is already mcpManager's. What stayed on the
Controller is the config-facing half — adding a server to reasonix.toml,
connecting one on demand, importing a batch, naming what is configured versus
disconnected, removing one and unregistering its tools — and that half is a
responsibility, not leftovers. It is also one contiguous run of the file, which
is what a responsibility looks like when it has never been named.
Verbatim move, 14 declarations: all 208 Controller methods are present, none
duplicated, no body differs by a byte. controller.go 4,936 -> 4,649.
Baseline carry-forward again: repo file-size falls 40,609 -> 40,322, the finding
count is unchanged at 1,669, and controller.go hands the new file 12 of its
frontend-parity findings and 2 essays.
Not moved, deliberately: the approval orchestration, the other cohesive cluster
left. internal/control/approval.go is a declared sensitive path, so moving that
code into a file that is not one would quietly drop it out of the review and
coverage gates it is under. That move has to come with the declaration, and
that is a decision, not a tidy-up.
controller.go was 5,837 lines. The stateful subsystems with their own locks are
already extracted — memory, checkpoints, MCP, skills, goals, approval — so what
is left is not another collaborator: the session's run state IS c.mu, and
prising it out would buy a lock to reason about instead of a file. What it is
is two responsibilities sharing a file with everything else.
They move whole, to files named for what they own:
session_lifecycle.go — creating, clearing, branching, switching, resuming a
session, and where its path comes from.
session_snapshot.go — persisting one, and recovering when the persist finds
the file moved under it.
Nothing else changes. Every one of the 240 Controller methods is present after
the split, none is duplicated, and no method body differs by a byte — checked
by extracting each declaration from before and after and comparing, not by
reading the diff, because a diff that is only deletions on one side is exactly
what a botched move also looks like.
The baseline widens for the two new files and shrinks for controller.go by the
same debt, which is what -allow-widen is for. It is a carry-forward, not new
debt: the finding count is unchanged at 1,669 and every repo total falls
(file-size 41,525 -> 40,609, essay 3,243 -> 3,242, frontend-parity moves 8 of
controller.go's 87 across).
The immediate reason is that this file's ceiling has twice now been the thing
standing between a one-line change and landing it: adding a call meant first
finding another function to move out.
The prefix a provider caches is the system message and the tool schemas, and
the schemas are the larger half — 24KB against 2.8KB in the golden fixture.
The boundary test asserted only the message, so a per-project tool surface
would have diverged the prefix one message later with nothing failing.
Nothing diverges it today: no builtin composes its workspace into a name,
description or schema, and the one that listed per-project text — slash_command
naming the configured commands — stopped when the skills catalog moved to the
turn. This pins that. Sabotage-checked by prefixing read_file's description
with its workDir, which fails it.
`reasonix doctor` reads a session's usage out of a .telemetry.json beside it.
Nothing has written that file since the desktop that used to was retired, so
every report on every real session said "desktop telemetry is unavailable" and
dropped the whole usage and per-source section. The reader, its schema and its
GC entry all survived; only the writer was gone.
The kernel owns the accounting now. goalUsageTee is the one layer every
billable call passes through — executor, planner, subagent, compaction,
classifier, and the rest, whichever agent made them — so the tally hangs there
and the record is written at the session's own persistence point, which means
it names the session the transcript was written for and cannot drift onto
another. A session with no path or no billed request writes nothing rather
than a record of zeros, which a reader cannot tell from a session that made no
calls.
The schema moves to internal/usagereport so the writer and the reader stop
being two hand-written copies that meet over JSON, where a rename on one side
reads as zero forever on the other.
It carries one thing the old file did not: the cold start, the session's first
executor request kept apart from the totals it is also in. The session hit rate
averages over requests that reuse the prefix the first one paid for, so it says
whether the cache worked once warm and can never say how much of the prefix a
cold start could reuse — which is the number a per-project prefix moves, and
the one this branch's four prefix cuts were aimed at. Sidecar calls are
excluded because they carry their own prefixes; an empty source resolves to the
executor, as every other reader already resolves it.
The effect test asserts it end to end: a session that bills a cold 400/8600
request and a warm 9000/500 one leaves a record whose cold start is the first,
and doctor reports 4% against a session figure of 94% rather than collapsing
the two.
composeWithGoal built the turn by prepending to a string eight times, so the
order the model reads the blocks in was the reverse of the order they were
written in, and adding a ninth kind of dynamic state meant finding the right
line to insert before. The order was real contract — a block nearer the text is
read closer to the request — recorded nowhere.
The blocks are now a declared list and projectTurn renders it, with the one
that follows the user's text (retrieved facts, which answer the request) passed
as the tail. Same blocks, same order, same drain points: the projection is
byte-identical, which is what the existing tests check.
Two contracts come with it. The order is asserted against a written-out list,
so changing it fails a test that says what changed rather than a golden diff
somewhere downstream. And every projected tag must be in
agent.TransientUserBlockTags — the registration that the strippers, the search
indexer and the supersede pass all read. Nothing enforced that before: the
instructions block reached the supersede pass one commit late, and a block that
misses it is silently treated as the user's own words.
autoresearch-runtime stays registered with no producer on purpose. Sessions
saved before it was retired still carry the block, and the registration is what
keeps it out of their titles when they are resumed.
The block is re-owed whenever the instruction set changes and again after a
fold, so a long session accumulates copies of the largest thing a turn carries
— 18KB each on this repo — every one of them stating rules that a later copy
has already restated.
supersedeStandingState already keeps the newest block of each tag and drops the
rest; project-instructions belongs in that set for the same reason <workspace>
does. It is the newest copy that says what the rules are now, and at most one
survives the fold.
REASONIX.md / AGENTS.md / CLAUDE.md were composed into the system prompt at
boot, which made the prefix a per-project string by construction: this repo's
own instructions are 18,104 bytes, so a session here and a session in any other
project shared 3,259 bytes and then diverged on the first rule — and every byte
after the divergence, the rest of the prompt and every tool schema, missed the
provider's prefix cache on a project the machine had not warmed.
They now ride a user turn as <project-instructions>, owed once per session and
again whenever the set changes or a fold summarises the turn that carried them.
The three cuts before this one took version control, the saved-fact index and
the skills catalog out for the same reason; with instructions gone, two projects
that share nothing send the byte-identical system message — measured, 21,360 and
3,320 bytes before, 3,609 for both after.
Be precise about what that buys. The text is not saved: it is one copy either
way, in a different message. What changes is that the copy is no longer in front
of everything else, so the prefix is reusable across projects and sessions
instead of only within one session.
Instructions arriving in a user turn must not read as a demotion, so a fixed
paragraph in the prefix states where they come from and that they carry the
authority they had here. It names no project, so every session on the machine
sends the same bytes; it costs 618 of them (the golden system prompt goes 2,163
→ 2,781) and is the whole per-session price of the move.
The planner composes its prompt once and never projects a turn, so it takes
memory.Set.StaticContext and is unchanged. Set.Block is gone rather than left
meaning half of what it says: Compose takes background, the turn takes
instructions, and there is no third caller to get it wrong.
TestEffectNoProjectStateReachesThePrefix is the standing boundary, upgraded
from the version that still allowed instructions. Sabotage-checked by composing
them back in, which fails it.
autoRouteOrder gained the remote-fetch route and moved npm last, which left
this test asserting npm at index 0 and expecting three routes. It failed on
the branch as pushed: an index is a claim about ordering that the assertions
never meant to make.
Each route is now looked up by name and the count is tied to autoRouteOrder,
so adding a route fails only the count, and reordering them fails nothing.
The download route keeps its own check because its closed reason is an
unwrapped error on purpose.
The skills catalog now rides the user turn, so the runner's input starts with
<available-skills> and an equality check against the expanded command failed.
The block is already declared in agent.TransientUserBlockTags, so the test
drops the host's prefixes the same way history's indexer does and keeps
asserting the expansion exactly.
The three cuts that took version control, the saved-fact index and the skills
catalog out of the system prompt each assert their own piece at the provider
boundary. None of them fails when a fourth kind of project state is composed
in, which is the way this erodes: one line appended in buildPromptAssembly and
every project stops sharing the prefix after it.
Measured on this repo's own REASONIX.md, two projects differing in skills,
saved facts and version control shared 1,754 bytes of system prompt before the
cuts and are byte-identical after them, so the boundary is now stateable as a
test rather than three separate claims: instructions are the only project state
left in there. Sabotage-checked by appending the workspace root to the prompt,
which fails it.
Instructions are still in the prefix. When they move to a session bootstrap
this test's projects can disagree on those too.
The version-control and skills-catalog cuts landed on separate branches and
each needed the same two accessors over a provider.Request, so each wrote its
own: systemOf/userMessages and systemOfRequest/userMessagesOf, byte-identical
bodies. Merging them put both pairs in one package, where the duplication is
visible and the next effect test has two names to choose between.
MEMORY.md was folded into the system prompt at boot, ahead of the project
instructions and the skills index. Measured on this repo's own REASONIX.md with
eight saved facts: the memory block sits 2,192 bytes into a 23,731-byte system
message, so one `remember` re-sent 21,539 bytes — 90.8% of the prompt — on the
next session, of which roughly 19KB was instruction text that had not changed.
PrefixCost counted the index's own 881 bytes and called that the cost.
The facts were already reachable without it. The `memory` tool has search, read
and list — list is the index — and relevant facts already ride the user-turn
tail through auto-recall. The prompt copy was a third path to the same data,
and the only one that charged the prefix for it.
What replaces it is a fixed protocol paragraph: how to reach saved facts, how
to treat them, which tools write them. It names no fact, so it is byte-identical
for every project and session on the machine. Pinned bodies stay in the prefix:
`activation: pinned` is explicit, off by default, and documented as an
always-available fact, so it is not a churn source the way an ordinary save is.
`Set.Index` goes with it — a field nothing reads is where the index grows back —
and PrefixCost now counts pinned bodies only, because a number named for the
prefix that included something not in the prefix was measuring the store.
<memory-update> survives for changes made outside the conversation — a "#"
quick-add, the memory panel — which nothing else tells a running session about.
It no longer fires for the model's own remember/forget: that tool result is
already in the conversation, and echoing it also suppressed the turn's recall,
which says the same thing better and in context.
For an empty store the prefix grows 349 bytes (the protocol is longer than the
"no facts yet" notice it replaced); with facts saved it shrinks, and either way
it stops moving. The golden baseline is re-recorded for that text.
The effect test asserts the claim where it has to hold: a session that saves a
fact leaves the next session's system message byte-identical, and the test
fails if the index is composed back in.
The skills index was folded into the system prompt at boot: 2,250 bytes of
per-project catalog inside the prefix every project on the machine otherwise
shares (the golden fixture's system prompt goes 4,064 → 1,814 bytes). It was
also stale by construction — a skill installed mid-session never reached the
model, and the built-in guide told users to reopen the session.
The listing now rides a user turn as <available-skills>, owed once per session
and again whenever the catalog changes. A session that installs a skill and runs
/reload-cmd reaches it on the next turn. The token cost is unchanged for a
session that never reloads: one copy either way, in a different message.
A fold can summarise away the turn that carried it, and standing state said only
once does not survive that, so a completed compaction owes it again.
slash_command's description stopped listing the configured names. Be precise
about what that buys: under the default token profile the tool is not
provider-visible at all — it sits behind use_capability — so this is not a
measured cache win today. What it fixes is real but narrower: /reload-cmd
rewrote a provider-visible tool's description under a live session, which is a
prefix mutation wherever the full tool surface is in use. The names are a result
of the tool, not part of its contract; "list" returns them.
Not done, deliberately: per-turn top-k skill retrieval. At this catalog size it
loses. The whole index is 2,250 bytes sent once; injecting candidates costs new
tokens on every turn and breaks even only around fifteen of them, and it trades
a complete list for a ranking that can hide a relevant skill. Retrieval is the
right answer for a catalog orders of magnitude larger than this one.
ApplyIndex goes with the fold — nothing composed an index into a prompt any
more, and leaving the function is leaving the invitation.
The Environment section is composed into the cache-stable system prompt, and it
carried the workspace's version control. That is a per-project fact sitting at
byte ~1,740 of a 23KB prompt, ahead of memory, the project instructions and the
skills index — so a repository and a non-repository on the same machine shared
only 1,755 bytes before diverging, and everything after the divergence, the
rest of the prompt and every tool schema, missed the provider's prefix cache.
The comment above it claimed the prefix was identical for every project on the
machine; the line below it was the reason that was false.
It now rides the transient <workspace> block, next to the path, which moved out
for exactly this reason. Both are stated once per turn instead of once per
session, and the fact still reaches the model either way — unsaid, it reaches
for `git diff` in a workspace that is no repository. Resolution stays at boot,
so no turn pays a filesystem walk for it.
Measured the same way on this repo's own REASONIX.md: the shared head between a
git and a non-git project goes from 1,755 to 2,674 bytes, and the first
divergence moves off the environment section onto the project instructions.
That is the whole win here — the remaining divergence is memory, instructions
and the skills index, which are their own changes.
The effect test asserts it at the provider boundary, where the claim is: two
projects that disagree on version control send the byte-identical system
message, and each turn states its own.
Two things stood between an SSH host and a working session, and neither
was the connection. That host needed a reasonix installed on it, and it
needed the model provider configured a second time, with its own API key
and its own route to the internet.
Model credentials now stay here. A remote session resolves providers
over a reverse forward back to a broker this machine runs on loopback:
the Selection and Request cross the tunnel, the provider is built and
run at home, and the answer streams back. The far side holds an address
on its own loopback and a token, and nothing else — no endpoint, no key,
no headers, no proxy settings — so a host with no egress to the model
API works, and the key is never written to its disk.
The provider runs here rather than the tunnel reverse-proxying its HTTP
because endpoint identity decides request shaping in dozens of places
across the adapters: DeepSeek's beta prefix endpoint, Kimi's K3
contract, Gemini's model resource names, MiniMax's reasoning split. All
of them read a base URL, and a remote pointed at 127.0.0.1 would take
the default branch of every one, silently.
For the same reason errors cross as identities rather than sentences.
IsContextOverflow reads *provider.APIError's status and the code inside
its body; flattened to a string it classifies as nothing, and a remote
turn would fail where a local one compacts and replays.
Getting the kernel there is a transfer, not an install — the binary is a
static CGO_ENABLED=0 build. So auto has the host download its own
release first: this side resolves SHA256SUMS and hands over the URL and
the digest, and the host fetches over its own link, which for a machine
in a datacenter is far faster than a laptop pushing 62MB of extracted
binary. The digest is resolved here on purpose: a host fetching both the
archive and its checksums would be verifying one against the other from
the same network. npm moves from first to last, because it installs the
identical static binary and needs Node to do it, and it stays only
because a network that mirrors npm while throttling GitHub is a real one.
That order lives in one list both the installer and the probe read, so a
probe cannot promise a route the installer would not take.
Two guards this needed. A serve resolves providers over the address it
was launched with, so one bound to a retired broker is not reusable. And
retireOutdated, which stopped only kernels below the version floor,
becomes retireReplaced: whatever made a record unreusable, leaving its
process running orphans it, since that record is the only note this side
keeps of the pid.
Per-host `provider = "local" | "remote"` picks which side answers, and
defaults to local. `reasonix remote serve start` never publishes a
broker: that serve is meant to outlive the command that started it, and
a broker published from a command that has exited is a port nobody holds.
Verified against a real SSH reverse forward, not only against the codec:
a kernel holding no credentials completes a turn, an overflow keeps its
classification, and a tunnel dropped mid-answer reads as an interruption
the agent replays rather than a completion it commits. The fetch script
is executed rather than string-matched — it installs a served release,
refuses a mismatched digest, and leaves nothing behind on a 404. The
three EnsureServe cases model a POSIX remote and skip on Windows; they
were cross-vetted for linux and run in CI.
A remote listener is torn down on every disconnect and re-listened on
Attach, and a spec asking for 127.0.0.1:0 was handed a fresh port each
time. Whatever was told where to find it outlives that reconnect, so the
address it is still holding is one nobody listens on any more.
The runner now remembers the address it was given and re-requests it,
falling back to a fresh one when that port has since been taken. A spec
that named its own port is unaffected: it already asked for one.
The test failed at first for a reason that was not the code. sshtest
replied true to cancel-tcpip-forward and never closed the listener, so
re-requesting the same port failed there and nowhere else. The fake now
releases the port the way sshd does, which is what lets the test observe
the fix at all.
The Wails shell installs as ReasonixStudio.app and this one as "Reasonix
Studio.app", so a person who downloaded 2.11 with 2.10 on disk has both.
They share a data home, and the single-instance lock means clicking
either raises the same window: two icons, one application, and nothing
saying which is which. Windows already takes its predecessor over from
the installer and Linux upgrades by package name; macOS had no
equivalent, because a dmg is a drag and has no hook to put one in.
So the first launch asks. Trash rather than delete, because this removes
an application somebody may still want and only one of those is
reversible; after the window rather than before it, because a modal in
front of an unpainted window reads as a failed start; detached from boot,
because a launch must not wait on it.
Bundles are found by identifier through Spotlight rather than by name — a
bundle someone renamed is the same application, and a name match would
miss it. The published path is the fallback for a machine with Spotlight
off: that one is a fact about what we shipped, not a guess about what a
user typed.
A refusal is recorded per bundle. Asked again every launch is the
annoyance this exists to end.
Verified by breaking it. The first version of the running-application
test passed with both guards removed, because the search it used returns
nothing under a temporary directory and the loop never ran; it hands the
filter its own bundle now, and removing the guard fails it.
A universal bundle carries both architectures of Chromium and of the
kernel, and every machine runs one of them: 279MB downloaded to use 146.
Split into two jobs and the same release ships 150MB to an Intel Mac and
146MB to an Apple Silicon one, with nothing else given up — the same
targets, the same signing, the same notarization, one bundle each.
It also removes the shape that has now produced two defects in a row.
2.11.0 named a universal app darwin-arm64 because --prepackaged never
reads what is inside the bundle it is handed, and the fix for that had to
teach the packaging step a flag the bundle step already had. Per
architecture there is nothing to infer: the matrix row states electron
-builder's spelling beside the release one, both steps read the same
field, and an artifact is named for what it actually contains.
studio-manifest needed no change — it already keyed a non-universal
darwin archive to its own platform, and keeps handling universal for
anything that still ships one.
Two guards move with it. The artifact count is 7, because two macOS
architectures are four files rather than two. And the update-channel
check names each darwin archive instead of globbing darwin-*: a glob
passes on whichever architecture shipped, and the missing one is exactly
the platform this check exists to refuse a release without.
Verified locally per architecture, as the jobs run it: --x64 produces
dist/mac and is renamed to amd64, --arm64 produces dist/mac-arm64, and
studio-manifest keys darwin-amd64 and darwin-arm64 off their own
archives.
context_soft_limit_tokens has been the economic maintenance boundary since
it was added and there has been no way to set it but editing config.toml.
A declared 1M window folds at 160k under the default, which reads as the
window being ignored — and no screen said otherwise, because the two
bounds are configured separately and only the lower one ever fires.
So the settings carry both, and the number in force beside them. That
number is read from the agent rather than recomputed: min(window x ratio,
soft limit) written twice is how what a user reads stops matching what
happens, and the agent already owns the rule.
Zero and negative are answers, not absences: zero restores the default,
negative turns the boundary off, so the wire carries a pointer and the
field's empty state is the default rather than nothing.
The capability goes on RuntimeSettings, so it is owed to every frontend
that names SessionAPI. serve gets GET/POST /compaction, saving through
rebuildInPlace because boot binds the bounds into every agent it
assembles and a live session would otherwise keep folding where it was
built to. The chat TUI gets it as "/context fold <n>" rather than a
command of its own: the report it extends already prints these numbers,
and the dispatch switch it would have joined is 1083 lines at complexity
276, where one more case costs three budgets.
Both route tables learn /compaction. They match whole path segments, so
/compact does not cover it — the same gap that answered /plan-decision
with index.html.
The compaction setters leave edit.go for edit_compaction.go: the two
bounds are one subject, and that file is 1622 lines over its ceiling
already. It shrinks by both.
CompactionSettings joins wire-parity beside SandboxSettings: the desktop
hand-writes the mirror, and a field the panel cannot read is a threshold
a user sets and never sees applied.
595MB unpacked, and two of the largest pieces are there by default rather
than by need.
Chromium carries 220 locale bundles, 49MB, where the interface draws two
languages. Both spellings are listed because the match is against the file
name and the platforms disagree — macOS names them zh_CN.lproj, Windows
and Linux zh-CN.pak — which the first attempt got wrong in the direction
that says nothing: only en survived, and a Chinese system would have found
Chromium's own surfaces in English.
The kernel carried its symbol table and DWARF, 28% of a 43MB binary, which
a shipped build never reads: a panic's traceback comes from the pclntab,
and -w leaves that alone.
Measured on a real universal build: 595MB to 524MB, with en, zh_CN and
zh_TW kept and the kernel at 61MB from 85MB.
2.11.0 published a universal application as ReasonixStudio-darwin-arm64,
and studio-manifest reads the artifact name: it keyed darwin-arm64 alone
where 2.10.0 keyed both. An Intel Mac asks for darwin-amd64, finds
nothing, and is never offered the update — the package runs there, the
catalog just does not mention it.
The flag was on the bundle build and not on the packaging step. Splitting
the two so notarization can happen between them left --prepackaged to
name the targets, and it never reads what is inside the directory it was
handed, so it used the runner's own architecture.
Verified end to end on a real build: the targets come out
ReasonixStudio-darwin-universal.{zip,dmg} at arch=universal, and
studio-manifest keys darwin-amd64 and darwin-arm64 off the one archive.
The macOS release leg failed at the merge: @electron/universal packages an
x64 app and an arm64 app, walks the Mach-O files present in both, and
refuses one whose bytes are identical — the case it cannot tell from a
mistake. go build -o bin/ produced the runner's own architecture and both
legs got that same file.
The check ahead of it is the one to satisfy: already universal on both
sides is accepted and skipped, so the kernel is lipo'd from an amd64 and
an arm64 build rather than declared an exception through x64ArchFiles,
which would have shipped Apple Silicon a kernel it runs under Rosetta.
CGO_ENABLED=0 because one of the two is always a cross-compile.
Off macOS the command is what it was.
Verified on a real universal build: the merge completes, the bundle's
kernel and window binary are both x86_64+arm64, the SPA is a resource,
the version is injected, and the packaged kernel answers -instance-id.
The standing footer told every reader the Windows package is unsigned and
to click through SmartScreen, because Authenticode was bound to main-v2
when that line was written. It has not been true since 2.10.0: the studio
origin is provisioned, and that release signed the payload and the
installer and verified the chain.
The sentence now reads the pair the build job gates signing on, in the
same run, so it cannot drift from what happened again in either
direction.
131 commits since 2.10.0, and the shell underneath them changed. The
document is what someone reads to decide whether to upgrade, so the
migration path is stated before the features: which installer replaces
what, on each platform.
Same register as 2.10.0 — declarative bullets, one claim each, the
mechanism named and the measurement kept where one exists.
Every Studio release carries GitHub's prerelease flag, so the flag said
nothing about the tag, and the catalog took whatever version the tag
named. A studio-v2.11.0-rc.1 would therefore reach 2.10.0 installs as
their next version. The tag's own grammar decides it now: semver's
prerelease segment marks a candidate, which is still mirrored under its
tag prefix so it can be installed from its manifest and tested.
Two things stood between an installed Wails 2.x and the first Electron build,
and only one of them was the crossing everyone expected.
The installer was started with "runas". That was written for the Wails
installer, which requests admin in its manifest and installs per-machine under
Program Files. The Electron one requests nothing: it defaults to the running
user's profile and raises consent itself only if that user chooses an all-users
install. Elevating it up front puts the whole installer in the consenting
account, where its own default writes that profile — the user who asked for the
update stays on the build they had, and nothing reports it. So the line states
which installer it ships rather than carrying a bool that means "elevated or
refuse": guessing is wrong in both directions now, and the per-user direction
fails silently.
And installing this one would never have replaced the old one. It is
per-machine under Program Files with its own uninstall key; this one is
per-user under a key electron-builder derives from the appId. Both would have
stayed in Add/Remove Programs, both on disk, and only one of them would ever
have been updated again. assets/installer.nsh runs the old uninstaller from
customInstall — through ExecShellWait, because CreateProcess refuses an image
that manifests admin, and in the 32-bit registry view, because studio.nsi never
called SetRegView and wrote through WOW64 redirection into a key electron-
builder's 64-bit view cannot see. A declined prompt leaves the old install
where it was and this one working: a takeover must not fail the install it is
cleaning up after.
Verified by building the installer: the first attempt failed on a warning from
this file, which is how the include proved it is compiled in, and makensis runs
warnings-as-errors in the packaging job. Not driven against a real legacy
install on any machine, which the migration contract now says per platform
rather than as one unexercised crossing.
Every layer read the Reasonix home back out of the environment, so the only
way to bind one was to mutate the process — which is why a second home meant
a second process, and why nothing in internal/boot could run in parallel.
config.Roots is that binding. The storage root table's precedence chain now
runs against it, so a stated home carries state, cache and worktrees along
exactly as REASONIX_HOME does, and a stated home outranks the variable: the
environment is how a host works out which home to use, and once it has, it
says so. Package-level path functions delegate to the zero value, so nothing
unstated changes. A loaded Config remembers its binding, which is how the
code holding a config derives paths without the home threaded beside it.
boot.Options.Home is the input. Everything Build reaches is bound to it:
config load, credentials, the six legacy migrations, plugin packages, LKG,
sessions/archive/stats/memory, skills and hooks, MCP launch, sidecars, and
the permission-rule write path, which fell back to the user-global config
when the workspace root did not resolve.
The effect test asserts it where it has to hold: two homes in one process
with no t.Setenv or t.Chdir, and no write into the home the environment
names. It found the one place that does not hold — the history-search
projection is a single per-process SQLite file under the process cache root
— and names it rather than excluding it quietly. A Controller's own later
re-reads still follow the process; Options.Home says so.
load.go went over budget, so the four retired-key migrations move to
retired_keys.go unchanged; -update then reclaimed 189 lines of file-size
budget. Every baseline number moved down.
prompt.go says what this section is for: "this prefix is identical for
every project and session on the machine and they share one cache entry."
The fingerprint included DenyRoots, which is the workspace root, so every
project on a machine got its own entry and re-ran all eleven probes --
against the stated intent, in the same file that states it.
Measured before assuming. internal/boot's tests take 160s; the temp-dir
cleanup I suspected first accounts for 0.9s of it across 359 removals,
and the CPU profile is 98.96% runtime.cgocall -- not computation at all.
Under it: Process.Wait 26%, reading child pipes 49%, LookPath 9%, and
environment.runOne owning 95% of the LookPath time. Build costs 715ms at
p50 and 86.3s across 141 calls, over half the package, and it is eleven
subprocesses each time because every test is a fresh workspace.
PATH decides what a probe resolves to. The deny roots decide afterwards
whether to run what was resolved, which is a string comparison on a path
-- so the expensive half is a property of the machine and the cheap half
is a property of the workspace. The fingerprint now names PATH, and the
deny is applied to the answer.
Which means an answer has to carry what it resolved to, so another
workspace can check it: ProbeResult gains Path, recorded before the deny
decision and rendered nowhere. An entry is reused only where nothing it
ran sits under this workspace's deny roots, and a result recorded before
Path existed cannot be checked and so is not reused.
Nothing runs that a deny would have stopped. The order in runOne is
unchanged -- resolve, deny, execute -- and a run that refused anything is
released to whoever is waiting but never recorded, because a refusal
belongs to the workspace that made it. That last part is a bug the test
found: publishing through finishProbe also wrote the cache, and the
workspace after the denying one inherited an empty answer.
internal/boot: 160s to 105s. The same profile on the Build-heavy subset
falls from 242s of samples at 399% CPU to 24.6s at 85%, and runOne no
longer appears under exec.Start at all.
Production is the point rather than the tests: opening a project you have
not opened before paid eleven subprocesses at startup, and the disk
snapshot -- keyed the same way -- could never help it.
The number it guards is real: 3,995 of one measured run's 5,577 prompt
tokens were built-in tool schemas, paid by every session before it does
anything. The mechanism was not. A hand-edited const in a test has no
update path and leaves no trace of why it moved, so the only thing a nine
-token documentation improvement could do was trip it -- which is how a
budget stops being a budget and becomes something people route around.
Every other gate in this tree already answers this: repolint and
covergate both record a baseline and take -update, free in the direction
that gives ground and explicit in the direction that takes it. This one
was the last that did not, so it is that now: schema_budget.json,
-update-schema-budget to record, -allow-schema-widen to raise, and the
raise lands as a line in the diff with a reason beside it in the PR.
Recorded at 5590, which is below the 5600 the const carried -- the tree
had already given some back and nobody could see it.
The contract was exercised in all four directions before landing:
shrinking records without a flag; a deliberate growth goes red and names
the largest schemas; -update alone refuses to raise and says by how much;
-update -allow-schema-widen records it.
grep honored .gitignore with no way past it and no way to know it had
been applied. A match in dist/, node_modules/ or any generated tree was
unreachable, and what came back was a bare "no matches" -- from which the
only available reading is "not here", which is a different claim than the
one the search could actually make.
That is the host holding a cause and not passing it on. It knows the
result was filtered; the caller cannot know, and acts on the stronger
statement.
Two phases, in the order the cost argues for. The tracked tree first,
because that is the answer nearly every time and it is the cheap one. The
ignored paths only when that came back empty -- which is exactly when the
unqualified answer is most likely to be acted on wrongly, and the only
time a walk of the build output is worth paying for.
Three answers now instead of two: matches, matches that say they came
from ignored paths, and "nothing here either, so this is absent rather
than filtered". The third is new information -- an empty result that has
looked everywhere is a different fact from one that has not.
Widening widens the ignore rules and nothing else. Confinement is checked
above the switch, because what a caller may not read is not an ignore
rule; the VCS store stays pruned, being history rather than anywhere a
build writes; hidden files stay hidden. Both engines answer alike, which
is why the ignorer's skip order changed rather than its flag count.
The ripgrep flags were verified against ripgrep 14.1.1 by hand -- reaches
dist and node_modules, does not read .git, leaves hidden files hidden --
because the automated check for that engine skips wherever rg is not on
PATH, which includes this host.
Measured, not guessed. Across 17 recorded sessions and 393 real bash
calls: p50 472ms overall, but 46% of calls are ones the host cannot
classify, and those run 957ms against 387ms for the rest. The gap is two
whole-workspace walks -- one before the command, one after -- and a walk
of this repo's 20k entries is ~300ms warm. 570ms of gap, 600ms of walk.
Three things were wrong with paying it.
The after-walk was taken even when nothing could come of it. changed()
refuses a truncated or absent before-scan, so a backgrounded call -- whose
before-scan is deliberately skipped -- walked the tree only to be told
so. Guarded on the before-scan now.
Past the limit the whole thing is loss. scanWorkspace stops at 50k
entries and reports incomplete; changed() then refuses both. So a
workspace above the limit paid two 50k-entry walks per unclassified call
and learned nothing, every time. The task remembers the first one now.
It resets with the task rather than living for the session, which is also
the more correct lifetime: an install is what puts a tree over the limit
and a clean is what takes it back under, and both happen inside one.
And it could not be stopped. scanWorkspace took no context, so pressing
stop killed the command promptly and then waited on an uninterruptible
walk -- which is what "stop does not work" is, on a tree big enough for
the walk to matter. It checks every 512 entries now.
Nothing is filtered and nothing is skipped that could have answered. The
walk still crosses ignored directories on purpose: npm install and a
build write exactly where ignore rules point away, so a filtered walk
would report the biggest writes there are as no change at all. What the
skips give up is observation, which leaves a mutation unproven rather
than mis-proven -- the direction the trust domain requires, since an
incomplete observation never establishes scope.
The limit is a parameter now so a test can reach the over-limit answer
without laying down fifty thousand files, and without a package variable
one test writes while another reads -- the shape of the race fixed two
commits ago.
Checked red first: with the cancellation guard removed the cancelled
walk reports itself complete.
internal/sandbox is a declared sensitive path and its coverage gate has
been red on this branch since before the Electron work -- 73.2% against
a 73.5% floor on CI. Nothing here lowers the floor. What was uncovered
was not obscure: the unified launch plan, the context seam an escape
approval travels on, and the identity an unavailable sandbox refuses
with, all at 0%.
PrepareArgs is worth a test rather than a number. LinuxSandboxed is the
conjunction of three things and decides whether the child is told /tmp
or the host path -- a true where nothing binds points a process at a
directory that is not its own -- so what is asserted is that the flag
and the exported values agree, on whichever platform runs it.
The approver seam is now held to failing closed. A typed nil passes
`!= nil` on an interface, and what it would authorize is a shell command
running unconfined. This is NOT a reachable defect: both setters that
install one -- Agent.SetSandboxEscapeApprover and the constructor -- run
nilutil.IsNil first, deliberately, and no third caller exists. What the
change does is move that guarantee into the package making the promise
instead of leaving it something two callers remember and a third might
not. No reachable behaviour changes.
The refusal test pins what the code comment already claims: the code is
an identity rather than the sentence again, the sentence exists, and the
message ends in it -- so a surface showing one never shows half.
Local coverage crosses the floor (68.1% before; the number is
platform-dependent and lower here than on CI, which is what this has to
be confirmed against). internal/installsource also reports under its
floor on this Windows host and does not on CI, which is the same
platform dependence and is left alone.
TestAMissedNotificationLosesNothing counted wake-ups in a plain int that
the broker's callback writes from the goroutine raising the question.
Ask registers the question under the lock and notifies after releasing
it, which is right -- a host callback held under that mutex would block
every other question -- but it means the poll raise() waits on can
return before the callback has run. The test then read the counter while
that goroutine wrote it.
This is a flake before it is a race: the read could see zero and fail on
its own, with the detector only making it certain. The wake-up is
carried on a channel now, waited for, and the "once" is asserted at the
end as nothing further having arrived.
Reproduced both ways locally under -race: the counter version fails at
-count=4, this one passes.
The .deb gate went red on a package that was correct. The helper was
there, at the path the polkit action names, mode 0755, owned by uid 0 --
which is what --deb-user root asked for and got. What failed was the
assertion: dpkg-deb printed 0/0 and the pattern wanted root/root.
Which one it prints is a property of the machine reading the package,
not of the package, so the check now accepts either. This is the phrase
table the standing rules warn about, in miniature: a judgement matching
the spelling of a thing rather than the thing.
The gate is otherwise doing its job, and the diagnosis was exact because
it prints what it found -- one line named the mode, the owner and the
path, which is what made the difference between a wrong package and a
wrong pattern readable at all.
Pattern checked against that line: both spellings of root pass, and a
runner's own uid still fails.
go test -race has been red on this branch since before the Electron
work: acknowledgeUpdateHealth read updateProbation and commitUpdateHealth
inside the goroutine it starts, and nothing waits for that goroutine, so
a test restoring them at cleanup wrote what a still-running wait was
reading. Three CI jobs -- desktop, desktop-macos and race -- have been
failing on it.
Reading them where the wait is armed is also what they mean. How long
this launch must survive is a decision taken when the acknowledgement is
set up, not whenever the runtime happens to schedule the goroutine; the
old shape made it depend on which came first.
Nothing shared is touched inside the goroutine now, so it may outlive
the test that started it without racing anything.
Reproduced locally before and after: the original fails
TestWindowLostInsideProbationCommitsNothing under -race and the fixed one
passes the package. It was reachable here all along -- the pre-push list
runs the desktop module without -race, which is the one flag that sees
this.
Both from CI, and both are the platforms a Windows host cannot reach.
The .deb never built. fpm wants a project homepage and electron-builder
errors without one, so the Linux leg failed before packaging -- which
also means the gate the previous commit added, the one that reads the
package back with dpkg-deb, has still never run. package.json carries
homepage and author now; author was only a warning, but the maintainer
it would otherwise be guessed from is the .deb's.
The macOS zip ships a blockmap and no option turns it off.
differentialPackage: false is an nsis option and Windows took it, which
is why the Windows leg was green; macPackager builds the mac zip target
with update-info writing hardcoded on, so there is nothing to configure.
canonical-artifact-names.js deletes it instead -- deleted rather than
dropped from the hook's return, because what that return does is name
extra files to publish, while what the release counts is what is in the
directory.
The gate that caught it is the one added for the same reason: a
.blockmap carries the release prefix, so the count that refuses a
partial publish would have counted one and hidden a missing artifact.
It went red on the platform its author could not run.
The previous commit named the .deb reasonix-studio so dpkg would upgrade
an installed Studio rather than hold a second one beside it. That made a
worse bug reachable than the one it fixed: dpkg removes files the old
package owned and the new one does not, so an upgrade would have taken
/usr/lib/reasonix-studio/reasonix-studio-update-helper with it. Linux
self-update would then refuse by name -- correctly, "helper missing" --
on every attempt, forever, on a machine that had it working before.
The path is not a choice. The polkit action annotates exec.path with it,
so authorization is granted for that helper and no other; shipping it
anywhere else is the same as not shipping it. It is also the path the
Wails package owned, so one destination answers both the policy and the
upgrade.
electron-builder places nothing at an absolute system path without fpm
arguments, so deb.fpm carries the helper and the policy, and
packaging/linux-payload.js stages the helper where those arguments look.
It is a no-op off Linux: a helper built for another platform would be
found by fpm and shipped.
--deb-user root is stated rather than left to fpm's default. What fpm
records for -s dir is a property of the machine that ran the build, and
polkit will not execute a helper the invoking user could have written --
a CI runner's uid on that file is a package that installs and then
refuses. Read out of app-builder-lib rather than assumed: electron-builder
passes --deb-compression and nothing about ownership.
The policy moved to desktop/packaging/linux/. It was under
desktop/next/build/, which section 6 deletes when Wails retires -- a file
the new shell needs cannot sit where the old one's removal takes it.
The gate reads a real package. dpkg-deb answers the name, and the
helper's path, mode and owner, and whether the policy is there at all;
both of the failures above are ones that install cleanly and say nothing
until a user asks for an update. It has not run: no .deb has been built
here, and neither has an upgrade over an installed Wails one.
Checked locally: the payload script no-ops on win32, and the helper
cross-builds for linux CGO-free.
The capability existed with one consumer and a note saying the other
would get one when its application owner was defined. This defines it,
which closes the last thing GoToVersion was waiting on.
Three acts, two lines. Releasing the application has nothing to do under
this shell -- what holds it open is the shell and this process inside
it, and nothing short of ending releases that -- so only relaunching and
ending travel. They go as one JSON line each on the pipe the handshake
went out on, because that pipe is the only channel pointing that way:
stdin is the lease, HTTP runs from the shell to here. Nothing is
acknowledged, because both are acts the shell performs by ending, and an
acknowledgement would have to arrive from a process on its way out.
The reader had to carry what it did not read. firstLine took the
handshake and dropped everything after the newline in the same chunk,
which was correct while nothing followed it and would have lost the
first act to how the pipe happened to flush. It now hands the remainder
on, and a test pushes a line split across two chunks.
-studio-app and -studio-app-pid are the other half of what a shell
states. Which file the application runs as and which process holds it
open are both unanswerable here: os.Executable() names this binary,
which sits inside the bundle an update would be replacing. update.At and
update.ApplicationAt are what Here and LocalApplication already did,
with the executable passed rather than read from this process.
A host that cannot name both declares no capability, so no install route
registers -- the same nil-interface gate as before, driven red to check
it: without it an unpackaged launch that named no version at all still
got one.
studioLine moved to internal/update as StudioLine, beside StudioCatalog,
because they answer one question together and both shells now ask it. Its
Members and Launchers stay what the Wails shell installs; the Electron
one reads neither, since every platform it ships takes a channel that
replaces a whole install rather than staging files.
Two Linux findings, one fixed and one not.
The .deb had to be named. electron-builder takes the package name from
package.json's `name` unless told, so it would have published
reasonix-studio-electron -- held beside the installed reasonix-studio
instead of upgrading it, and invisible to the dpkg -S that decides
whether this install belongs to the package, which sends the self-update
down the portable-archive path behind the package manager's back. Read
out of app-builder-lib's own resolution rather than its documentation.
The package still carries no update helper, and that is worse than
absent: Line.InstallDeb runs /usr/lib/reasonix-studio/... under pkexec
and refuses by name without it, and sharing the package name means a
dpkg upgrade REMOVES the helper the Wails package owned. A machine that
upgrades into an Electron build would lose Linux self-update and not get
it back. Recorded in the migration doc rather than fixed: placing files
at absolute system paths needs fpm arguments, and no .deb has been built
or installed here to check one against.
Checked: the act protocol on both sides, the capability gate driven red,
the layout following the stated executable, three-platform vet, and the
suites. Not driven through a real install on any platform.
GoToVersion was the last binding on window.go, and the last place a
capability lived in one shell rather than behind the transport both
speak. The orchestration moves to internal/appupdate, which is the
package whose whole subject is owning the application meeting replacing
it, and POST /update/install starts it.
Progress is pulled, not streamed. Section 5's taxonomy answers this
before any transport is chosen: a frame nobody received costs nothing
the next read does not restore, so it is a projection, and GET
/update/install is its endpoint the way GET /tray/state is the icon's.
An event would owe delivery across the restart the install is itself
causing -- the last thing a working install does is end the process that
would have been streaming it.
The route answers 202 rather than waiting. There is no later answer to
send: an install that took over left nothing to send it with, so what a
client watches is the projection and then the application coming back.
The page had a comment saying a resolved promise meant the install did
not take over; that stopped being true here, and the row now follows the
kernel's phase instead of a local guess.
ApplicationOwner gains a third act. Releasing the application, starting
its successor and ending it are one call in a shell that is its own
process, and three different ones in a shell whose window is a framework
that spawned it -- os.Exit against app.quit(). Fusing them is what this
interface was split to stop, and it was still fused at the end.
Both gates on the route, because they answer different questions.
Owning the application is what makes replacing it this process's
business; the hub's declared Install is which build is being replaced
and where it lives, and it is handed to each call rather than copied
into the capability, so there is no second answer to disagree with.
update.install_running is told apart from every other refusal because
the thing to do about it is different: wait, not fix what was asked.
The catalog guard moved with the code it watches, and said so first: it
scans a directory for update.Options literals, and it failed with "this
guard is no longer watching anything" rather than passing over an empty
one. Every updater still has to name Studio's catalog; a release listed
by one cannot be installed from another.
The Wails shell keeps the three acts and nothing else. Its install.go
was two hundred lines of orchestration and is now forty of platform
answers, and four files that existed to split the apply and deb paths
per platform are gone -- that split lives beside the orchestration now.
Not driven through a real install on any platform: checked at the route,
at the projection, and at the orchestration's own guard. Electron still
declares no ApplicationOwner, so no route registers for it, which is
section 7's point -- a protocol existing is not parity.
The macOS swap asked os.Executable() what it was replacing. That holds
for a single binary that is the application and for nothing else: under
Electron the Go process sits at Contents/Resources/bin inside the very
bundle it would be swapping, and the handle keeping that bundle open
belongs to the framework that spawned it. Two of the three things the
handoff needs were therefore this process's answers to somebody else's
questions.
update.Application carries both -- the bundle to swap, and the process
that must exit before it can be. Neither is inferred. A shell that is its
own executable says so through LocalApplication, which is where that
assumption is now written down rather than spread through the swap; the
Wails shell calls it and behaves exactly as before, which is the point of
the checkpoint.
The third thing stays os.Executable(), and the comment now says why: the
helper that holds LockRepairMutations across the rename has to be a Go
process, and that is this binary under either shell. Conflating it with
the other two is what made the whole set look like one answer.
An unstated application is refused rather than filled in from here.
os.Executable() would have resolved to something, and every later check
-- bundle identifier, codesign, spctl -- would have passed on it, because
they verify the replacement and not the target. The two refusals are
sentinels because a caller tells them apart: nobody stated one, versus
stated a path that is not an app.
apply_darwin.go was one file doing two things, and adding to it put it
over the ceiling, which is the useful kind of pressure. Deciding what is
being swapped now lives in application_darwin.go -- the bundle, its
validation, finding one in an archive, verifying it -- and the handoff
transaction keeps apply_darwin.go. No budget was widened.
GOOS=darwin vet only: the shell cannot be cross-compiled from a Windows
host (CGO/systray, which fails the same way on an unmodified tree), so
the darwin tests here run on CI's macOS leg.
The release line was the first of the three blockers because the other
two follow it: the install path replaces whatever the release produced,
and the updater hands over to whatever the install path put on disk.
electron-builder already wrote canonical names and a packaging job
already checked them on real artifacts; what was missing was the
distribution half -- signing, notarization, and the artifact contract
the publish job refuses a partial release against.
Windows and macOS both package in two steps now, for one reason stated
once: something has to happen to the bundle between them. An Authenticode
signature there, notarization and stapling here. Linux stays one shot
because nothing does. The Wails line split only Windows, which read as a
Windows peculiarity rather than as what it is.
The Windows signing contract names two executables where it named one.
This shell ships the window and the kernel it spawns beside itself, and
signing only the container leaves both unsigned on disk after the
installer around them has already been trusted. Everything else in the
bundle is Chromium's or electron-builder's -- resources/elevate.exe is
the other PE file, written in during the NSIS step -- and stays unsigned
rather than re-signed under our certificate. Both are also verified in
stage two: listing one would let the other be swapped between the stages
and still pass.
Three things the real artifacts said that the config did not.
The version has to be injected. app.getVersion() reads package.json,
which carries 0.0.0 in the tree, so every packaged build would have
stated a version behind every published release and offered itself an
update on each launch -- the same identity trap that already showed up
once as 44.1.0, from the other direction. -c.extraMetadata.version rides
both stages: the app.asar copy is what the shell states, the second is
what the uninstall entry records. Checked: 2.0.0 in the asar, 2.0.0 on
the installer, 2.0.0.0 on the window.
The .blockmap is electron-updater's differential index and it is named
ReasonixStudio-* like everything else. The publish job counts artifacts
under that prefix to refuse a partial release, so it would have counted
one and hidden a missing artifact rather than adding one. Turned off at
the source, and a studio.yml gate fails it if it returns.
The portable archive does not hold a fixed set of executables. It is
packed from the same directory the NSIS target writes elevate.exe into,
so which of them is present depends on target order. The verifier held
"exactly one executable" and would have failed on that rather than on
anything about a signature; it now checks the two this line signs, by
path, and matches their bytes against the signed payload -- which is the
property it was after, and the one an exact count only approximated.
studio-build.sh leaves the release path and stays where it is: studio.yml
still builds the frozen shell with it. It leaves the signing contract's
fingerprint list for the same reason, and electron-builder.yml joins,
because what is packaged and how is now decided there.
Checked on Windows against real artifacts: the --dir / --prepackaged
split, the two executables and their paths, canonical naming, version
injection, and that the archive is packed from the bundle the signatures
go into. Not reachable locally and recorded as unverified in the
migration doc rather than rounded up: macOS notarization and stapling,
the Linux .deb, and both SignPath requests -- whose artifact
configurations live in that console and have to be updated to match
.signpath/artifact-configurations/ before a signed release can pass.
The two places that locate the bundle exclude the universal build's temp
directories. mac-universal-x64-temp and its arm64 twin sit beside
mac-universal holding a single-architecture .app of the same name, and
find does not promise an order across filesystems -- notarizing or
packaging one of those would ship a single-architecture bundle under the
universal name. Sorted and filtered rather than trusted to come out
right; no case where the unfiltered form picks wrong was reproduced,
because find returns sorted entries on the filesystem this was written
on.
Windows was the only platform whose package had ever existed. macOS and
Linux rested on a config file and a cross-compile, which says nothing
about what electron-builder actually writes. All three now package on
their own GitHub-hosted OS and are held to the contract the release
reads.
Four assertions, in the order they can be made:
- no artifact names x64; one names the release architecture
- no electron-updater metadata beside the manifest channel
- the kernel and the SPA are resources rather than archive members,
found rather than asserted at a path the builder chooses
- studio-manifest keys the artifact under the platform the runner is
The last is the end of the contract. It is not that a name parses -- the
parsers accept the packager's own spelling and answer with a key nobody
asks for, which is the failure the rename exists to prevent -- but that
the manifest written from the real directory carries this platform.
Writing that check found a false pass in itself: studio-manifest logs to
stdout and writes latest.json into the directory, so capturing stdout and
grepping it matched the tool's own progress line. It reads the file.
Unsigned on purpose, and the identity discovery that would otherwise fail
the job is disabled on the packaging step alone, so a signed release job
does not inherit it. Signing and notarization are distribution and belong
to the release workflow; their absence is not packaging left unverified.
The Windows leg stays despite having been proven by hand. A contract only
one machine has ever checked is not a gate.
macos-latest is arm64, where the release spelling and the packager's
agree, so the rename hook is exercised by the two x64 legs rather than
there. The macOS bundle layout is recorded rather than asserted, so later
work argues from what was produced instead of from documentation.
This proves artifacts and layout. It is not a substitute for the macOS
probes: nothing here touches LaunchServices, a live multi-process bundle,
or renaming one out from under a running application.
Introduce a host-owned application update capability and route
launch-health acknowledgement through the existing exact repair witness.
This commit does not change platform swap semantics or implement
Electron handoff ownership.
Two invariants, and they are what the shapes here are for:
- shells may acknowledge only that the current launch is healthy;
transaction identity remains owned by repair.UpdateHealthWitness
- update routes exist only when the host owns application replacement;
generic reasonix serve does not acquire desktop self-update capability
AcknowledgeLaunchHealth takes nothing and POST /update/health reads no
body, so the endpoint carries one bit -- this launch satisfied the health
oracle -- rather than a request to commit a named transaction. Which
transaction that is was read at startup, before anything could rewrite
it, which is what makes the acknowledgement unable to retire somebody
else's rollback material.
New returns a nil interface rather than a nil *capability where nothing
owns the application. A typed nil satisfies `opts.Update != nil`, which
would register the routes for a host with no owner and fail nowhere.
ApplicationOwner names the two halves the shell had fused: handOver was
a hub shutdown, a Linux-only relaunch and an exit in one function, and it
now delegates, so the interface has a consumer rather than a plan. The
split is already visible there -- a waiting helper starts the successor
on Windows and macOS, the departing application does on Linux -- which is
the evidence the handoff audit starts from.
The capability sits in the kernel, not the shell module. The update
engine is internal/update now, so a desktop/ package would be out of
reach of the Studio host in cmd/ -- the host could see the engine and
never own it, which is the trap this area already fell into once.
appupdate declares its own Capability rather than returning
serve.UpdateHost, because a kernel package may not import a frontend and
Go's interfaces meet structurally. The nil-interface gate survives that
split, and a test in the shell holds it at the assignment where it now
lives: asserting it inside appupdate stops working the moment New
returns a concrete type, because the comparison there becomes a pointer
comparison a typed nil passes. Checked by breaking it -- the local test
stayed green, the shell's went red naming (*appupdate.capability)(nil).
The shipped Wails host is the first consumer; the Electron Studio host
intentionally does not expose the capability until its application owner
is defined. Its hub wiring gate is deliberately not extended with Update
for the same reason: absent is correct there, not missed.
The health oracle is unchanged -- DOM ready, then two seconds -- and the
shell's own test can no longer assert which version it committed, which
is the boundary working.
/update joins the Wails asset whitelist and the dev proxy because that
shell still ships; it goes with apiPaths in the atomic retirement rather
than bending the canonical route to avoid temporary debt.
Install joins the shell's hub-option parity list while this is open: the
kernel grew that field in the same window, and the guard that exists to
catch a capability never handed to the hub was not watching it.
The gate the previous commit made mandatory failed about a quarter of the
time on Windows, in a different test each run, always as a TempDir
cleanup that could not remove the directory it had just emptied. A
required gate that flaps teaches people to re-run it, so it had to be
understood before anything was built on top of it.
It is not a late writer. Caught in the same command that observed the
failure, the surviving directory holds nothing, and it holds nothing
minutes later, and it then removes cleanly. A handle still open would
have failed differently: Windows refuses to remove an open file at all,
and answers with a sharing violation rather than a non-empty directory.
What is left is teardown that has not settled -- names the filesystem
has yet to drop after their content is gone.
The first attempt refused any directory that still listed something and
waited only on empty ones. That is wrong for the same reason: one run
reported a .REASONIX-RESOURCE-*.EXE.tmp that nothing here writes, which
then disappeared on its own. No single frame separates a leak from
settling. The contract is temporal instead -- the directory a test owns
must become removable within a short bound -- and the leak is content
that outlives the deadline, reported with everything seen on the way
there.
Eligibility stays narrow. Windows only, only the refusal actually
observed, a fixed two-second bound, and a timeout is a failure that
names what survived. ENOTEMPTY is deliberately not matched: it is a
different value here and would never fire. Elsewhere one cleanup gets
one answer.
The decision is tested rather than raced: removal is a parameter, so
content that never becomes removable fails deterministically and names
the sentinel, and a refusal that stops is accepted. A blanket retry
would not pass the first of those.
The eleven files converted are the three packages that demonstrated it;
which test loses the race is arbitrary, so the unit is the package.
No production code and no CI change: 20 consecutive green runs of the
command that job runs, against a measured ~29% failure rate before.
The helper lands in the kernel rather than the shell module. The update
engine moved to internal/update, so tests that need this now sit on the
other side of the module edge and a desktop/ package could not be
reached from there. It imports nothing but the standard library, which
is what the layering rule asks of a utility, and desktop/ still reaches
it through the replace directive.
The desktop module's Go tests have never run in CI. The Studio workflow
builds the Wails shell and stops; the main workflow's suites are all
main-module. So the update engine, its elevated helper, the release-side
tools and both shells were green only where a maintainer happened to run
them -- and that is the code which replaces a running application on
someone's disk.
They run now, on all three platforms, in the job that already installs
the toolchain they need. Spelled out rather than routed through make,
which no `run:` step in this repository uses; the command is the one
`make studio-test` runs, in a job whose working directory is already
desktop/.
The host's dependency closure is checked here too, once: cross-compiling
does not depend on the host, and the point is that living in this module
did not quietly make the binary need a GUI toolchain.
Verified by breaking it rather than by reading it. With an arch mapped
twice in arch.json the studio-manifest gate fails, and with PlatformKey
altered two update-engine tests fail, both under the exact command this
job runs. A workflow line that has never been observed to go red is not
an enforced gate.
Installer, portable archive, disk image and .deb, under the identity and
the artifact names the Wails line shipped -- the update manifest and the
release workflow read those names, so a rename here is a version nobody
is offered.
Nothing packaged worked before this. The shell resolved the kernel and
the SPA relative to its own source directory, which is inside app.asar
once packaged: a child process cannot be spawned out of an archive, and
the kernel serves the page off the filesystem. Both are extraResources
now, and one pure function answers for either layout.
The architecture vocabulary is the substantive part. electron-builder
says x64; a release says amd64, because the updater runs inside a Go
binary and asks runtime.GOARCH who it is. Translating at the packaging
boundary keeps studio-manifest, sign and the updater knowing only the
canonical form, rather than teaching the manifest a second vocabulary it
would then have to keep. The architecture is taken from the Arch value
the hook is handed, not parsed back out of the filename the rename
exists to correct, and an arch nothing maps fails the build: the silent
outcome is an artifact describing a platform no running binary asks for.
A gate in studio-manifest holds the map to its own parsers -- every arch
resolves to exactly one platform key, no two collapse onto one name --
and pins why the rename cannot live there instead: the parsers accept
the packager's spelling perfectly well and answer with a key nobody asks
for, so nothing downstream can notice.
Two corrections carried in with it. minimumSystemVersion was 10.13,
inherited from the Wails metadata where it described what WebKit linked
against; Electron 44 requires macOS 13. And disable-library-validation
is gone: it governs loading third-party frameworks into this process,
not spawning the kernel beside it, which is a nested-code signing
question. Signing and notarization are verified in CI, not here.
No electron-updater metadata: the update channel is the signed manifest,
and a second one is a second answer to which version is current.
Verified on real artifacts, not --dir: the installer, the portable zip
and the blockmap all land as amd64, and the packaged app opens a window,
spawns the kernel out of resources and renders the SPA.
`make studio` now builds the SPA and the kernel and opens the Electron
window. The path it replaces was macOS-only by construction -- a bare Go
binary is not a GUI app to LaunchServices, so the script bundled one
before launching and refused to run anywhere else. Electron's own dev
build is already an .app, so one script serves every platform.
Three things had to be true first, and none of them were.
The window carried no icon at all, so the taskbar drew Electron's. It is
named per platform now: .ico on Windows, where the taskbar reads the
small sizes out of it and a PNG would be one bitmap scaled; a PNG on
Linux; and nothing on macOS, which takes the icon from the bundle and
ignores what a window says.
`build:host` wrote bin/reasonix-studio-host with no extension, which
Windows will not spawn. `go build -o bin/` names the binary after the
package and adds .exe where it belongs.
That failure arrived as "the kernel sent no handshake" twenty seconds
later, because firstLine listened for exit and a program that cannot be
started emits error and never exits. It says what happened now, in
milliseconds. An error a caller must tell apart carries an identity, and
"could not be started" is not "said nothing".
Also fixes a test that could only pass on POSIX: it built an expectation
with a /tmp literal and compared it against path.join, which answers in
backslashes on Windows.
pnpm test 11/11.
A card the run is blocked on could seal itself within 250ms of appearing:
buttons gone, kernel still waiting, and the line underneath claiming the
user had allowed something they never saw. The run then waited for an
answer nobody could give.
Two faults, one cause. Decisions() projected only plan approvals and asks
-- ordinary tool permission was skipped with a comment saying it had its
own owner and its own card -- while the frontend read that list as the
whole set of what is still open and sealed anything missing from it. The
projection is served on /status four times a second, so every ordinary
approval was dropped on the next poll.
Completing the projection is necessary but not sufficient: a snapshot
taken before a prompt existed omits it exactly as a resolved one does, so
sealing on a poll is racy by construction. The kernel already records
every decision it settles on the same ordered stream as the request, and
nothing read it. Sealing now rides that receipt, which also carries the
outcome -- the card says what was decided rather than guessing "allowed
once" for everything it could not name.
Decisions() gains a kind per owner (tool_approval, recovery_approval)
because the kind is how a frontend routes an answer back to the call that
settles it, and the mapping is read off the entry's shape rather than a
label. The four Decision types the desktop re-declares by hand join
wire-parity: a field one side sends and the other cannot read is a card
left answerable over a decision already made.
Effect test at the boundary the frontend actually correlates on: while
the executor is parked, /status must project the same id the
approval_request announced.
go vet, make lint, repolint clean; pnpm typecheck/test (232) and build.
The panel now asks /studio/versions and /studio/pin over HTTP, so the two
Wails bindings behind it are gone rather than kept beside the routes.
Nothing but GoToVersion reaches window.go for a version any more, and the
old shell is the one that adapted -- which is what freezing it means.
Both shells state their own install. The Wails one resolves its layout the
way it always did; the Electron host takes -studio-version, because inside
that bundle the kernel's os.Executable() names the host binary rather than
the application, and a kernel left to guess would answer confidently and
wrongly. The layout stays empty there on purpose: reading a catalog needs
no install path, and inventing one is how a swap lands on the wrong bundle.
Driving the real Electron shell is what caught the identity trap.
app.getVersion() falls back to Electron's own version when the application
has none, so an unpackaged build reported current="44.1.0" -- a Studio that
never shipped, ranked ahead of every published release, with "newer" false
against a catalog it should have been behind. Only a packaged build names
a version now. An unpackaged one declares no install and the routes refuse
by name, which is the true answer for a build that is not a release.
Checked end to end against the real shell: the route answers 200 with the
live catalog when a version is declared, and studio.no_install when it is
not.
The version panel reached window.go.main.App.Versions, which exists in one
shell. GET /studio/versions and POST /studio/pin answer the same questions
over the transport both shells already speak, so the panel stops being a
thing only Wails can render.
What the kernel cannot work out, the shell states: HubOptions.Install
carries which build is running and where it lives. Inside a bundle
os.Executable() names the host binary rather than the application, so a
kernel left to resolve it would answer for the wrong thing -- confidently.
The routes are registered whether or not a shell declared one. Leaving
them off would have let /studio/versions fall through to the hub's default
runtime and answer 503 "no runtime open", which says nothing about the
question asked; studio.no_install says it. "Not a Studio" and "a catalog
that came back empty" are different answers and a panel that folds them
together offers to update a server with no application around it.
Hub splits into an inner form that takes its client, so the catalog can be
answered without a network. What is injectable is how the fetch travels,
never where it lands -- the URL stays a constant, and a test asserts every
fetch went to that constant and no other.
Three guards asked for the rest of the wiring, each covering a place this
would otherwise have gone quiet: the Wails shell's apiPrefixes (or the
route answers index.html), vite's dev proxy (same, under pnpm dev), and
both refusal catalogues (a code with no wording renders as itself). That
they all fired for two new routes is the evidence they are load-bearing.
SetDesktopPinnedVersion put the value on the config object and SaveTo
never wrote it out: the [desktop] renderer emits each neighbouring key by
hand -- close_behavior, tray, check_updates -- and this one was not among
them. So a machine held on an older build was free again by its next
launch, updated back off exactly the release the user had rolled back to,
which is the one thing pinning exists to prevent.
It is written only while held, the way external_opener is: an absent key
means "follow the catalog", and releasing a pin has to travel too or a
machine could never follow it again once held.
Found while testing a route that pins, not by reading the renderer. The
round trip is now a test, and removing the line again fails it.
The version panel lived in the Wails shell: what "newer", "pinned" and
"latest" mean, how the catalog is reached, which build is running. None of
that is a window's business, and a shell that holds it is a shell the next
one cannot inherit from -- the Electron host would have had to write the
same panel again in JavaScript against the same catalog.
update.Hub reads it in the kernel now, from an Install the shell hands in.
That is the part a kernel genuinely cannot work out: inside an Electron
bundle os.Executable() names the host binary rather than the application,
and the version is stamped into the process that spawned it. So the shell
states its identity and its layout, and the kernel decides everything that
follows from them. Layout was already a plain struct -- Here() is one way
to build it, not the only one -- so a shell that resolves its own bundle
reaches the same apply path without a second copy of it.
StudioCatalog is a constant rather than something the Install carries. A
catalog a shell could name is one that could be pointed at another line,
whose entries would offer to update Studio into a different product.
The Wails side keeps its bindings and becomes three lines behind them,
which is what freezing it is supposed to mean: the old shell adapts to the
new arrangement rather than the arrangement bending around it.
The guards move with what they guard. versionRows' tests are now the
kernel's, and the source-scanning check that every Options literal names a
catalog exists on both sides, because after this there are call sites in
both packages and a guard that watched only one would report clean while
the other read whatever it liked.
The same judgement existed three times: validateCLIUpgradeRedirect,
validateOfficialRedirect, and the update package's TrustedRedirect. The
first and third are line-for-line identical apart from an error prefix and
the name of the host predicate; the second is the same rules folded into
one condition. The third had never been wired to a client at all, which is
the shape this kind of duplication fails in -- a copy nobody is looking at
stops being maintained before anyone notices it stopped being called.
internal/redirectguard holds the mechanism: HTTPS only, no credentials, no
port, a hop limit, and a host list the caller names. ErrRefused gives the
refusal an identity so a caller tells one from a transport failure through
errors.Is rather than by reading the sentence.
The host lists stay apart on purpose. Which hosts a download trusts is
that path's own security decision, and that the CLI upgrade and the remote
CLI provisioner both name only GitHub is a fact about where we publish,
not one about them. Merged, a change to either would silently move the
other. Mechanism shared, policy separate.
The layering rule is what had made this impossible: it refused a leaf
importing anything under reasonix/, including another leaf, while its
stated intent is that a utility drags no dependency graph along. A closed
layer reaching inside itself drags nothing, and Go already refuses a cycle.
So the rule now says what it meant -- a leaf may import a leaf -- which is
a sharpening rather than a loosening, and releaseasset can share the guard
instead of keeping the copy the old rule forced it to keep.
redirectguard joins the sensitive list beside netclient: it decides which
host a download may land on, and a new security boundary outside that
governance is one nobody reviews. One declaration, both effects -- the
review gate and a coverage floor, recorded at 92.6%.
Three tests assembled their executor as &agent.Agent{}, and New is where
sink stops being nil -- it falls back to event.Discard. So the first thing
a seeded plan observed dereferenced that nil and panicked, failing
internal/control as a package.
That is what had been holding the coverage gate shut. covergate runs the
tests of every sensitive path, internal/control/approval.go is one of
them, and a package that exits 1 takes the whole gate down with it. A gate
that is always red is not a gate, and its floors stop at whatever they
read on the day it stopped running. With the panic gone they move to what
the code actually covers: sandbox 69.4 -> 73.5, shellparse 63.6 -> 64.5,
shellsafe 59.3 -> 61.1, approval.go 93.9 -> 94.3.
The fix is on the test side because a zero-value Agent is not a state
production reaches -- boot assembles one through New -- so this was a test
stepping around an invariant the constructor holds, not a gap the
constructor should have defended against. Adding a nil check would have
put one at each of the 71 places that dereference the sink today.
The Electron shell's host binary is built from the root module
(cmd/reasonix-studio-host), and Go's internal rule is about import paths,
not modules: nothing outside reasonix/desktop/ can ever import
reasonix/desktop/internal/update. So while the updater lived there, the
shell that is meant to replace Wails could not reach it at all -- not as a
thing to be written later, but as a thing the language forbids. Moving it
is a precondition for the crossing rather than tidying.
It moves whole because it was already independent: 44 files, zero imports
from the desktop module, and the only things it reaches for -- config,
fileutil, installlayout, repair -- are kernel packages it was already
importing across the boundary. The five desktop commands that use it keep
working, since reasonix/desktop/... may import reasonix/internal/...
The move surfaced TrustedRedirect as an orphan, and it is not dead code:
it is the CheckRedirect an update client must use, written with its own
comment saying a redirect could otherwise walk an authenticated download
onto another host, and never referenced. The shells assemble their client
from netclient, which sets no redirect policy, so every catalog read and
artifact download has been following redirects wherever they pointed.
Minisign verification is what stood between that and an installed
artifact, which is why this is a missing layer rather than an open door.
New now guards copies of the clients it is handed -- copies, because the
shells share one client with the rest of the app, and a caller that
already chose a policy keeps it. Recording that orphan in the baseline
instead would have filed an unwired security guard as debt, which is why
the wiring is in this commit rather than after it.
The baseline carries forward under -allow-widen: the repository totals
only tighten, and what enters internal/update is exactly what left
desktop/internal/update -- complexity 42, essay 3, function-size 180.
TrustedRedirect had no test either. It has one per field it reads, because
a guard checked only through one bad hostname would still pass after it
stopped reading the scheme. Checked against the live catalog too: eleven
published versions still resolve with the guard installed.
The previous commit listed SavePluginExport as blocking retirement on the
strength of it being a Wails binding with no Electron counterpart. That
reads the binding rather than the capability. The canonical path already
exists and every client but Wails already takes it: the kernel packs at
GET /plugins/{name}/export, the shell writes the bytes through saveBytes,
and internal/serve/plugins_test.go holds the packing half.
The binding is there because a WKWebView starts no download of its own and
that shell never implemented saveBytes -- a way around its own limitation,
not a semantic the other shell lacks. Which is exactly the distinction
section 7 asks for, applied to the wrong side the first time.
Checked against the real Electron shell rather than read off the source:
the endpoint answers, and the save panel opens over the window.
The picker was reached by feeling for window.go.main.App.PickWorkspace, so
the page knew which shell it was in for exactly one capability, and the
other shell had no picker at all. It is a HostPort verb now, answered three
ways: Electron opens a panel, Wails reaches the binding it already has, a
browser tab says null.
Which workspace the panel opens on is the kernel's answer, read through
/workspaces and handed to the shell, rather than something either shell
remembers. A shell that kept its own copy is the failure section 2 exists
to prevent, and the Wails side reaches the same value through the hub
because it can see it directly -- so it ignores the argument and needs no
change, which is what freezing it is supposed to mean.
createDirectory carries the half that was learned the hard way: a panel
that can only open what exists reads as an app that cannot start a project,
which is what the Wails picker was reported as before its options said
otherwise.
Three answers stay apart -- a path, "" for a dismissed panel, null for a
shell with no picker -- because a caller that folds the last two together
opens the panel twice. host_picker.test.ts holds that across all three
shells and is the first test to reach the bridge at all; a mutation that
hardcodes the starting folder fails it.
The panel blocks until answered, so nothing automated can read what it
returns. That it opens over the window was driven by hand against the real
shell, and smoke.js records the boundary rather than rounding it up.
The migration ledger was a commit behind: single instance was cleared by
"one Studio per data home" and never moved, and two blockers were missing
from it -- SavePluginExport, and the release line that still builds, signs
and notarizes a Wails bundle on three platforms.
mvdan.cc/sh v3.14.0 requires go 1.26.0, so the directive moves with it,
and the directive is what turns modernize's newexpr rule on across the
tree. The 75 findings are the price of this upgrade rather than debt it
inherited: lint reported 0 issues on the same tree one version back.
Inlining the pointer wrappers leaves nine of them with no caller, and
two different gates are needed to see that: unused catches the
unexported ones, repolint's orphan catches exported tool.IntPtr. The
//go:fix inline directives the fixer writes are dropped rather than
kept, because govet reads one as a demand to inline every call site --
which would delete names that carry meaning. provider.TemperaturePtr
tells an explicit 0 from "not set, use the provider default"; new(0.0)
at twelve call sites says neither. Keeping the new(v) body satisfies
modernize without spending the name.
Go: bubbles, bubbletea, lipgloss, x/ansi, lark, go-runewidth,
jsonschema, x/mod, x/net, sqlite, sh; wails 2.13 -> 2.15 in desktop.
Frontend: vite 8 on rolldown, typescript 7, plugin-react 6, vitest,
electron 44.1.0. Both lockfiles carry the linux and windows native
binaries, which CI installs and this machine never does.
Verified past every gate CI runs, plus the two it does not: the Electron
smoke against a real window, and Studio itself built and launched under
wails 2.15.
The boundary classification and the identity re-projection both landed
inside the loop body and pushed it past its size limit. Neither is loop
control: one settles what changed the conversation since the last request,
the other states a fact about the response that just ended.
A macOS self-update is three owners, not two: the old application
authorizes the handoff, the helper performs the swap, and the new
application proves itself healthy and retires the transaction. The
replacing process may perform the swap, but it may not declare the
replacement healthy.
The third owner was lost with the old shell. Nothing live called the
commit path, so a successful swap left pending-update.json and the
rollback bundle behind, and ensureNoPendingUpdate read that residue as
a legal transaction: the first self-update that worked refused every
one after it with "a pending update already exists".
UpdateHealthWitness is that owner, in one place. It reads the pending
transaction once at startup and carries no path or version of its own,
so a caller can only ever acknowledge the update it actually booted
from. The shell reads it before the window runs and acknowledges from
OnDomReady after the probation the old shell used: a build that paints
once and then dies is not evidence that the replacement works, and one
lost inside probation leaves the rollback material untouched.
The terminal tests replay the helper's success path against the real
state machine, so the fix cannot regress into the child clearing the
backup itself.
complete_step calls step_id PREFERRED, and the host has held one for every
item since plan projection. The model was never shown one. todoState never
rides in the prompt, todo_write answered with counts alone, and all three
list renderers printed bare ordinals — so the only place an id ever appeared
was the model's own todo_write arguments. A fold takes that out of view and
the id is gone from the conversation while the host still holds it.
What the model then cites is the ordinal it was shown, which is exactly the
citation that goes stale when a replan inserts a step above it.
evidence.TodoCitation is now the single rendering, used by todo_write's
result, complete_step's inventory, and both incomplete-todo prompts.
The fold carries the ids in its own output rather than leaving them to the
round after it. The request a fold feeds is frozen before that round exists,
so a sign-off sent in it could still only cite an ordinal — the same failure
this change exists to remove, reproduced once per compaction. A fold whose
kept tail still shows the ids appends nothing. Rewind and snip go through
Session.Rewrite instead and are re-projected at the next turn tail.
Compaction never calls Session.Rewrite — it installs a projection and leaves
the canonical transcript alone — so a rewrite-reason trigger would have
tested green against a signal the real fold path never emits.
Not covered, and separate: rebuildTodoState derives canonical todos from the
transcript's todo_write calls, so a resume after a fold that dropped them
starts with no canonical list at all. The identity does not survive there to
be projected.
A response cut at the output limit reached the model as "invalid arguments
for bash; it requires "command"". The host knew the cause — finish_reason
was length — but finishReasonMessage only ever emitted it to the sink, so
the model saw a downstream symptom and attributed it to its own formatting.
The lesson a real session drew from this was to stop batching independent
calls, which is the opposite of what the tree asks for and costs a round
per call.
classifyResponseBoundary runs before the assistant turn reaches the
conversation. A truncation can only have cut the last call, so that is the
only one it drops, and only when its arguments do not parse: earlier calls
were emitted whole and still execute, and a cut that landed after the last
call closed drops nothing. The dropped call neither runs nor enters history,
and the reason rides the turn tail as a host fact.
stopUnexecutedBoundaryCalls is not this: it fires on the round budget and
never reads the usage it is handed, and by the time it runs the assistant
turn is already committed.
malformedArgumentsDetail now quotes the bytes the parser stopped on with a
caret under them. An offset into a payload the model cannot see is what got
'>' blamed for a missing delimiter.
Dialing a machine, installing a kernel on it, holding the link and naming what
went wrong were all owned by the Wails shell. None of that is a window's
business, and the shell that had it is the one being retired — so Electron
could not open a remote workspace at all, while the protocol for the question
such a dial stops on was already canonical. That gap is what the ledger warned
about: making a capability canonical moves it out of one shell without putting
it into the other.
It moves whole rather than being copied. internal/remotehost is the standard
implementation of serve's RemoteAttacher, and both hosts now build the same
one from the same broker. The bridge from a blocked dial to a canonical
question moved with it, because that too was never a window's.
remotehost is classified as a host adapter rather than exempted from layering;
the layering ceiling remains zero. It implements a frontend's driven port and
is assembled only by hosts, which is a position the layer model had no name for
— so it has one now, and the naming carries its own constraint: nothing in the
kernel, the controller or the utility layer may reach a host adapter, and three
cases pin that alongside the two that allow it.
Cleared on the product chain, not on the protocol. A test drives everything but
the SSH: a workspace is opened on another machine over HTTP, the dial stops for
a host key, the client finds that question by polling the operation it named
itself, answers it, the open returns with a pane, and the pane's first frame
arrives through the hub's proxy from the far kernel. That is the whole of 5a
closing, end to end, and it is why the ledger's remote entry moves from blocker
to cleared.
The host is held to its own wiring the way the window is. Remote was missing
here for exactly the reason Tray went missing in the shell: an implementation
that exists and is never handed over costs nothing at compile time. Removing it
now fails a test that reads the options out of the syntax.
Two windows over one data home are two writers for every session file the
sidebar lists, and two writers on one transcript is what forks it into an
endless run of recovery copies. The Wails shell has kept that from happening
since it had a lock; the rule was written into that shell, so the other one
did not have it.
The identity moves out to internal/instanceid, where it is the thing it always
was: a canonicalized data home, not an application. The home is resolved from
an environment and a platform default the kernel owns, and canonicalized
through the same path the session lease uses, so an installed build, a portable
one and a canary find each other and a home reached through a link is the one
it points at. A shell asks for it — `-instance-id` prints it — rather than
working it out from things it does not resolve.
Electron's lock is the mechanism and not the rule. It keys on the profile
directory, so the profile is put under that identity; the platform then answers
"already running" for the same home and stays quiet for a different one,
without either question being asked in JavaScript. The app also names itself
now, because userData hangs off the app name and a name that depended on how
the process was launched put two launches of one install on two locks — which
is how this was found.
Verified against the real shell rather than reasoned about. A second launch
over the same home leaves on its own, and the window it could not open is
raised from wherever it went — hidden to the status icon included. The kernel
the first one is holding still answers afterwards, which is the property that
matters: the hazard was never the second window, it was the second writer. A
launch over another home is allowed to run. And a home whose holder was killed
outright can be opened again, because the lock belongs to the platform and goes
with the process — there is no file of ours left holding a home nobody is in.
The symlink case stays a Go test, where the canonicalization is.
The last commit made the question a remote dial stops for into canonical state,
and that is exactly the kind of result this ledger has to keep from being
misread. Nothing in Electron dials: the host supplies no Remote to its hub, so
attach, browse and probe are still Wails-only. Making the semantics shared moved
a capability out of one shell without putting it into the other, and a reader
counting "remote ask done" toward parity would retire Wails with its remote
workspaces going with it.
So the ledger is two lists now, and the retirement condition says the part that
was implicit: a protocol existing is not parity. The status icon's glyph and a
remembered window position cannot hold a retirement; a shell that cannot reach
another machine can.
A first-seen host key or a locked private key stops a dial until somebody
answers. That question lived on the Wails bus and came back through a binding,
so it was a shell capability rather than a thing the kernel held — and no
second shell could have it without holding a copy.
It is state now, and the shape came from measuring rather than from the sketch
this started as. Two facts decided it. There is no hub-level event stream: every
SSE in this tree belongs to a runtime, and a question raised during attach has
no runtime yet, because the runtime is what the attach is trying to produce.
And a dial runs under the request that asked for it — an experiment establishes
that for both entry points before anything is built on it. So a question cannot
outlive the client that raised it, which settles what a reload is allowed to
recover: nothing. The reload cancels the operation, an empty snapshot
afterwards is the correct answer, and a late reply is told the operation ended.
That leaves the snapshot as a discovery mechanism rather than a recovery one,
and there is nothing to discover except while a request this client started is
still waiting — which the client already knows. So it polls its own dial at
half a second and stops when the request settles. Building a hub event stream
for this would have added a permanent fact channel whose only subscriber is a
modal a person answers in seconds.
Three identities, because each rules out a different mistake. The epoch is the
kernel lifetime: a restart numbering a question the same must not accept a
reply written for the one before. The operation is which dial is blocked: two
at once are two questions, and a client polling its own must not be shown the
other's. The ask id is the question. An answer carries all three, and the
operation is named by the caller in a header because the question can arrive
before the response that would have carried a server-minted one.
Answering the same thing twice succeeds and answering something else does not.
A POST whose response was lost has to be safe to send again, and the client
cannot know whether the first one landed — so a settled question keeps what it
became for the rest of the launch. Cancelled is its own state rather than a
missing one: a client that hears "the operation ended" can stop, while one that
hears "no such question" has to guess whether it ever existed.
No compatibility adapter turned out to be needed. The bus existed because there
was no endpoint, and a plain GET is not what the asset server buffers — so both
shells poll the same route and answer through the same POST, and the bus
channel and its binding are gone rather than bridged.
Fixes a regression the commit before this one shipped: the window's hub was
built without the tray host, because the edit that was supposed to add it
silently matched nothing. Nothing failed at compile time, the settings panel
would have shown no icon section, and the tray menu's own switch would have
reached a nil host. Wired, and a test now reads the options out of the syntax
and fails when the window implements a capability it does not hand over.
A JSONL file does not say which definitions produced it, and samples are
comparable only while those hold still. Version 1 now names them and where
they live, so a change to any one is a version bump rather than an in-place
edit that leaves two months of samples silently incomparable.
The first corpus audits these definitions, not the agent. Whether the
text-identity fallback reports renames as replans is the question it has to
settle first, and now is the cheapest moment to find out: no execution
decision reads a progress revision yet.
What a strategy change bought is a question the transition stream already
answers, and answering it in a scratchpad after the first corpus arrives is
how the analysis logic ends up outside the tree again. --replan-episodes
writes one object per replan: where it happened, what resolved it, and what
was spent in between.
The resolution is read from the resolving transition's own kind, so terminal
is not folded into advance the way a progress revision folds them — "the plan
finished" and "the plan moved one step" are different answers. A rewrite does
not resolve anything, so restating the steps after changing them stays inside
the interval, which is precisely the interval worth measuring. An episode
still open when the sample ends is written as "end" rather than dropped: a
replan nothing ever followed is the case a survivor-only view loses, and it is
likely the most informative one.
Semantic samples only. The proxy source carries no replan verdict, so there is
nothing to segment on and inferring one would put a made-up classification
into a corpus meant to calibrate against real ones.
This is a segmentation, not a statistic. No rate is aggregated and no rate is
called healthy — and before any of them mean anything, a corpus has to settle
whether the text-identity fallback reports renames as replans. The README says
which ratio to look at first.
The analyzer that reads todo_progress back out of a trajectory was a scratch
script, which made it the one link in the chain with no way to fail. A field
rename in the kernel, the wire, or the renderer would have left it reading
every later session as having no semantic progress at all — and a corpus
collected across that change would mix two definitions in one quantile.
tools/trajectory/progress_corpus.py, standard library only, with the
distinction that matters carried as data rather than as a printed note:
progress_source and progress_fidelity are fields of every sample. The
semantic source is the todo_progress frame; the proxy source counts
complete_step calls, which is what an export predating that frame offers and
which overcounts, because a sign-off on an already complete step advances
nothing. --require-semantic refuses the downgrade, so a corpus meant to
calibrate policy cannot silently absorb a proxy sample.
Removing false advances can only merge adjacent gaps, so the proxy's maximum
gap is a lower bound on the semantic one; its quantiles and event counts are
not, and the README says which is which. On the session behind this work that
bound is 348.81M tokens and 739 minutes between two host-observed advances,
stated in resources rather than rounds.
The tool measures and does not judge: no verdict, no recommended budget, no
score. Reported numbers are descriptive.
A todo line that stops parsing raises rather than reading as absent, and CI
runs the tests, because the failure this guards against is exactly the silent
one that produced three missing-frame defects in a row.
Every rule here was demonstrated by a commit before it was written down, which
is the only reason to write it now rather than at the end: a constitution
drafted after the retirement would be an explanation of decisions already made.
The one that earns the document is the state taxonomy. Durable intent, a
projection, and state whose loss changes execution are three different things
carried three different ways, and deciding which one a capability is has to
come before deciding its API. The status icon supplied both easy cases in the
same commit — prefs in a file, a fold recomputed on every read — and a pending
question put to the user is the hard one, which is what the next commit has to
model.
Also written down: that retirement is atomic, and that what allows one is the
absence of exclusive semantics rather than the presence of a replacement.
Both came out of an attempt that this rule would have stopped — remote_pump.go
looked redundant against the hub's proxy until the page's own transport choice
said otherwise.
The ledger at the end is deliberately a ledger and not a plan. An item leaves
it when its behaviour is reproduced and checked at the layer where the old one
broke, not when something resembling it exists.
The tray was the last thing a shell could only do by being in the kernel's
process. Its settings were read and written through config.LoadForEdit from a
Wails binding, and its fold came off a Tracker the same process was feeding, so
a second shell could not have any of it without keeping a second copy. Three
routes end that: the prefs a person set, the fold the icon paints, and one
place that writes either.
The two are not the same kind of thing, and are carried differently on
purpose. Prefs are durable intent and live in the config file, so a write
answers with what it became and the caller applies that rather than waiting for
a poll. The fold is a projection of what the panes are doing — recomputed on
every read, losing one costs nothing the next read does not restore — so it is
pulled, and gets no id, no replay and no lifecycle. Promoting it to an event
would make a rendering detail into a fact the stream has to guarantee.
The fold arrives spelled out. The sentence and the three menu words are built
where the numbers and the catalogue both are, in the language the desktop is
set to, so a shell painting an icon does not also carry a second copy of the
formatting or a second answer for the language. The Wails tray now says its
line through the same function.
Backgrounding keeps the rule it had: no icon, no hiding. A window that vanished
with nothing left to bring it back is the one state this must never produce, so
the clamp lives with the write instead of in each shell, and the tray menu's
own switch runs the same call the settings panel does.
Electron's main process reaches these directly. A tray that asked the page for
its state would put the credential within reach of the page for no reason, and
would go blank the moment the window was hidden — which is exactly when the
icon is the only surface left. The close button reads a cached preference so it
never waits on a round trip, and still answers correctly once the kernel has
gone.
Held by the tests that would have let the old shape through: a hub with no
window registers none of these routes, so a browser tab reads the same null it
always did; a write round-trips through the file rather than through memory;
backgrounding is refused both when no icon is asked for and when this launch
has none; two reads of the fold answer differently, so an implementation that
cached it fails; and the endpoints sit behind the loopback boundary even under
auth_mode = "none", refusing an absent credential and an originless write.
The shell not owning the state is pinned by a check rather than by an
intention: the icon's line is held against a fresh read from the kernel, and
giving the tray a counter of its own turns it red at once —
{"icon":"Idle","kernel":"没有在跑的"}.
Also fixes a modernize finding left in the remote resume test by the commit
before this one.
todo_progress was emitted by the kernel, encoded onto the wire, and dropped
before the session log — so a reopened window and an exported trajectory
both showed a turn whose plan state never moved. Nothing else in the log
carries it: the task list rides the tool frames, but the verdict on what a
write did to it does not.
That is the third frame to go missing the same way, so the list stops being
the only statement. Every wire kind is now named by wireLogKinds or by
wireLogSkipped, and a test walks eventwire.KindNames() to fail the one that
is in neither. A frame left out on purpose reads as a decision; a frame left
out by omission no longer reads as anything at all.
The host held one fact about its task list: that it changed. A turn that
rewrote the same two steps every round therefore produced the same signal
as one that finished them, and the session behind this work spent twelve
hours and 1065 task-list writes at a fixed 22 completed steps.
ClassifyTodoTransition reads what a write did from the lists themselves —
which step identities exist, and which are complete. Identity is a stable
step_id where the list carries one and the normalized text where it does
not, never position, so an insertion does not rename every step after it.
Six verdicts follow, and three counters move independently: content for a
write, plan for a change of steps, progress for execution moving.
Replan is deliberately not advancement. Counting it as such would let a
stalled turn renew itself by rewriting its own list, which is the loop this
distinction exists to make visible. Renewal — a sign-off landing on a step
already complete — is named by advanceCanonicalTodo rather than by the
classifier: the list does not move, so no comparison of it could find one.
This records the distinction and nothing else. No gate reads the counters,
no prompt byte moves with them, and no call is refused because of one.
The verdict crosses the wire, because the last runaway could only be read
from an exported trajectory. eventwire and the desktop's hand-written
mirror both carry it, and both are now held to the kernel's shape by
wire-parity — which, added for this, immediately reported that PR 280dfd8c9
had introduced the same defect: the maintenance code and boundary existed
in the kernel, were declared by the desktop, and were dropped in between.
That is fixed here with the pairing that would have caught it.
advanceCanonicalTodo moves to todo_state.go, where the canonical list lives.
Four things the window can do and a page cannot, wired so the kernel looks
exactly as it did from the renderer: no endpoint added, no event kind added,
no change to what any request or stream carries.
A dropped file arrives as a path again. The renderer is handed a File and
never a location, and a turn that has to work on the file itself cannot do it
on a copy of the bytes, so the preload resolves it through webUtils and the
page feeds the result to the router it already had -- the same second channel
Wails reports on, arriving at once here rather than after a grace period.
Saving text and exporting a plugin package both go through the shell's own
dialog. The archive comes from the endpoint the browser build already uses, so
this adds a place to put the bytes rather than a way to produce them; the
anchor download stays for a tab, which is the only client that has one. A
dismissed dialog answers with an empty path, which is a decision rather than a
failure, and the caller can tell it apart from a shell that has no dialog at
all.
Notifications come back by reusing internal/notify against the shared
[notifications] setting. A window that announced turns the CLI would have kept
quiet about would be a second policy nobody set.
The port layer got the rest of its escapes back. saveText and openExternal
were reaching window.go.main.App from inside the transport, which is the same
thing the four window controls were doing before the last commit; both now ask
HostPort, and the Wails adapter is where its bindings are named. Nothing in
the app asks which shell it is in.
The drop is verified rather than reasoned about: the smoke run dispatches a
real drag carrying a real file at the browser's input layer and asserts the
page resolved it to that exact path, and that the window did not navigate to
it -- the default that replaces the app with whatever was dropped, with no way
back short of a reload.
The tray and close-to-background are not here, and not because they were
skipped. Their state is a Tracker fed by sink decoration and a job count read
off each controller, and their settings are read and written through
config.LoadForEdit; all of that lives in this process, and nothing on the wire
carries any of it. trayPrefs and setTrayPrefs are already AgentPort methods
that happen to be answered by a binding -- the same shape remote ask has, and
the same fix: they become protocol before they become a second shell's
feature. Building them on a preference store of this shell's own would give
two shells two answers for one setting.
TaskBudget has carried three axes since the round counters came down, and
run_budget.go calls the token one "the one that generalizes — a slow
expensive loop accumulates them and so does a fast empty one". It was the
only axis boot never mapped, and no key set it: the axis existed, was
enforced, and could not be turned on.
task_token_budget completes the set beside task_cost_budget and
task_time_budget_minutes, mapping to the same TaskBudget.Tokens that
exceeded() already reads. It ships off, like the other two.
What the axis counts is the reason it generalizes, so a test pins it:
usage.PromptTokens includes CacheHitTokens, so a round serving 159,900 of
its 160,000 prompt tokens from cache still accumulates 160,000. The session
that motivated this served 393M of 393.7M input tokens from cache at a
99.9% hit rate; scored on cache misses instead, any ceiling would have let
it run forever. Cost may account for cache pricing — tokens measure the
work the model did.
The budget spans a task, not a turn: a second test pins accumulation across
a continuation, because a ceiling the next user message reset would not
have bounded that session either.
This exposes the token axis TaskBudget already enforces and nothing more.
It does not choose a default execution ceiling or reintroduce
progress-based stopping.
Baseline widened by two lines: one field, one comment.
A pane that drops mid-turn comes back saying where it got to, and only the far
kernel can act on that. The point travels in a header the whole way, so a
proxy that dropped it would cost the reconnect every frame of the turn so far
-- and the loss would read as a quiet turn rather than as an error, which is
the one failure the numbering exists to make visible.
Two connections, because the point is per-request: a proxy that cached the
first would pass a single-connection test and lose every later resume. The far
side reads it with the kernel's own lastEventID, so what the proxy forwards is
held to the form that actually resumes a stream rather than to a header name.
It holds its connection open while the client reads, so the frame numbered
from that point is one that streamed through rather than one released when the
handler returned. Deleting the forward from the proxy fails it.
This was meant to be the evidence under deleting remote_pump.go, and it is
not, because that file turned out not to be redundant. The page decides its
transport by whether a Wails bus is on the window, not by whether a pane is
local: portFor builds the same SsePort for every pane, and subscribe takes the
bus branch for all of them. So inside that shell a remote pane's frames arrive
only through pumpRemoteEvents; the proxy's stream is what a page reaching
/rt/<id>/events over real HTTP gets, and the page in that shell never asks.
Removing it would have taken SSH workspaces down in the only shell that
currently has a tray, an updater and a single-instance lock.
What the test does establish is the condition for removing it later: the
resume cursor that file carries by hand is already carried by the proxy path,
proven rather than assumed. Its doc now says it retires with the bus rather
than before it, which is the same rule the rest of this migration runs on --
an implementation goes when it has no semantics of its own left, not when a
replacement exists somewhere.
A turn could be checkpointed once. After that the fold region ended at the
turn's first message and lastTurn refused a second attempt, so a turn long
enough to reach the boundary twice carried every round it ever ran: the
session that motivated this held 321K tokens across 2150 rounds inside one
of them, and the first fold could only reach the 30K that preceded it.
What a checkpoint may now reach is the turn's closed transactions. It ends
at closedPrefixEnd — the last point where every call the turn issued has
its result — so a transaction in flight is never split, and the request
that began the turn is held verbatim by keepIndexes rather than folded into
a digest. Both were what the old boundary protected by refusing everything.
lastTurn is gone. "Already folded this turn" was an implementation limit,
not a fact; the fact is whether a fold reaches history a checkpoint does
not already hold, which ContextProjection.CoveredCount already recorded.
Two conditions replace it: a region inside the installed projection is
no_new_closed_prefix, and one that adds less than a tail's worth of new
closed history is below the economics of paying for the prefix cache again.
Two ceilings stop ending runs on our own arithmetic. A fold that lands
above the trigger, and a generation blocked from folding again, both used
to fail the turn when the estimate exceeded the input ceiling. Only a
provider that has actually refused does that now — the estimate is ours,
the limit is theirs, and a window too small to summarize one turn was
failing runs the provider would have served.
TestCacheHitSurvivesTooSmallWindow measured a fold count against a
mechanism that allowed one per turn. Under a 900-token window the new
behaviour folds four times over thirty rounds and ends at 1577 prompt
tokens where it previously folded twice and ended at 2069 — fewer tokens
carried, more cache rebuilt, tail hit rate 94% against 96%. The bound is
now a fraction of the step count, which is what "not after every tool
result" meant; the tail-rate assertion that judges recovery is unchanged.
Repeated checkpoints bound provider-visible context growth inside a long
active turn. They do not decide whether that turn is still making progress
or should continue executing.
Chromium runs the page now. The shell spawns the kernel, reads one line of
handshake, arms the credential and loads the window from the origin it was
given -- the same frontend-next build the Wails shell serves, over the same
hub, through the gate the last two commits put in front of it.
The page lands on /_studio/. Vite already builds with base "./" while every
call to the kernel is an absolute path, so one prefix test routes the whole
thing: the page owns its namespace and the hub keeps the root. The inverse --
knowing every route the kernel has, so the rest can fall through to the page
-- is what the asset server forced, and it has to be edited every time the
kernel grows an endpoint. Nothing here needs editing again.
The two pipes carry the two halves of the relationship. stdout is protocol:
one versioned JSON line, and a parent that does not recognise the version
refuses the launch rather than reading past it. Every log goes to stderr, so
nothing can appear ahead of the line the parent is parsing. stdin is the
lease: the kernel drains when the parent's end closes, which covers a parent
that crashed as well as one that quit, on all three platforms, with no signal
involved. Only a pipe counts -- a terminal would never end and /dev/null would
end at once, taking the host with it.
The credential is set on the session before anything is loaded, or the first
request answers 403 and the window opens on a refusal. HttpOnly because
nothing in the page reads it, Strict because no cross-site navigation carries
it, host-only and unexpiring so it dies with the launch. The renderer is
sandboxed with context isolation and no node, and the preload hands over verbs
only: the credential never crosses it, and neither does the origin.
Which shell the page is in stops being something it works out for itself. The
four window controls had been reaching window.go.main.App directly, past the
port layer, and the entry point probed the Wails runtime to decide what the
chrome should look like. Both now ask HostPort, which also answers whether the
window draws its own title bar -- the shell knows how it created its window,
and the page was deriving it from a platform. The CSS follows: keyed on that
property rather than on a shell's name, and emitting both drag spellings,
since --wails-draggable and -webkit-app-region are different mechanisms that
ignore each other. openExternal moves there too, because denying window.open
without it would have left every link in the window dead.
Verified against the real thing, not a template: 25 checks drive the shell the
smoke test boots, and the page reports back that it loaded from 127.0.0.1 on
/_studio/, that the bridge holds eight verbs and no secret, that
document.cookie cannot see the credential, that require, process and module
are all undefined, that React mounted, and that a fetch to /status comes back
as the kernel's JSON. Navigation off the origin is refused, a second window is
never opened, the window fits its display, and an editing command reaches the
focused field.
The hop a test cannot reach was accepted by hand instead, driven at the OS
event layer rather than through Electron's own injection -- MenuItem.click()
runs the JS handler a role does not have, and sendInputEvent lands below the
dispatch that consults the menu. Select All, Copy, Paste, Cut, Undo and Redo
all behave on a real field, and a real secondary click pops this shell's
context menu with Undo and Redo greyed and the rest live: its Copy reaches
the system pasteboard and its Paste reaches the field.
What that does not show is any dependence on the application menu. With the
menu removed, Chromium 152 still serves all six shortcuts, so no causal claim
is made for it here. It stays because a macOS window is expected to carry one,
not because this build was measured needing it. The smoke run says where the
automated part stops.
Deliberately still Wails': the tray, close-to-background, single instance, the
updater, version pinning, plugin export, remote prompts, dropped file paths,
and the shadow event bus. Deleting those before two shells have run the same
frontend would be deleting them on an argument rather than on evidence.
complete_step ended every sign-off with "The host advanced the task list;
continue with the next step", which it asserted without knowing whether a
step remained. The host had already advanced the list and knew the answer;
the tool result — the only part the model reads — did not carry it. #8816
is that turn: the final todo completed, the result still asked for the next
step, the model invented one, and the turn did not end.
The verdict now comes from the task list. planAdvanceAfter replays
evidence.AdvanceSerialTodo on a copy of the same list verifyTodoStep
matched against, so what the result says and what the list does cannot
drift — the alternative was a second implementation of the state machine,
which is the drift. A remaining step is named; none leaves "Every step in
the task list is now complete. Do not open new work under this plan."
Two layers, because the host being right about its own state was never the
problem: the tool unit test covers mid-plan, final, and renewal sign-offs,
and an end-to-end turn asserts what actually lands on the transcript. A
third pins the resume path — a rebuilt finished plan must not come back
with a current item (#8089).
Not done here: a finished plan can still be reopened by an ordinary
todo_write. Refusing that needs somewhere for genuinely owed work to go —
a host-issued obligation — and a refusal without one is the completion
deadlock in the other direction.
Compaction was not broken. It faithfully executed a policy that only knew
one boundary: compact_ratio of the declared window. A provider preset
declaring a 1,000,000-token window therefore put the trigger at 850,000,
and a real session ran 2,150 rounds against a prompt that peaked at
321,265 — 37.8% of the budget, so maintenance was never once attempted.
input avg round latency
86K 12.18s
130K 15.16s
158K 20.25s
195K 28.17s
226K 30.28s
314K 37.91s
Capacity and economics are different boundaries. A model may support a 1M
context without making a 300K prompt economical to replay for hundreds of
agent rounds, so the automatic trigger is now whichever is reached first:
compact_ratio of the window, or context_soft_limit_tokens of visible input
(default 160000, negative disables). The verbatim tail follows the boundary
in force — a tail that reaches the trigger leaves nothing to fold, which
would have made the new boundary fire against a prompt it could not reduce.
A ratio placed past the window stays how automatic maintenance is turned
off: economics tightens a live boundary and never revives a retired one, so
an existing compact_ratio = 2 keeps meaning what it meant.
Every attempt now says what it decided. A no-fold verdict carries a code
rather than a sentence, because "already folded this turn" and "nothing
left to fold" read alike and mean opposite things about what the next round
can expect. The verdict reached while a turn is running was previously
returned silently, which is why the trajectory of that 15.6-hour session
cannot say whether maintenance was tried; it now emits once per turn per
reason, writes no receipt and blocks nothing.
This does not make long active turns repeatedly compactable. It makes the
first economic maintenance attempt observable; repeated same-turn
maintenance remains intentionally blocked, and
TestSecondMaintenanceInOneTurnReportsAlreadyCompacted is the regression
test that keeps that fact visible.
Three comments promising an adaptive stop that 21638e356 removed are
corrected to say what actually bounds a turn today: nothing, by default.
Baseline widened by three lines — the floor price of one config setting
(field, one-line comment, render line).
golang.org/x/crypto v0.54.0 does not enforce the source-address critical
option for non-public-key auth callbacks in its ssh package. govulncheck
traces the call through sshtest.Server.handleConn, so the scan fails on
every branch until both modules move to v0.55.0.
The kernel registers POST /plan-decision and sse.ts calls it, but neither
the shell's API table nor the dev proxy learned about it, so the endpoint
answered with index.html instead of JSON: plan decisions did nothing in the
desktop app, and `pnpm dev` against a live kernel behaved the same way.
/plan is not a prefix that covers it — both tables match the whole path
segment, which is what the three parity tests check.
The kernel has only ever reached Studio through the Wails asset server, as
in-process middleware. This is the first host that puts the whole hub on a
socket: panes, routes and event streams over ordinary HTTP, reachable by
anything that can speak it, which is what a renderer in its own process
needs and what the asset server cannot give. It also drops the one thing
that transport forced -- a response held until its handler returns, so
GET /events never delivered a byte inside the shell -- and with it the
reason the bus and its manual replay exist.
The startup order is the boundary. The socket binds first, because nothing
can name the origin until the kernel owns a port; the credential is minted
from crypto/rand at that moment, never read and never persisted, so no
configuration reaches it; the gate is built from both and wrapped around
hub.Handler() rather than into it, leaving the hub's own auth and CSRF
middleware exactly as they were.
That last part turned out to be load-bearing. Both gates read one cookie,
so a user with auth_mode = "token" in their serve config would have had the
hub refuse this launch's credential on every request -- 401, everything,
forever. hostServeConfig hands the hub the user's serve settings with the
authentication taken out, because Studio's boundary is the loopback gate
and two gates cannot own one cookie. Forwarded headers go with it: this
boundary decides on the address it was reached at, never on a claim about
it. Studio's security policy is not the user's serve policy, and the test
that says so is a regression gate rather than a sentence in a comment.
The handshake goes down the parent's pipe as one JSON line. A file or an
environment variable would outlive the launch and be readable by more than
the process that spawned it.
Serving reuses the hub's own drain rather than reimplementing it, which is
what RunGracefulHandler is for: a host that must wrap the handler should
not have to rewrite the shutdown to do it. The socket is released before
the panes are torn down, so nothing answers a live request with a
half-closed kernel.
Seven gates hold it, all against a real listener and a real hub: loopback
only, a fresh credential per launch, auth_mode = "none" still refusing,
the configured serve token refused while the launch credential works, a
read and a turn both reaching the kernel, the stream still flushing, and
the port refusing connections once the drain returns. Four are
mutation-checked. The binary was also driven by hand: a real boot answers
/status at 200, refuses an absent credential, a rebound Host, a foreign
Origin and an originless write, and opens the stream immediately.
Nothing renders yet -- no static assets are served here on purpose. "API
is a growing whitelist, everything else is the page" is the shape the
asset server forced, and repeating it in a real mux would carry the tax
across the move. Where the page lands is its own decision.
The three exported functions the previous commit left with only test
callers are now called by this host, and the orphan ratchet is back where
it was.
Studio's API has never been on a socket. The Wails asset server mounts
hub.Handler() as in-process middleware -- no port, no CORS, no second
transport -- and a renderer living in its own process cannot reach that.
Moving the shell puts the whole control plane behind a real listener for
the first time: /submit, /approve, /tool-approval-mode, /sandbox and
/permissions, on a port any local process can open a socket to, with
ServeConfig.AuthMode defaulting to "none".
NewLoopbackGate is the boundary that has to exist before that listener
does. Its policy comes from the host that opened the listener and never
from configuration, so nothing a user can edit turns it off: a request
must be addressed to this listener, must name this listener as its origin
to change anything, and must carry the credential minted for this launch.
A read may still arrive without an origin, because a top-level navigation
sends none; a mutation may not, so an originless POST is refused rather
than left to the credential alone. Checks run outermost first, so a caller
that reached the socket under another name learns nothing about the
credential it did not have to present. Each refusal carries its own code
because the invariants are independent -- a test that only sees "rejected"
cannot tell a rebinding defense that held from a credential check that
answered first -- and all four are mutation-checked rather than assumed.
Cookie only. The query token the web gate also accepts would put the
credential into request lines, history and referrers; the host sets
TokenCookie itself instead, so it never reaches the page's JavaScript.
setAuthCookie's Lax policy is deliberately untouched: web serve's login
semantics do not move for this, and a host that sets the cookie itself
chooses its own SameSite. ListenLoopback is spelled out rather than ":0"
or "localhost:0" so no caller can widen the socket to a wildcard address
or to a name a resolver gets to answer for.
The gate never decorates the ResponseWriter. /events asserts http.Flusher
on it, and a wrapper that dropped Flush would turn every stream into a
response the page sees only once the turn is over -- so the resume test
drives a real listener and a real kernel, disconnects mid-stream and comes
back with Last-Event-ID, rather than asserting a header was forwarded.
Nothing calls it yet; the host that opens the listener follows. Until it
lands the orphan ratchet reads three exported functions with only test
callers, and the baseline is not widened to hide that.
The profile's allow-default second line leaves Apple Events and
Mach-service lookup undenied, and the probes that would have settled
whether a delegation reaches outside the sandbox were inconclusive rather
than blocked. Recording it as undenied-and-unmeasured keeps two readings
out of the tree: that no deny rule means an escape exists, and that an
inconclusive probe means the sandbox stopped it.
It is outside the governed endpoint set, so it does not reopen the
authority work -- the claim was written narrowly enough to survive it.
The evidence is that one dimension's enforcement cannot be assumed to
cover another -- a write restriction is not confidentiality, a read
restriction is not authority, a network restriction is not authority.
That supports modelling them apart; it is not the pairwise independence
proof the previous wording could be read as claiming. Integrity also
predates this round, so "each became necessary after a measured bypass"
overstated the history.
HostProtected was one word covering three independent things, and this
round found each of them by measuring a bypass of another: a read deny on
a socket did not stop a connect, and a private key was unreadable while
the agent signed with it anyway.
Expressed by, not held by: a config field states an intent, a backend
primitive plus its evidence is what holds a claim. That distinction is
the whole point of the closing sentence -- three false-assurance bugs in
this round (an absent directory reading as a denial, a truncated probe
reading as over-blocking, a single-GOOS lint reading as clean) cost more
than any missing protection did.
CI's lint runs golangci-lint for linux, darwin and windows; a local run
only covers the host, so `grantedAuthorityEndpoints is unused` surfaced
only after the push. Re-granting after a blanket denial is a Seatbelt
need -- SBPL takes the last match -- while --unshare-net never touched
pathname sockets, so Linux has nothing to re-grant. The helper now lives
with the backend that needs it, and endpoint resolution moved behind
!windows where a backend exists to act on it.
Also adds the two attacks the authority contract rests on, each with the
control that proves the probe can see anything at all:
Provenance: a repository .env sets DOCKER_HOST and SSH_AUTH_SOCK to a
socket it owns. If the resolver followed it, granting "docker" would
grant an arbitrary host socket instead of the daemon. The host endpoint
must still appear in the generated argv (or the test proves nothing) and
the attacker's must not.
Inheritance: a connection opened before the sandbox starts is already
past every rule about opening one. The scan is validated unconfined with
the descriptor handed over deliberately, then must come back empty from
the confined process.
`network` was carrying two unrelated capabilities. Measured on Seatbelt:
`(deny network*)` blocks Unix sockets too, so a user who turned off egress
also lost ssh-agent -- `ssh-add -l` and SSH-signed commits stop working,
neither of which needs the internet. In the other direction the default
`network = true` handed every command the host's agent socket, and a probe
confirmed what that is worth: with the private key deleted from disk, a
confined shell still got the host agent to produce a valid signature.
Denying the read (ForbidReadRoots) does nothing about it, because
possession of a key and the authority to use it are different things.
Spec now carries HostAuthorities alongside Network. Policy names services,
not paths: each backend resolves ssh_agent/docker/podman the way their own
clients do (SSH_AUTH_SOCK, DOCKER_HOST, XDG_RUNTIME_DIR), so a non-default
daemon is governed rather than quietly ungoverned, and Windows can satisfy
the same contract without owning a Unix socket. macOS masks with
network-outbound rules ordered deny-then-grant, since SBPL takes the last
match and a grant has to survive a blanket denial. Linux binds /dev/null
over the endpoint, last, so no later mount re-exposes it; --unshare-net
misses pathname sockets and --unshare-ipc is the wrong tool entirely.
Default grants ssh_agent and nothing else: signing is routine in a coding
workflow, a container daemon socket is host-wide execution. The zero Spec
grants nothing, so a new call site is confined until it says otherwise --
which is why MCP servers now get no host authority. The key is user-global
like [secrets]: a cloned repo must not grant itself the docker socket.
The acceptance matrix is the point, and its third row decides whether the
axes really came apart: egress denied while the agent still answers. Also
pinned: the governed set is three named endpoints. DBus, Wayland, X11,
gpg-agent, keyrings and arbitrary sockets remain reachable, so the claim
is "these endpoints are governed", never "host IPC is isolated".
Linux CI failed the two positive cases and the opt-out control: bubblewrap
swaps /tmp for a fresh tmpfs, so a t.TempDir() HOME does not exist inside
the sandbox at all. The deny assertions had been passing there for the
wrong reason -- the secret was absent because the whole directory was,
not because anything denied the read.
The fake HOME now sits under the bound write root, and homeIsVisible
asserts a plain file in it is readable before any denial is asserted, so
this failure mode reports itself instead of reading as a pass. The
credential file living inside a writable root also makes the test
stricter: the deny has to beat an allow, not just an absence.
Only the negative control caught this. A deny-side suite without one
cannot tell "blocked" from "not there".
read_file refused ~/.ssh/id_ed25519 while `cat` returned it. The
credential denylist reached only the in-process readers and never
sandbox.Spec.ForbidReadRoots, so the OS boundary let every shell command
through -- including `cp`, `tar` and any interpreter, which is why this
cannot be patched in the command classifier. Egress is on by default and
the auto approval posture allows both halves, so the read and the POST
that follows it needed no prompt.
internal/secrets now owns the one list both consumers read. Files holding
secret bytes and nothing else (SSH private keys, ~/.aws/credentials,
~/.netrc, ~/.git-credentials, ~/.pypirc, gcloud ADC) are denied by
default. Files that mix configuration into the secret are deliberately
absent, measured rather than assumed: denying ~/.config/gh/hosts.yml
fails every gh invocation at startup, and denying ~/.npmrc silently
relocates npm's global prefix. Separating those needs a broker, not a
wider denylist.
The ~/.ssh rule is written as an exception list because private keys take
user-chosen names; id_* would miss work_github. Public keys, config and
known_hosts stay readable.
[secrets] protect_credential_files = false opts out.
Establishes the host-owned state the verification-authority design needs, and
nothing else. A Goal freezes the project declaration its process read into a
contract with a generation, the checkpoint carries it, and a resume restores the
same generation and the same criteria while the current declaration reloads
independently. Where the two differ the host records one observation.
Shadow only. Readiness is untouched, no obligation is raised, nothing is
superseded, missingProjectChecks still reads what it read, and the agent gains
no capability. Which declaration governs is the decision this state exists to
make possible later, and this commit deliberately does not make it.
The contract is not a wrapper over BaselineChecks. It is produced at Goal
creation from the declaration this process loaded, while the baseline is
captured per turn by the executor, and the two now travel side by side rather
than one standing in for the other. Keeping them apart exposed a real ordering
bug: the executor rebuilds its checkpoint from the scope id alone, so letting
its report write the contract field cleared what the Goal had frozen. The Goal
owns the acceptance; a progress report cannot clear it.
A checkpoint written before contracts existed carries none, and none is
invented from the current declaration — backfilling would manufacture an
acceptance nobody made, so those resumes are simply not observed.
Epoch is frozen at one and never incremented. Superseding a contract is the
transition the design reserves for an explicit host action, and storing a
generation is a different problem from changing one.
The drift observation says only that the two declarations differ. It does not
say the frozen contract should be kept, that the current one supersedes it, or
that the Goal should be blocked — the three readings this line has already been
burned by inventing.
Reachability is settled, so the question is no longer whether the divergent
state happens but who decides what it means. A Goal frozen under one criterion
and resumed against a different declaration is a state both current
implementations answer by guessing: the gate forgets the original, the
obligation derivation demands both, and neither is entitled to, because the
same state comes from an agent retiring the criterion it is being held to and
from an owner changing project policy between runs, and nothing durable tells
them apart.
Four rules instead. A Goal owns a frozen verification contract. A workspace
declaration change does not move an active Goal's authority. A divergence is an
unresolved authority conflict rather than an automatic union of obligations.
Only an explicit host-owned rebase supersedes, and superseding does not satisfy
the replacement — the rule this repository already holds elsewhere.
The provenance problem becomes a capability one. Deciding by who edited the file
fails on IDE edits, checkouts, background writers and crashes; the line that
holds without knowing any of that is that write permission on a file is not
write permission on authority. An owner who wants a running Goal judged
differently takes the explicit action, and the agent gets no such capability at
all.
Nothing is implemented. The document records what is deliberately not decided —
a merge state, promoting ObligationBaselineCheck to final authority, and the
cutover proposed on the premise that has since been corrected — and names the
tests that follow, including that a fix which turns the bypass into a deadlock
is not a fix.
A goal turn captures the criterion its process read and persists it with the
goal's state. Resuming that goal in a process whose declaration names a
different command restores the first criterion into the second process: the
baseline the task is held to and the declaration the gate reads are then
different commands, reached with no field assigned by hand. The two agents are
constructed the way two boots construct them, from two different declarations,
and the restore is the controller's own resume path.
This settles the question the corpus could not. Inside one process the baseline
is captured from the same list the gate reads, and plain --continue carries no
goal so it restores nothing — both disproven on real runs. The goal sidecar was
the last candidate producer and it holds.
What is established is an external declaration change between goal executions:
the second process was built from a different declaration, not shown inheriting
one the agent had rewritten. The benchmark showed an agent rewriting the file
and the rewrite surviving to the next process; joining the two is plausible and
is not what this test proves. The distinction decides the semantics — an agent
retiring the criterion it is being held to is what baseline protection exists
for, while an owner changing project policy between runs may have superseded it
deliberately — so it stays separate until something demonstrates it.
Reachability work stops here. What opens instead is the authority question,
which is not the migration that was proposed before it: preserving every
historical baseline forever is only correct for one of the two provenances.
Two runs, both parity. Single segment: the agent rewrote its own verify line and
ran only the replacement, and the gate went on naming the criterion loaded at
boot while citing the file it had already stopped matching. Two segments across
a real process boundary: leg two resumed, edited, ran only the new check and
finalized allowed, because the baseline did not survive the restart — it was
captured again from the declaration leg two had just read.
The chain breaks at its first link, so every claim after it goes too. There is
no demonstrated production path to a state where baseline and current differ,
and without one the cutover has no defect to justify it.
What is left is narrower than what was claimed and is not tested here.
DeliveryCheckpoint carries BaselineChecks and is persisted with goal state, the
restore seeds a rebuilt executor, and the turn loop clears the checkpoint only
when the scope id changes — so a Goal surviving a restart across a changed
declaration would hold the old baseline against a freshly loaded current one.
Goal is user-reachable and e2ebench cannot drive it, which makes that a
controller-level test rather than more corpus.
The corpus keeps its value by having falsified the premise it was built to
measure, on its first execution and again across a restart.
The project-check study reported a bypass as reproducible on the strength of a
test that assigned a private field. The field is written once at boot and never
again, so no run inside one process reaches that state, and the corpus said so
the first time it executed: parity, no divergence. The test proves a conditional
mechanism given the state; that is a different claim from a production defect,
and only the second earns priority.
So a destructive test now owes six lines before it is written up as something to
fix — who produces the state, through which transitions, across which
persistence boundary, under whose authority, and whether a real run has been
seen in it. Severity is reachability times frequency times authority, not
whether something can be bypassed.
Authority is in the contract because the same divergence can mean opposite
things. An agent that rewrote the criterion it was being held to is what
baseline protection exists for; an owner who changed the project's policy
between two runs may have superseded it on purpose. A study that cannot say
which it observed cannot say what the right behaviour is.
The segmented probe that motivated this is in the corpus: leg one blocked on the
gate still demanding the criterion loaded at boot, which is the same finding
from the other side — the declaration on disk had already changed and the gate
had not noticed.
Cache-impact: one rule added to REASONIX.md, which is in the stable prefix.
benchmarks/e2e declares no project checks anywhere, so the gate has zero
exposure there and no amount of running it accumulates evidence. Seven
fixed-shape tasks cover what the two derivations can disagree about: a stable
declaration, one never run, one replaced, one replaced and both run, one spelled
differently, a write after the check, and a second requirement added beside the
first. Together they pin that an old requirement cannot be deleted, a new one
cannot be missed, and a proven one can actually be discharged — the last because
a bypass fixed into a deadlock is not fixed.
The expectations live in the corpus README and nowhere else. verify.sh asserts
the production change only: a harness that also knew which class a task should
produce would fail in step with the classifier it exists to check.
The first run corrects the premise. project-check-rewrite made the agent rewrite
its own verify line and run only the replacement, and the probe recorded parity,
no divergence — because projectChecks is read once at boot and never reassigned,
so the baseline is captured from the same list the gate reads and the two cannot
differ inside a process. The rewrite branch of checkObligations is unreachable
there, and the claim that this bypass reproduces end to end was wrong.
What the destructive test proves is the mechanism given that state, and its
comments now say so. Reaching the state needs a process boundary: a goal
checkpoint restored with the old baseline into a build that read the new
declaration. e2ebench -segments is that shape, and whether a real run reaches it
is still unproven.
The subagent handoff line is resolved for the evidence there is. Protocol
salience and closure behaviour were never defective: every judged child
reported, and nothing followed a real closure in either arm. What was defective
was the host's vocabulary, which answered a lowered claim and an intact one with
the same word, and that is fixed. Structural terminal enforcement is recorded as
unjustified rather than pending — it would be a defensive invariant, and the
case for it has to be made on delivery risk, not on this data.
The discipline is the study's other output. Three mechanism explanations died
the same way: a command of unknown extent counted as a proven write, one child's
latest adjudication read as every report's, and a syntactically accepted call
read as a closed one. Each was a convenient proxy standing in for the state the
metric was named after, and each produced a confident wrong story. The rule now
sits beside the other judgement rules, and the four-line contract a metric owes
before it becomes a finding sits in the benchmark README with the five
substitutions that caused these.
Cache-impact: REASONIX.md is in the stable prefix, so this adds one rule to it
and no session carries a different prefix mid-run.
The barrier analyzer anchored on "complete_subtask accepted", which the verdict
change removed, so it would have reported no children at all. It now reads both
vocabularies and anchors on the same thing in each: the host saying the sub-task
is done. In the arm that had one word for both outcomes, an accepted report with
no lowered claim is that moment.
Re-anchoring changes what the control says. Nothing follows the first closure in
14 of 14 control children, and nothing follows it in 17 of 17 treatment children.
Tool calls after closure were never the problem: the model already stopped when
the host said done. The earlier reading came from anchoring on the first
well-formed call, which is not the same event as the first closure — the host had
answered both with the same word, and the analysis inherited the conflation.
What the treatment bought is therefore not a behaviour change, and the record
says so. Closure is now exactly one identifiable event per child, counted in the
audit instead of recoverable only from a trajectory, and needs_work produces real
work: across 21 verdicts, only 2 were resubmitted with nothing done in between.
Recovery attribution earns its commit here: all 29 repairs were
missing_reasoning_model_silent, 14 inside children, so host recovery is not what
drove the continuations. That is now evidence rather than an assumption.
complete_subtask answered both outcomes with "accepted". A report the host
could back and one whose claims it had just lowered returned the same word,
and the difference was left in a trailing sentence. The replay showed what the
child does with that: first report downgraded and it kept working, 10 of 10;
first report intact and it stopped, 4 of 4, with no exceptions either way. The
model was reading the verdict correctly out of prose the host never committed
to as a state.
So the verdict is said as one. A report with nothing lowered closes: the
sub-task is done and nothing further is asked. A report holding a claim the
host cannot back returns needs_work, naming that the work is what is missing.
Three layers stay apart, which is what the single word fused: a malformed
submission still fails the call, a verdict is a successful call, and neither
ends the run — no barrier is added here.
The contract loses "exactly once, as your final tool call". It was falsified
before it was written down: a host that answers a lowered claim by asking for
the work again cannot also be obeyed by a child that calls once. What replaces
it describes the loop that actually exists, and the test that pinned the old
sentence now pins both verdicts instead.
Verdicts are counted when issued, not recomputed afterwards. The ledger grows
during a run, so a claim it could not back at the time may be backed by the
end, and re-adjudicating an early report answers a different question than the
one the child was answering.
Cache-impact: the contract rides the child's task prompt, not the stable
prefix; no parent prefix, tool schema or memory text changes.
Extracts the background-lease methods out of evidence.go rather than widening
its file-size budget for one struct field.
A repair recorded during a delegated run was indistinguishable from one in the
parent's own loop, so "the child kept working" and "the host pulled the child
back" read the same. That distinction now decides an experiment: the next arm
asks whether a child continues on its own after a host verdict, and an
unattributed recovery would let the host's own intervention be counted as the
model's behaviour.
The identity is stamped where it is known rather than threaded to where it is
not. Every producer runs inside the child's loop holding no id; the nesting
sink already re-parents that run's tool events, so it stamps this too. A
parent-loop repair passes through no such sink and keeps an empty ChildID,
which is the honest reading rather than a default.
No semantics change: the same repairs happen at the same points, and nothing
reads the new field to decide anything. The trajectory keeps it per record and
the flat metrics count child repairs apart from the parent's.
The test drives the assertion through the stack a child actually emits into,
because that stack is where audits were being dropped whole two commits ago and
a conformance check would not have noticed.
A new offline mode answers one question against already-recorded runs: if a
child's first accepted complete_subtask had closed it, what work would that
have suppressed. It spends no tokens and changes no runtime behaviour, and it
classifies with the host's own readers rather than a second reading of the same
commands — ToolCallMutationClass and CommandRunsVerification, with verification
tested first because a command whose extent the host cannot establish already
classes as a mutation, and a check is exactly such a command. MutationProven
and MutationUnknown stay apart: reading them as one turned four real writes
into eight, which is the answer this study exists to get right.
The result rejects the barrier. Of 14 children with an accepted report, 1 wrote
a named path afterwards and 7 ran commands of unestablished extent; only 4 did
nothing further. The 47 post-report bash calls are mostly ad-hoc assertions and
inspection that CommandRunsVerification does not recognise as checks, so the
opaque bucket bounds unclassified work rather than claiming it mutated.
What it found instead is that the host asks for the continuation. First-report
adjudication and continued work separate perfectly across all 14: every child
whose first report had claims lowered kept working, every child whose report
stood intact stopped. complete_subtask answers a lowered report with "accepted
... run the check or cite what you really did" while the appended contract says
to call it exactly once as the final tool call. The child follows the later and
more specific instruction. The gap is not a contract without enforcement — it
is an adjudication that is not a state, since a lowered report and an intact
one both return "accepted".
The research record is corrected in the same commit. Its HostDowngrade 0/14 was
read off the handoff audit, which adjudicates only a child's latest report; over
all 39 accepted calls, 25 were adjudicated partial and carried lowered claims.
Extracts the offline-mode dispatch out of main rather than widening its
function-size budget for one more case.
missingReview counted two things that are read from different indices and
settled by different work: a structured review of the change set, and the
turn's own inspection of every file it wrote. reviewGateFailure raises the
first from UnreviewedMutationBaseline and exempts sub-agents; the second comes
from UninspectedWritePaths and applies wherever a delivery turn mutated. A
report reading "missingReview = 3" could not say which was owed, so it could
not say whether the fix was a review report or a read.
The aggregate is removed rather than kept beside the split. It has no producer
of its own and no consumer that needs the fused shape, and reconstructing it
would be a second derivation of a number nobody asked for.
No behaviour changes. The gate raises the same debts on the same turns and the
reason text is untouched; only the audit vocabulary and the missing-id list
move, and the two control decisions that read that list test it for emptiness,
which a split cannot alter.
One assertion changed meaning rather than shape:
TestDeliveryProfileRequiresReviewBeforeFinalAnswer said it wanted an audit with
"missing review" and the debt it actually raises is changed-path inspection.
The single counter is what let the wrong description stand.
Every judged child attempted and produced an accepted complete_subtask report
(14/14), so handoff wording is not the observed bottleneck. What 11 of 14 did
was call it repeatedly, and 10 of 14 kept using ordinary tools afterwards: the
report behaves as a milestone because the host accepts it without closing the
child's execution epoch. The contract already says "exactly once, as your final
tool call" in the most direct wording available and the tool enforces nothing,
so this is a missing state transition rather than a prompt to rewrite. Against
the threshold agreed before the run, no nudge.
The limits are recorded with the result because they bound it: 14 judged
children, 10 of them from prompts that demanded delegation, read-only n=3 from
one task, one run per task. The ratios describe children that exist, not the
model's own judgement about when to create one — 6 unprompted tasks produced a
single child against 10 from 5 that asked, which is logged as a separate
question rather than folded into this one.
Raw evidence stays out of the tree: trajectories are as sensitive as session
transcripts and run to 3.2 MB. It lives under the state home in four batches
kept apart, because the budget aborts that skipped tasks in two of them are
provenance, with a manifest pinning revision, model, the judged denominator and
a sha256 per file, beside the analyzer that reproduces the table.
Every delegated child emits into subagentProgressTracker.wrap(), and it
returned an event.FuncSink. Optional capabilities are delivered by type
assertion, and a func type implements none of them: measured against the
registry, that sink dropped all twelve. Not one channel — the child's handoff,
contract shadow, completion report, readiness audit, outcome progress and
protocol recovery all ended there, one layer before the nesting sink that would
have forwarded them.
Every delegation path goes through it. fleet, task and parallel_tasks all reach
RunProfileSpec, which wraps the child sink this way, so subagent telemetry has
been empty since 9ef543ee0 added the progress forwarding on 2026-08-05.
nestedSink already carries the lesson in its own comment — it is a type rather
than a func sink because a bare one "swallowed every delegation audit a fleet
child produced". wrap() was added in front of it and reintroduced the same bug
further out, where nestedSink could no longer be reached. plannerSink had the
same shape and is converted too.
Audits are not gated on the tracker's terminal. A preview event after the child
finishes is noise; its accounting is not, and the handoff receipt is written
from a defer that runs before the tracker is finished either way.
Measured on benchmarks/fanout-width (one parent, four children), before and
after: subagent_handoff 0 -> 4, contract_shadow 1 -> 5, completion_report
1 -> 5, protocol_recovery 0 -> 6, outcome_progress 4 -> 39. The one-per-child
channels landing at exactly parent+4 is the shape the hole was hiding.
The new guard lists the sinks handed to a child and checks each against
MissingCapabilities, because this package has now dug the hole twice and a
comment did not stop the second time.
The channel counting how often a delegated child closes the way it was asked
to reached nothing. No type implemented SubagentHandoffSink anywhere in the
tree, AuditForwarder had no method for it, and it was never registered in
capabilityContracts — so the type assertion inside RecordSubagentHandoff
matched nothing at the first wrapper and the audit was dropped. The producer
had a struct, an interface and a green unit test, which is exactly why nothing
noticed: conformance says a method exists, and only a stack says a value
arrives.
Registering it is the fix that matters. The registry is what forces every
wrapper and the shared forwarder to carry a channel, and the reason this one
escaped is that it never joined the closed set. AuditForwarder is embedded by
notify, telemetry, control, traystate, stats and the CLI sinks, so one method
there restores the channel for all of them.
The two guards that should have caught it kept their own hand-written lists of
capabilities, which pass for every capability they have not heard of. The
forwarder guard now reads capabilityContracts directly, and moves into
internal/event where that registry lives rather than exporting it for a test.
The cross-package wrapper guard still keeps a list; it is extended here, and
switching it to the registry is blocked on two channels that have no terminal
consumer at all (RunBudget, WorkspaceMutation).
Consumers follow the project-check probe's split: run-metrics aggregates,
trajectory keeps the whole observation. The metrics denominator is Judged —
expected to report and not killed by the provider — because a run that never
reached the point of closing is not a refusal, and counting it as one answers a
different question than the one being asked.
Nothing about delegation changes: no prompt byte, no handoff gate, no
completion semantics. This only makes the existing observation observable.
The gate and the ledger answer "which declared check is still owed" twice, and
the answers are not the same question. unmetProjectChecks walks the current
declaration and matches raw command text since the writer index; the ledger's
checkObligations walks baseline and current, keyed on VerificationIdentity,
since the latest successful mutation. Only the second one survives a task that
rewrites the declaration it was accepted under, which is what
ObligationBaselineCheck was written for — and the gate has never read it.
Nothing changes about what blocks. The probe derives the obligations beside the
gate and records both answers, per readiness evaluation rather than per turn.
It records identities, not counts: 0 vs 1 cannot distinguish the baseline
protection working from the candidate over-reaching, and the identity plus a
class can. A disagreement is explained strongest-first — a criterion the
current declaration dropped, then the two sides' differing after-indices, then
canonicalisation — so candidate_only and legacy_only are what is left when none
of the three account for it. Those two are the only classes that are defects.
project_check_probe_test.go records the gap end to end: a delivery turn that
rewrites its own declaration and runs only the replacement finalizes today,
never having run the criterion the task began under. The test asserts that it
ships, so flipping the gate to the obligations is what changes the assertion.
The channel is registered in capabilityContracts and forwarded by every
wrapper, so it cannot repeat SubagentHandoffAudit, which is emitted today with
no sink implementing it and no guard able to see that.
Also extracts appendIncompleteTodoGap and appendProjectCheckGaps out of
finalReadinessCheckFor rather than widening its function-size budget.
missingActionEvidence has had no producer since b071fef95 retired the word
lists that raised it. The field, its progress-signature slot, its missing-id
entry, the metrics column and the trajectory field all stayed wired, and every
one of them reported zero. A bench column that cannot be non-zero is worse than
an absent one: it reads as evidence the gate never fires.
CommandMismatchMissing was assigned the same value as MissingProjectChecks at
its only producer, so the audit carried one number under two names and the
metrics file summed it into two columns. There is no independent derivation to
restore it from, so it goes rather than being given one — inventing a second
derivation to keep a historical field alive is how a measurement vocabulary
stops matching the semantics it claims to count.
Behavior: none. Neither field was read by any gate, and missingIDs never
emitted "action" because the counter never rose, so the readiness wire payload
is unchanged. run-metrics JSON loses readiness_command_mismatches and
readiness_missing_action_evidence; no benchmark or frontend reads either.
Epoch staleness was written as "a transition invalidates everything produced
under the previous authority", which is stronger than what it exists to prevent.
What it prevents is earlier work inheriting capability it did not have: a batch
sampled while planning must not become executable because the user approved the
plan while it was still streaming.
Turning Plan on does the opposite. It narrows what may run, so nothing in flight
gains anything — and refusing it threw away the rest of the turn every time
someone touched the toggle, readers included, with "stale plan authority" where
the answer should have been the file. Side effects during planning are held by
the phase gate, which judges each call on its own terms; staleness was not what
was protecting anything there.
So it now refuses only across a widening transition. The attack it was built for
still fails closed — a writer sampled while planning is refused after approval —
and a reader caught by a toggle mid-turn returns its file, while a writer caught
the same way is refused by the phase rather than as stale, which is the
difference the model needs to read to know what to do next.
Found by asking what normal use costs rather than what an attacker gains.
Answering a card has to be the right instance, on the right surface, in the
right runtime. Those are three guards in different places, and a single test
that trips over any of them proves none of them.
Two attacks, each with its own destructive counterfactual, and the pair is
mutually exclusive — breaking one leaves the other's test green, which is what
shows they are separate lines rather than one line reached twice:
legacy /approve, stale id break resolve()'s exact lookup → stale answers current
plan surface, stale id break resolveTool()'s id selection → stale answers current
(keeping its tool check intact)
The legacy bridge is the one worth naming: it does not go through resolveTool at
all, so its staleness rests entirely on the exact map lookup in resolve(). Being
the right kind of decision was never the question there — being that decision is.
A third attack crosses runtimes, where both panes mint id "1" from their own
counters and only the route tells them apart. It passes, but the counterfactual
for it did not: routing every request to the first runtime left the test green,
so the break did not reach the path under test. It stays recorded as verified,
not proven, and the harness gap is the finding.
Planning admits read_only_task because its child cannot write. An extension can
replace the call, so the question is which invocation the phase judged — the one
the model wrote, or the one that will run. Judging the first would carry a full
tool set into a phase that refuses writers.
The assertion is that the child never starts, not that a message came back, and
the reverse direction is pinned too: narrowing task into read_only_task is
admitted, which is what shows the gate reads the capability it is about to run
rather than recognising a name.
Verified by moving tool.before after the policy gate, where the writer-capable
child starts once.
Identity, checked across the invariants while here: the pre-scheduling barrier
scan reads the original batch — it can only see what the model wrote — and the
outcome check covers what that leaves; every other judgement reads the
transformed or resolved-final call. Plan effect and the MCP phase gate read the
resolved target, permission and evidence read permName/evidenceName, and stale
authority is an epoch rather than an identity. No invariant judges an invocation
that will not run.
The barrier scanned the calls the model wrote, before scheduling. An extension
substitutes a call inside executeOne, after that scan — so a reader turned into
a question left the scan looking at the call that no longer exists, and
everything the model wrote after it ran anyway. That is the failure the barrier
exists for, reached through the one path that skips it.
The call now reports it: an outcome whose tool is a decision barrier ends the
round where it executed, and the rest of the batch is closed out the same way
the scan closes it. The scan stays, because it is what keeps a question out of a
parallel segment in the first place; this is the case it structurally cannot
see.
Found by attacking the seam rather than testing the feature, and the test fails
without the fix: the writer authored before the injected question runs once.
Studio answered a plan card by folding its three outcomes into the approval
boolean and then setting plan mode itself. That was already lossy — revising and
exiting are different transitions — and since the lifecycle became host-owned it
also raced the kernel's own move: the frontend's SetPlanMode(false) could exit a
workflow the approval had just carried into execution. The CLI did the same
thing in the same place, so both now send the outcome whole through
ResolvePlanDecision and read the legacy flag back instead of asserting it.
That call needed a way through HTTP, so serve gained POST /plan-decision. It
answers 409 with a coded refusal when the host no longer holds the decision:
concurrency, not client error, and the wording is in the catalogue so the window
says it in the user's language.
The composer toggle keeps following `plan`, which is false once a plan is
approved. planPhase is read separately and only to say what is happening —
"executing an approved plan" is a fact worth showing, and showing it must not
re-open a toggle whose next click would mean exit.
Asks name why they are asking. The reason switch is exhaustive against the two
values, so a third — a decision belonging to permission or to the plan card —
fails this compile rather than rendering as a question.
The projection is the authority on what is still waiting. A card this window
holds open that the host no longer lists was resolved somewhere else, so it is
sealed rather than deleted: it stops being answerable and stays on screen as the
record of what happened. Nothing here removes a decision on its own.
ResolvePlanDecision moves out of Approvals into its own port. A plan decision is
a workflow transition rather than a permission answer, and the chat gateway and
editor bridge have no screen for revising a plan — leaving it in the shared port
recorded them as owing an edge they will never draw.
Verified against a real kernel in a real browser: the toggle drives the
lifecycle to planning; a plan turn reaches awaiting_approval with the three
buttons on screen; clicking Start leaves the toggle off, the badge reading
执行计划中, and the kernel in executing; and replaying that same card returns
409 plan.decision_stale while the run is unaffected.
A frontend that wants one "waiting on you" list has had to assemble it from
events and remember what it saw. Doing that in the UI is how the ownership the
last four commits separated gets merged back together: one panel, one Allow/Deny
pair, and a plan approval starts looking like a permission prompt.
Decisions is a projection. It is derived from the owning subsystems each time it
is asked for, carries no state of its own, and nothing in the kernel reads it —
a client that never fetches it, fetches a stale copy, or ignores it entirely
changes no behaviour. Kind names the owner, and the owner is who answers:
plan_approval goes back through ResolvePlanDecision, ask through AnswerQuestion.
There is deliberately no Decision.Approve.
Identity is the id the owner already issued, sent back untouched. That is what
makes a stale card harmless without the UI knowing anything about phases or
epochs: the owner looks the id up, finds it resolved or replaced, and answers
nothing. Authority arithmetic stays in the kernel.
AskReason arrives with a consumer rather than ahead of one — a frontend can now
distinguish "your decision" from "information the request never gave me". The
two values are the whole set; permission, plan approval, and the agent's own
uncertainty are answered elsewhere and never become a third variant.
status gains plan_phase alongside the unchanged plan bool. Absent means outside
the workflow, so a client reading it can finally say "executing an approved
plan" while one reading only `plan` behaves exactly as before. Both are asserted
together, since the pair is the compatibility contract.
The projection is a serve-local capability rather than a port method: only this
frontend renders it today, and putting it on the shared port would record every
other frontend as owing an edge it has no screen for. It moves to the port when
a second consumer arrives.
The ask schema gained a field, so the cached prefix is invalidated once and the
golden baselines are regenerated for it.
ask obtains what only the user can supply. It is not a way to request
permission, not the plan card, and not a stand-in for research the agent can do
itself — and the criterion that used to let it through, "can't settle it from
the request, the code, or sensible defaults", let the model settle anything it
had an opinion about. Having a recommendation does not make a choice yours: when
two reasonable options would change architecture, public API, data model,
dependencies, UX, compatibility, scope, or anything irreversible, ask and put the
recommendation first. Local, low-risk, reversible details take the default.
The sharper failure is timing. Everything the model writes beside a question was
written before the answer existed: `ask("delete or archive?")` and
`write_file(...deleted...)` in one batch executes the guess whichever way the
user answers. Tools declare the barrier themselves rather than being matched by
name, and the scan runs before scheduling — ask is read-only, so it shares a
parallel segment with its neighbours and by the time it executes they have too.
Read-only siblings stop as well: sharing the segment is the problem, not writing.
The deferred calls are told they were not carried over and why.
The lifecycle is untouched. An answer changes what the task knows, not who holds
workflow capability, so it raises no plan epoch — the two staleness mechanisms
stay apart: plan epochs invalidate stale authority, this barrier invalidates
stale reasoning. If the answer leads to a revise or an approval, that transition
raises the epoch as it always did.
A run with nobody to ask no longer answers itself. The old fallback told the
model to use its best judgment, which contradicts the only rule that puts a call
here — the decision stays unresolved, and the model is pointed at
conclude_blocked instead of at a guess it would have to defend. No approval
posture answers for the user either; auto-approving writes says nothing about
which option someone wants.
The ask description is in the cached prefix, so this invalidates it once for
existing sessions. Golden baselines regenerated for that.
The plan workflow was an atomic bool carrying two questions at once — is the
user in the workflow, and what may run right now. A bool cannot say
AwaitingApproval, and it cannot say that approving grants capability to the
work that follows rather than to whatever was already in flight: flipping it
admitted every tool call the model had streamed while planning, retroactively.
planmode.Runtime holds one canonical State{Phase, Epoch}. Active is derived, not
stored, so there is no second field to keep in step. Every accepted transition
raises the epoch — Submit and Revise included, because each changes which
authority is current, and deciding case by case which one "really" counts is how
stale work finds a way back in.
Transitions compare against the state the caller last saw. An approval answered
after a revise finds Planning@N+1 where it expected AwaitingApproval@N and does
nothing, so a late click is harmless rather than merely unlikely.
Each provider round is stamped with the state it was sampled under, before
sampling rather than at execution: what matters is the authority the model
produced the call under, which the state at execution time cannot report. A call
whose origin epoch is no longer current is refused as stale, and told so, since
the reason is what sends the model to the current state instead of a retry. The
admission the gate records carries its epoch too, so the execution assertion
checks freshness — it still re-classifies nothing.
ResolvePlanDecision becomes the transition surface it already described:
revise and exit move the lifecycle before the waiting turn is answered, while
start stays with that turn, which holds the state it submitted and is the only
party that can tell an approval from a late one.
status.plan stays a bool. It is now a projection of the lifecycle for wire and
UI compatibility — true while the marker rides the turn, false once a plan is
approved, exactly as the flag behaved. Nothing in the kernel reads it.
Two places answered "may this run while planning": the phase gate, and a turn
policy that tested mutation accounting. Neither was wrong on its own — the hole
was between them, and the delegation fix landed in only one of the two. Collapse
the answer to one owner so the next tool cannot fall through the same gap.
taskpolicy stops enforcing. Its plan signal is still derived, still rendered
into the execution-policy block, and now only that: AllowsMutation had no other
caller and retires with the gate that used it. planPhaseEffect becomes the sole
classifier, and the planner's MCP exemption folds into that fact instead of
being special-cased at each gate.
Decide the phase before the first effect, not merely before permission. A proxy
names its real target only after resolving, and ResolvedCall.Commit is a state
transition its own contract places after the host's checks — it was running
before them, so a refused planning call could still leave a committed ledger
entry. The resolved-target gate now runs ahead of Commit.
What remains at the execution boundary is an assertion, not a second opinion: it
re-reads the admission the gate recorded and classifies nothing. Reaching it
means a pre-execution path skipped the gate, so it reports a host bug rather
than borrowing the ordinary refusal. tool.before keeps running ahead of the gate
because it decides which call there is to gate; that ordering is safe only
because a substitution is re-parsed, which now has a test.
Plan promised the model that the host refuses writes, side-effecting shell,
capability installation, memory mutation and writer-capable delegation until a
plan is approved. Delegation was not refused: the boundary tested `mutates`,
and mutation accounting answers "did this call record a mutation" — `task`,
`run_skill` and `use_capability` record none of their own because the write
lands in a child. In Plan with auto or yolo approval they ran, and the child
held the full tool set.
Decide the phase on an Effect axis instead. planmode is a leaf package: it owns
the rule, callers pass what their own metadata proved, and the zero value reads
as a side effect so a barrier that fails open cannot ship. The per-call fact the
plan already resolved is the input — the tool's own answer, or the shell AST's
for a concrete bash invocation, never the schema-level bool, which would refuse
`grep` and regress #5341.
A refusal says the run is still planning, not that permission was denied, and
says what still runs so the model spends no turns retrying. Each refusal carries
an identity: unclassified is classifier debt worth counting separately from a
declared side effect. The marker stops saying "avoid" now that the host refuses,
and its earlier wordings move to planmode.Superseded so replayed sessions still
strip the prefix.
Delegation splits by writer capability, not by being delegation: read_only_task,
parallel_tasks and the subagent readers are how a plan researches and keep
running. The planner's authorized non-destructive MCP research keeps its
standing exemption.
Covered by a cross-posture matrix — every approval posture refuses, execution
runs the same call, and explicit deny keeps working in both, which is what
proves Permissions was left alone.
The typed handoff exists for read-only children now, and nothing insists on it.
So this measures the natural rate first: a nudge built on a compliance number
nobody collected would be a guess with a number on it.
It observes and decides nothing. No prompt byte moves, no notice is emitted, no
parent handoff changes, and the provider surface is untouched.
The denominator is the instruction, not a guess at one. ExpectCompletionReport
is set exactly where the contract is appended, never inferred from a registry
holding the tool — the same distinction this codebase keeps having to relearn:
a count is not its evidence.
Four things are counted per child run, one sample each, from a single defer so
a salvage, a review failure, a provider error and a clean answer are all
counted the same way:
adoption attempts, accepted, malformed. Attempted-and-refused is a schema
problem; never-attempted is a protocol one, and one number
cannot say which.
protocol report round against final round, and tool calls after it. The
contract asks for the report as the closing call, and
"submitted eventually" is different behaviour.
adjudication claimed status beside the host's, and how many claims it
lowered. A child that reports readily and is corrected every
time is not a compliance problem.
exit completed, error, cancelled, no_answer. A provider failure that
produced no report never had the chance to comply and leaves
the denominator.
Split by entrance and depth, because an aggregate hides the entrance that is
failing. Content-free throughout: counts, enums and rounds, never a prompt, a
path or a summary.
Verified by making each fail: stop separating malformed from accepted and the
schema-vs-protocol distinction disappears; classify a provider error as
no_answer and a failed run becomes a compliance failure. The cancellation test
carries a wrapped sentinel and a lookalike string, because the classifier reads
errors.Is and a message that merely says "context canceled" must not pass —
repolint's error-text rule caught the first draft doing exactly that.
Options moved to agent_options.go: it is 172 lines of a god object, and this is
the third field appended to it this round. That extraction carries ten essay
findings forward, declared with -allow-widen; agent.go drops from 1597 to 1424.
runReadOnlySubSession stays in task.go — the spawn-boundary guard is right that
its list must not grow for a file-size reason — and the framing both runners
apply is shared instead.
A writer child ends by calling complete_subtask, and the host adjudicates every
citation against what it observed the child actually do. A read-only child
ended in prose. Its receipts still reached the parent ledger, so the host knew
which files were read and which commands ran — but the semantic half arrived as
an unverifiable sentence, and nothing connected the two. With one researcher
that is invisible. Across a fleet of eight it is the parent's whole picture.
Strict children now get the same contract and the same tool. complete_subtask
is already ReadOnly, so it survives the strict construction filter unchanged,
and the parent's existing adjudication path needs nothing new: read-only runs
through RunSubAgentWithSession like every other child.
The order is the point, and it has a name now. readOnlySubRegistry builds the
tools, proves the child can investigate something, and only then attaches the
way to report. Attached first, complete_subtask would make an empty registry
non-empty — a child with no research tools at all would pass the capability
check by holding the tool it files findings with, and then report on work it
could not do.
The contract's wording asked for "the paths you changed", which a child that
only looked at things cannot cite. It asks for changed or inspected.
No provider surface moves: the tool joins a child's registry, not the parent's.
Searchable canonical recall is proven: 6/6 against 3/6, and the successes
without it enumerated addresses by hand at nine times the page-in cost. That
number is from a clean environment, after three separate leaks were closed.
Fold-index marginal utility is unresolved, and the README says so rather than
picking the more interesting of two contradicting batches. The contaminated
Stage 2 is void; the clean paired batch found a consistent effect and the
same-batch dose-response did not reproduce it. Two of six index tasks carry
heavy-tail stopping behaviour, which is the likeliest reason. Existing evidence
cannot tune the shipped 1% budget in either direction.
The README also records what turned out not to be a problem — query
formulation, memory routing, snippet length, a general stopping failure — each
measured rather than argued, and each having been believed at some point in
this round.
And the four measurement distinctions that each reversed a conclusion once:
target-hit is not evidence-sufficient, linear event order is not model-round
order, an isolated workdir is not an isolated host, and a count is not its
evidence. They are enforced in the schema now, so the next reader does not have
to rediscover them.
The hypothesis was that i03 and i04 kept searching because a 240-rune window
handed over an incomplete answer — a rank-1 hit that scores as found and reads
as insufficient. Measured through the shipped MakeSnippet across every task,
100 instantiations each, and every query those runs actually drew:
240 runes: 12/12 tasks at 100% coverage, i03 and i04 included
The records are 30 to 179 runes long. They never reached the boundary. The
shipped recall path agrees: i04's four historical queries each return 3/3
values. Only r01 at 120 runes falls short, and 120 is not what ships.
So the post-hit searches in those two tasks are stopping behaviour after all.
Seven runs out of forty-four, in two tasks, which is a scale that does not
justify changing a runtime — but it is now measured rather than assumed.
FirstHitCoverage and AnswerValues are recorded from here on. Three analyses in
a row have turned on the difference between "the target came back" and "the
answer was readable", and it should not need a one-off script to tell them
apart again.
A search returning the target at rank 1 has not necessarily returned the
answer: the snippet is bounded. So the stopping boundary is the round where
everything the task needs became readable, across snippet and read together —
not the round the target came back. A read after an insufficient snippet is
correct behaviour, and counting it as waste blames the model for a bound the
host set.
Runs are classed by what they did after that point: SnippetStop, SnippetThenRead,
DefensiveRead, PostSufficientRetrieval, PostSufficientRunaway, NeverSufficient.
The funnel reports mean, median, p90 and max of the extra rounds and extra
page-in, because the suspicion here is a heavy tail and a mean would hide it.
Trajectories are written beside the metrics once the whole batch is done.
Three analyses in a row have needed a re-run because something was counted and
not kept — first the query text, then the snippet contents — and this is what
stops the fourth. They are written at the end on purpose: during a batch, those
files are the answer.
What the existing batches can already say, with target-hit standing in for
sufficiency: 44 clean runs held their target, 37 of them issued no further
search, and all seven that did belong to two tasks. Not a general stopping
failure.
Two runs in the dose batch hit the four-minute budget, and the metrics already
said which kind they were. i04's first search returned the target at rank 1 in
round one; it read it in round three and was still searching in round eight,
five of those searches issued after the answer was already back — the last of
them for the answer's own codename. i03 found it in round two and kept going
too. Neither was waiting on a provider.
So a timeout is classified rather than counted. TargetFirstSeenRound,
RoundsAfterTarget, SearchesAfterTarget and RecallTokensAfterTarget say what
happened once the answer was in hand, and TimeoutReason separates
PostTargetRunaway from SearchSpiral, TargetHeldLate and NoToolActivity. Only
the second is a case for a longer budget; the first would just get more time to
circle.
This matters beyond the two runs. A batch that reports "context deadline
exceeded" cannot tell an arm that made retrieval harder from an arm that drew a
slow minute, and the index experiment is currently deciding exactly that.
scoreRun became a runScorer holding the walk's state, because the metric it now
derives crossed what one function may carry.
Two runs in the dose batch timed out, and their curves printed 0 at those
budgets — a line falling to the floor where nothing was measured. Both tasks
were then excluded from the boundary counts, correctly, but the table beside
those counts told the opposite story. Missing arms print a dash, and a curve
with a hole says "no curve" instead of a delta computed from a zero.
CueDirectRead came back 1/6 on clean data: the model almost never uses the
addresses. But searches and page-in still dropped on all six paired tasks when
the cue was visible. So the hypothesis under test is not that a bigger index is
better. It is that a visible historical action cue lowers the cost of active
retrieval — which predicts a step at each task's own visibility boundary, and
not a slope across four budgets.
Each task now gets a curve across default, half, quarter and off, with an arrow
where its cue disappears. BoundaryAligned reports whether the largest single
transition is that one. A change somewhere else is variance wearing the shape
of an effect, and averaging four arms cannot tell the two apart.
Reported with mean, median, and the mean after setting aside the largest
effect. The largest is not deleted: one task drove a −1735 token delta, and the
honest reading is that the effect survives without it, not that it was an
outlier.
Arms are shuffled inside each task block from a fixed seed. Running six
defaults and then six halves would make provider drift collinear with the axis
under test — a bad minute would land entirely on one arm.
Each batch prints what produced it: model, endpoint, window, generations,
commit, start time. Batch effects have reversed three conclusions here already,
and a table with no provenance cannot be compared with the next one.
Twelve runs instead of twenty-four. Each index task is measured at the
narrowest scale that still addresses its cue and at the next one down, so a
pair moves the affordance and nothing else — default-vs-off moves the entire
index along with it, and averaging four arms mixes six questions of different
difficulty into every number.
The two arms draw separate nonces. Reusing one would leave the first arm's
answer in a host-readable history for the second to find, and the
counterfactual is about the cue, never about the literal.
CueDirectRead is judged strictly now: the cue was addressed, the first memory
action was a positions read, and that read covered the target. Counting any
positions call would hand the index credit for an address a search had already
found — which is the number the old Stage 2 leaned on.
The report is paired deltas per task, then the two sides pooled, then where
each side looked first.
A clean run was failed by the marker "229" appearing somewhere in
~/.claude/history.jsonl. It is a three-digit epoch: it appears in any long file
by chance, and this one did. The run had actually recovered the answer through
recall and said so.
The gate takes codenames only. They carry this run's entropy, so a hit is
proof; a model holding one holds the numbers printed beside it anyway. Numbers
still count for scoring the answer, where every marker must appear — there the
question is whether the model produced the value, not whether a file contains
it somewhere.
The disk assertion earned itself immediately: with session.jsonl and the
context sidecar removed, session.events.jsonl still held the answer, and all
twelve runs failed before their first provider request. Nothing was paid to
learn it.
A session writes more than the file it is named after, and naming the ones we
know about is how the next one gets missed. sealFixture empties the fixture
directory instead.
The disk assertion earned itself immediately: with session.jsonl and the
context sidecar removed, session.events.jsonl still held the answer, and all
twelve runs failed before their first provider request. Nothing was paid to
learn it.
A session writes more than the file it is named after, and naming the ones we
know about is how the next one gets missed. sealFixture empties the fixture
directory instead.
Two leaks were closed by name: corpus.go by instantiating the answers, and
session.jsonl by removing it once the agent holds the transcript. Naming files
is how the third one gets missed, so the fixture directory is now scanned for
this run's answer literals — before the first provider request and again after
the turn. An autosave that lands somewhere new, a recovery tombstone, a sidecar
that moves: each fails the run instead of quietly feeding it.
Also a shadow reading. AnswerRecovered means every marker appears in the text,
which proves the right fact is present and not that it was submitted: the leaked
run answered with this run's real values and an older corpus's values together
and scored recovered. AnswerAmbiguous flags an answer naming two candidates of
one codename's shape. It changes no verdict — the first behaviour pass stays on
nonce matching — but a report will no longer read "said everything, including
the right thing" as clean recovery.
Runs that errored are counted apart from runs that measured something, so a
provider timeout no longer votes in the routing distribution.
A clean-baseline run came back contaminated, and the leak was the one the repo
work could not reach: bash cd'd into the fixture directory and cat'd
session.jsonl. The canonical transcript is the answer by construction, and the
sandbox mounts the host read-only by design, so a model that finds the path
reads the answer. One did.
The agent holds the session and its sidecar in memory before the turn starts,
so the files stop being needed at exactly that point. sealFixture removes both
and denies the directory — the deny matters, or an autosave recreates the file
with the same content the removal took away. A failed autosave costs the
benchmark nothing; it scores from memory.
Two things worth recording from the leaked run. The answer it gave mixed this
run's real values, read out of session.jsonl, with values from an older corpus
it found somewhere else entirely — so answer_recovered read true on a run that
recovered nothing. And the contamination gate is what caught it: the run left
the statistics instead of scoring 6/6 for the wrong reason.
Two runs are told what they are running and sent after the answer everywhere
except the conversation: the repository, the benchmark source, the fixture
generator, test files, scratch files, session metadata. The question is not
whether a model obeys the experiment. It is whether the answer is reachable at
all by one that knows the mechanism and is actively attacking the host.
Both came back isolated. Thirteen tool calls on one, six on the other, and
neither reached a value. A run that gives up and recalls still passes: that is
the attack failing, not the model behaving.
The gate is EscapeFoundAnswer, not AnswerRecovered — recovering the answer
through recall is the path this benchmark is for, and a strict "did not answer"
check would have failed the wrong thing.
Two pilots were contaminated the same way: the model grepped corpus.go out of
this repository and read the answer. Isolating the workspace did not stop it —
the sandbox mounts the host read-only by design, so a model that guesses a path
can read it. The fix is that the path leads nowhere useful.
Every answer-bearing literal is a placeholder now. The corpus says
The ownership token is {{token}} ... filed as {{reason}}
and a run turns that into values generated for that run alone. The invariant is
exact: benchmark source may reveal the experiment, the task structure and the
semantic template, but no literal sufficient to satisfy AnswerRecovered may
exist in the repository before the run begins. That includes the numbers —
randomising a marker while leaving "expected epoch 12" behind would leak two
thirds of an answer.
Values stay shaped like engineering records: cobalt-k7m4q9, epoch 731, 43ms,
0.0437. A UUID would close the leak and turn every task into "find the random
string", which is not the retrieval being measured.
The template grammar is one identifier in double braces. No conditionals, no
loops, no defaults, no filters, and an unresolved placeholder fails the fixture
rather than reaching a transcript as "{{marker}}". This is fixture data, not a
language.
Seeds split by purpose. Preflight, calibration and tests are deterministic, so
a tier boundary is measured against reproducible values. A paid run draws from
crypto/rand, so its answers existed nowhere before it started.
Scoring binds to the instance, and results keep no vars — writing the expected
answers next to the run would rebuild the file this commit removes.
Two more things the pilots asked for:
Contamination now records the tool, its arguments and a bounded excerpt of the
output that leaked, plus EscapeFoundAnswer — "looked at the workspace" and
"found the answer there" are different facts about the same call.
Routing is judged by model round, not by the order of tool events. Two calls in
one round are a parallel fan-out; calling that workspace-first would report a
preference the model never expressed. The same correction the query audit
needed when 2.17 searches turned out to be one round's fan-out.
Verified by making each fail: write one seeded marker into corpus.go and the
leak check names the file and the line; treat a same-round fan-out as ordered
and the routing test names it.
The first two pilots kept only counts. search_calls=4 said a run searched four
times and nothing about what it searched for, so the obvious question — why
does a retrieval the host probe ranks first take more than one attempt — could
not be asked of the data at all. Sessions on disk are the fixture; the turn's
own messages were never saved. Answering it needed the runs again.
Each recall query now carries its ordinal, round, rank, result count, how it
differs from the one before it, and which of the host probe's terms it left
out. The probe is the oracle here: it ranks every target first, so the terms a
query lacks are what the model did not think to ask for.
Reformulation classes are set arithmetic over recall's own tokenizer — no
judge, nothing read out of prose. NearDuplicate is Jaccard >= 0.8 against the
previous query. HistoricalAnchor is a term the user's question never contained,
which had to come from the model's own memory of the history rather than from
rephrasing what it was asked.
The audit reports the funnel by attempt (found by query 1 / 2 / 3+ / never),
whether a hit was then read, and how many searches were issued after the target
had already come back — that last one is a result-to-read problem, not a query
problem, and the two want different fixes. Every query is printed in order, so
a surprising number can be read rather than inferred.
The round is recorded per attempt for a reason the first reading of this data
needed: two searches in one round are one parallel fan-out, not a retry.
Three additions the index experiment needed, and one rename.
An answer reachable through anything but recall invalidates the run. The
workspace is isolated, so this should never fire; asserting it beats trusting
it. A tripped run reports Contaminated, leaves every recovery statistic instead
of inflating one, and names the tool and marker that leaked. It fired once in
twenty-four — a bash call that reached this repository and read corpus.go —
which is exactly the case the gate exists for.
Escapes are placed rather than counted: before any recall is a different
strategy from after one came back short. They are behaviour, not noise. How a
model routes its uncertainty when its memory is missing is part of what this
measures, so nothing blocks them.
DirectRead is RecallReadWithoutSearch, and its stage is CueRead. read_file is
also a read, and in an audit trail the two mean opposite things: one is the
index doing its job, the other is the model giving up on memory.
The index report now walks each task across its own cue boundary — the
narrowest scale that still addresses it, against the next one down — and pools
the two sides. A four-arm average mixes six questions of different difficulty
into each number; a boundary row holds the question fixed and moves only the
affordance.
The first pilot reported search-off recovering 6/6 with no search and no read,
every run reaching for bash and read_file. The answers are nonces, so that was
not a guess. Reading one back explains it: the model grepped corpus.go out of
this repository and quoted the file's own line about every answer being "a
nonce appearing in one folded message and nowhere else", then said so.
The corpus lives in the tree the agent was started in. So the run moves into an
empty directory first, and the fixtures stay outside it — a session file the
model can read is the canonical transcript with the answer in it.
Two more things that made those numbers meaningless.
Three search tasks were addressed by the fold index. A tool call always earns
an index line, so r04, r05 and r06 were measuring the index, not search — which
is why they came back DirectRead in the arm that cannot search. They are the
assistant's own account of the same runs now. The check meant to catch this
matched the task id against the index, and a task id never appears there; it
matches the target's address, and fails all three loudly.
Metrics kept no answer text, so a surprising run could not be read back at all.
FinalAnswer is retained, bounded. A metric nobody can audit is a claim.
Also: the stage for "opened addresses, none of them the target" was called
NoSearch, which reads as a choice the model made — in the search-off arm it is
not one. It is ReadMissed.
With the workspace isolated, the same twelve runs separate:
search-on 6/6 recovered search/task 2.17 recall 197 tok/task
search-off 2/6 recovered search/task 0.00 recall 1336 tok/task
ReadMissed=3 NoRetrieval=1 DirectRead=2
Both arms still reach for the workspace and find an empty one. The two the
search-off arm recovered, it brute-forced by reading addresses until one paid
off, at roughly seven times the page-in cost.
A run mode that has never run is a run mode that fails on its first paid call.
-dry drives fixture, resume, tool surface, scoring and report with a scripted
provider that walks the chain a competent model would: search, read the best
hit, answer with what came back.
It found three harness bugs that would each have cost real calls to discover.
The script decided what to do from a call counter, and one provider serves
every task in a run, so task two started where task one left off — eleven of
twelve runs scored NoRetrieval. It reads the request now.
Then it looked for the last tool result anywhere in the request. A fixture's
own history is full of tool results, so every turn looked like a continuation
and none like a first round. It reads the last message.
Then it sent a query in the arm that has no query parameter. The runtime
refused it, and the refusal scored as SearchMiss — a failed search, when
nothing had searched. It honours the schema now, which is what a model does.
With those fixed both experiments walk end to end:
search-on 6/6 Recovered search/task 1.00 recall-tok/task 288
search-off 6/6 NoRetrieval search/task 0.00 recall-tok/task 0
index-* 24/24 Recovered identical across all four scales
The index arms being identical is correct and worth saying: the script always
searches and never uses a cue, so it is the always-search baseline. Telling the
four scales apart is the model's job, and the difference will show up as
DirectRead — which the scorer's own tests already cover.
Nothing here calls a provider. The pilot is the next thing that spends.
The experiments can now be run and read. Two modes drive the fixtures against a
real provider — run-search for the twelve-run stop/go, run-index for the
twenty-four that follow — and every judgement they make comes from a tool call's
name and its JSON arguments, or from a canonical position. "I will search the
folded context" is prose, and prose is not a search.
The funnel is the point. A run lands in exactly one stage, chosen at the first
step that did not happen:
NoRetrieval recall was never called
SearchMiss searched, the target never came back
HitNotRead the target was returned and never opened
ReadButAnswerWrong opened it and still answered wrong
DirectRead read from an index address with no search at all
Recovered
So a failed arm says where it broke rather than only that it did. Those four
failures want four different fixes, and a single pass rate would hide which.
Two counters are kept apart for the same reason: SearchHits is a search that
returned something, TargetSearchHits is one that returned the target. The gap
between them is query quality, and collapsing it would score a model that
searched badly the same as one that searched well.
Target hits and reads are matched on the canonical position the fixture already
knows, never on snippet wording — and a read is credited to the caller's own
address, which is what recall's span returns the results under. DirectRead is
separated from Recovered because it is the index arm's whole claim: the address
was on screen, so no search was needed.
RecallReturnedTokens is what recall paged back in, which is the other half of
the index tradeoff: a smaller index saves resident prefix and pays here instead.
UnexpectedWorkTools records reaching for the workspace instead of recall —
reported beside the outcome, not overriding it, since the interesting case is an
arm where the model changes strategy.
Answers are graded on nonces, every marker required, no judge model.
Verified by making each fail: score prose containing "search" as a search and
the narration test names it; match a snippet instead of a position and a run
that missed its target reports HitNotRead.
armsFor is now the single declaration of which arms a task runs at, so the
preflight cannot clear one set of arms while the run measures another.
Still no provider called under go test. The run modes need DEEPSEEK_API_KEY and
are the only thing here that spends anything.
The fixtures were checked against the model-visible projection. That is what
the agent believes; a provider.Request is what the model is told, and
rendering, sanitization and tool-schema construction sit in between. So each of
the 36 arm states now resumes the way a restart does — transcript from disk,
projection from its sidecar, the shipped tool surface at that arm — runs one
round against a capture provider, and is judged on the request it produced.
The capture answers with a clean terminal response. An empty one would buy an
empty-final retry and a second request, and the round under inspection is the
first. The turn's request is the one carrying tools: a fold on the way in asks
the same provider for a digest, and taking request[0] blindly inspected the
summarizer's prompt instead.
The scan enumerates the provider-visible surface rather than marshalling a
Message whole — content, reasoning_content, tool-call names and arguments,
responses_items, and every tool name, description and parameter schema — so a
leak is reported where it is, and local-only fields the boundary is supposed to
strip cannot produce a false hit. Those are asserted absent in their own right:
raw_content, LocalOnly, decision receipts, tool execution and memory citations
crossing the boundary is a regression whether or not a marker rides along.
It found what the projection check could not. i05's answer marker "session"
was readable in tools[0].parameters and tools[2].parameters — in all four arms,
because a tool schema is not part of any projection. r01's "partial" was one
ordinary word away from the same fate. Both are nonces now.
Search arms are held to the ablation's definition: both keep positions, only
the control has query, and the search-off arm's request may not contain the
wording that offers a search — checked over the whole surface, not just the
schema, so a description or an index line cannot reintroduce it.
Getting a resumed fixture to keep its projection turned up one more thing worth
recording: projectionCoversTail cannot revalidate a projection that covers the
entire transcript, since it has neither a matching transcript version nor a
live tail to sit in front of. Real sessions always have one, because work
continues after a fold. The fixtures now do too.
Verified by making each fail: stop scanning tool schemas and i05's leak goes
quiet; leave the search tool unswapped and the search-off arm is named twice,
once for the parameter and once for the wording.
benchmarks/* join cmd/ and desktop/ as hosts in the layering rule. Each is a
main that assembles a real agent, and a harness reproducing the shipped tool
surface has to reach the frontend that defines it. Nothing is opened to the
kernel by this: the rule that matters is that nothing below a frontend may
import one, and a benchmark is above every frontend.
No provider is called anywhere in this commit. This is the gate that says the
API spend would measure what it claims to.
Twelve recall questions, built by folding a real session and checked before any
of them is worth a provider bill. Six ask whether search reaches what no index
addresses; six ask what an index line is worth, across the four budgets.
The fixtures are real sessions. buildFixture plays a history through the actual
agent, calls CompactNow, and lets the runtime write both the transcript and its
context state where it normally does — so the loader, the projection restore
and the arm all have to work on them. A bench-only state shape would let the
experiment pass on a state the runtime never produces.
Preflight is the point of this commit. For every arm a task will run at, it
rebuilds the fixture and checks the state the model is actually handed: the
answer unreadable, the corpus findable by its own probe query at rank <= 5, and
for an index task the cue addressed at exactly the scales its tier names. Three
conditions, thirty-six arm states, all of it before a single API call.
Building it found three things about the mechanism the corpus had to be
rewritten around.
A cue's tier is set by what follows it, not by what precedes it. mergeFoldIndex
trims a cumulative index from its oldest end, so the first draft — which padded
ahead of the target — produced the same visibility at every padding size, since
the target stayed the oldest line and was always trimmed first. PlantAfterGen
replaced it and gives a clean staircase: planted after generation 4 a cue
survives to quarter, after 2 to half, after 0 to default only. Two tasks per
tier, so the boundary is crossed by the same question rather than by two
different ones.
A failing command cannot be an index cue. coverageDemands hands failures to the
digest, and the host backstop keeps them besides, so a failure never reaches
the fold index at all — the first i04 was visible in all four arms including
off, measuring nothing.
A failing tool result cannot be a search target either. KeepErrors deliberately
holds failing output through a fold, which is good news about failure evidence
and fatal to a recall question: preflight caught r04 and r05 with their answers
still on screen in every arm. Both are reported diagnostics now, which is also
what r06 already was and why it passed from the start.
Verified by making it fail: declare a cue at the wrong tier and the arms it is
missing from are named; leak an answer into a tool argument and every arm that
can read it is named.
go test runs the whole preflight (-short skips the 36 folds). No provider is
called anywhere in this commit.
The next experiment asks two questions the first bench cannot: whether an agent
reaches for search when it has forgotten something, and what the ambient
address list is worth in tokens. Both need arms, and the arms need knobs.
recall-search is a real subsystem ablation, so it joins Modules(). Off, it
restores what recall could do before the folded region became searchable: the
runtime refuses a query, the provider-visible schema loses its query parameter
and its description stops offering one, and the line the index writes when it
trims an address stops pointing at a search. An arm told about a capability it
does not have is not the arm before the feature.
The fold-index scale is not a module and does not become one. Set gains an axis
beside the module set: default, half, quarter, off. Four steps rather than a
free-form fraction, because the question is whether an ambient address list has
marginal utility, not where its optimum sits, and a float would turn a
measurement into a tuning knob nobody asked for. It scales the floor along with
the budget — a surviving floor would make the off arm a small index rather
than none.
It reaches Arm() either way: "index-quarter" is not the control arm, and
results keyed by arm name would otherwise merge with it. Both axes travel to
the child binary through one appendArmArgs, because String() carries modules
only and the four call sites that passed it would each have dropped the scale.
ParseArm reads both at once for the same reason.
Measured through the projection, not the flag: 400 tool calls folded at a 120k
window publish 112 index lines at the shipped budget, 58 at half, 28 at a
quarter, 0 off.
Invariants locked by tests, each verified by making it fail:
- the scale not reaching foldIndexBudget -> all four arms publish 112 lines
- the runtime gate held open -> search runs in the arm without it
- the trim line not reverted -> the arm is offered a query
- boot not swapping the tool -> the arm is shown a query parameter
No user-facing surface: both flags are documented as benchmark arms on the same
`run` subcommand -ablate already lives on, and nothing reads them from config.
The repolint budgets for cli.go held it to one line, which is why the flag pair
moved into bench_flags.go rather than growing the god object by seven.
Cache-impact: none on the control arm — the shipped schema, prompt and index
wording are byte-identical; only an explicitly selected arm differs.
Cache-guard: go test ./internal/boot/ (golden baselines unchanged)
Documentation-impact: none.
The bench asks one question fifty times: a fact stated once at the start, is it
still reachable? It separates the two carriers, because they lose their address
by different routes and on different schedules.
Assistant reasoning never enters the fold index at all — buildFoldIndex records
user turns and tool calls, not what the model concluded — so it is out of sight
from the first fold and search is its only route for all fifty generations. A
tool call does get an index line, which holds until the budget trims it; the
run reports where that happens (generation 17 here) and verifies search across
every generation after. Neither carrier is a user turn: keepUserTurns holds old
ones verbatim oldest-first, so a fact planted there stays on screen and would
make the whole bench pass for the wrong reason.
Every generation asserts the model cannot already see the fact before claiming
search found it, and a run where that never became true fails rather than
reporting success — without that guard a loop that skips every case is green.
Rank holds at 1 across 15, 123 and 603 folded messages, at a flat 47 tokens
against a 6000 budget, so a search does not get quietly worse or dearer as the
session it searches grows.
The bench found one real gap, fixed here. recall rendered its result through
renderTranscript, which summarizes tool-call arguments to stop a digest
reproducing a long one (#4317). Applied to a recall that meant searching for a
command, finding it, reading it back, and getting "[assistant calls bash]
{command} (1 keys)" — the address without the fact. That leak path is a digest
becoming a user message; a recall result is a tool result, and the recall
budget already bounds its size. So recall renders arguments verbatim and
summarizer input keeps summarizing them.
Verified by making each fail: fold the arguments again and the tool_input
carrier loses its wording; drop the "never left sight" guard and a bench that
tested nothing passes.
Cache-impact: none — tests and a recall-only rendering path.
Documentation-impact: none.
recall could only read a position something else had already named. The two
things that name one both decay. The fold index is bounded at 1% of the window
and trims its oldest lines to stay there. And canonicalOriginFor returns -1 for
anything inside a previous projection, so a message folded a second time has no
canonical position to derive at all -- not evicted, never minted.
Underneath, nothing was lost: compaction rewrites what the model sees and never
touches the canonical transcript, and every commit records how far into it the
projection reaches. The transcript kept the data while the model lost the
address for it.
So recall gains a query. It searches canonical[:CoveredCount] -- the backing
store, never the projection -- through the same BM25 primitives history uses
(internal/retrieval; history.Searcher itself imports agent, so only the
algorithm is shared, not the searcher). Addresses come back straight out of the
transcript, which is why generation count stops mattering: there is no
provenance to preserve across folds when nothing asks a projection where a
message came from.
Addressing differs from history's on purpose. A tool result is matched on its
own output but addressed by the assistant call above it, because recallSpan
reads a call together with its results -- pointing at the result would return
output without the command that produced it.
Search and read share one budget. A search pages folded content back in exactly
as a read does, and two budgets would let one refill what the other refused.
An empty result costs nothing and is not an error: "it is not in the folded
region" is an answer, and failing the call reads as the search being broken.
Invariants locked by tests, each verified by making it fail:
- search the projection instead of canonical -> no hits at all, every
generation, which is the whole reason this reads the backing store
- address a tool result by itself -> the command is lost
- search canonical[:] instead of the covered -> the live tail comes back
Every claim about finding a fact first asserts the model cannot already see it
(foldedOutOfSight); the first draft of this test passed for the wrong reason,
because keepUserTurns holds old user turns verbatim oldest-first and the
fixture's fact was still on screen. It is assistant reasoning now.
Also: CJK queries (the tokenizer's bigrams are what make a Chinese session
searchable), and the index's trim line now points at the search instead of
saying only that the transcript still holds what it dropped.
No cache budget was raised to land this. The visible-schema ceiling caught the
first draft 214 tokens over; the explanation of why to search moved out of the
prefix into the index line that trims, and the kind filter was dropped rather
than charged to every session for a convenience nothing had asked for.
Search cost is linear and small enough to need no index: 2.3ms at 1k folded
messages, 11ms at 5k, 44ms at 20k (BenchmarkSearchFoldedRegion, kept as the
regression guard). A generation-scoped cache was designed and not built.
Cache-impact: one-time. The recall schema changes, so the tool prefix moves
once on upgrade; the golden baselines are regenerated for it.
Cache-guard: go test ./internal/boot/ (prefix_shape + tool_schemas updated)
Documentation-impact: none.
The fold index and the digest divide the fold between them. buildFoldIndex
skips a change with a path and a failed command on the digest's promise to
carry them (coverageDemands), so nothing lands between the two. Two paths
break that promise and nothing was catching either.
Under mustFree, repairFoldCoverage measures the coverage and then returns
without spending the retry -- correctly, since the hard ceiling is no place
for another summarizer call. And when the summarizer fails outright,
degradeFoldSummary installs a mechanical digest that carries nothing at all.
In both cases the change is absent from the digest, absent from the index, and
still present in the canonical transcript: data retained, address lost.
measureFoldCoverage already computes exactly what went missing. So the host
writes it back itself -- paths and command signatures out of the same
receipts, no tool output repeated and nothing inferred:
## Host-retained fold facts
The summary above does not cover these, and the fold index omits them.
- changed: internal/parser/reader.go
- failed: go test
Only what the digest dropped, so a digest that did its job costs nothing. The
block is bounded and says how many facts it left out, because a list that just
stops reads as a complete one. It is written before the projection is measured,
so acceptance already prices it and no fold gets rejected for carrying it.
mustFree now means "prose may degrade", not "state may vanish".
The degraded path also measures its coverage now. It never did, so a fold that
lost every change reported CoverageRequired=0 / CoverageMissing=0 -- the same
receipt a perfect digest writes. The CLI and desktop cards say when the host
completed a digest rather than the summarizer.
Invariants locked by tests, each verified by making it fail:
- no backstop under mustFree -> the changed files leave the projection
- no backstop when degraded -> a proven change and failure are lost
- degraded coverage unmeasured -> total loss reports as nothing to cover
Plus: silent on a complete digest, silent about reads (the index owns those),
and explicit about what a truncated list left out.
Cache-impact: none -- compaction rewrites history by construction; the
system-prompt prefix is untouched.
Cache-guard: go test ./internal/boot/ (prefix_shape golden unchanged)
Documentation-impact: none.
The execution layer was already asynchronous; the agent's control flow was
not. A background job ran to completion, queued a sentence, and then waited
for the user to say something before the model could learn it had finished.
The only way for a turn to act on its own background work was to poll it with
wait, which is what #7948 reports.
Nothing here builds a second runtime for that. The session inbox already is
one: durable, idempotent, crash-recoverable, with a level-triggered dispatcher
that admits work only when the session is idle, and a steer path that consumes
guidance at the run loop's model-round boundary. What was missing was one wire
between the job table and it.
So jobs publishes a CompletionEvent -- an identity, not a sentence:
completion/<job-id>/terminal-v1 is derived from the job, so a delivery path
that runs twice can tell a replay from a second completion. The controller
takes it and translates it into a host continuation on the queue it already
owns. Nothing under the frontend learns what an LLM is: returning nil from the
observer means the event reached durable storage, never that a model read it.
The observer fires after close(j.done), not with the note. recordCompletion
stays where it was for the reason its comment gives -- an observed terminal
status has to imply the note is queued -- but a wake-up is different in kind:
it can start a turn whose first question is about this job, and a turn that
can still observe Running has been told a lie.
Which delivery a completion gets is never decided by reading whether a turn is
running. The turn can end in the gap between that read and the enqueue. The
steer attempt itself reports which world it is in: taken means the live turn
has it, refused converts the item to a follow-up and kicks the dispatcher.
Both notification paths survive, and exactly one delivers. A completion the
observer took is acknowledged out of the manager's own queue; one it could not
take stays there and rides the next real user turn. A session with no durable
inbox (headless run, e2ebench) degrades to the old path rather than failing.
Host attribution now travels with the item instead of with the call site.
PromptOrigin lives in the manifest, not the envelope -- one place to read, and
nothing for UpdateItem to fork when it rewrites a blob. A host item steers
through SteerHostItem, runs synthetic when it degrades to a follow-up, keeps
its attribution when an abnormal exit records it unapplied, and is named as a
background follow-on in the queue panel rather than as a line the user typed.
Invariants locked by tests, each verified by making it fail:
- the observer runs before terminal publication -> status reads "running"
- the host dispatch is dropped -> the model is told the user spoke
- the legacy note is not acknowledged -> the next turn hears it twice
Plus an end-to-end over the real jobs.Manager and Controller: a background
job finishing is enough to give the session a turn, with nothing left queued.
Known gaps, both deliberately out of scope:
- A host follow-up persists as a user-role message, so previews, titles and
user-turn counts still read it as the user's. Fixing that wants a
structured marker on provider.Message, which also retires the 17-prefix
SyntheticUserPrefixes table -- a change of its own.
- The jobs -> inbox handoff is not yet crash-safe: a process that dies
between terminal metadata and the enqueue loses the wake-up. The
deterministic event id makes redelivery free, so reconciliation at bind is
a separate, small change.
Cache-impact: none -- the system-prompt prefix is untouched; a continuation
rides the turn tail like every other host notice.
Cache-guard: go test ./internal/boot/ (prefix_shape golden unchanged)
Documentation-impact: none -- no docs/*.md describes the completion note path.
Repolint: no budget widened; agent.go 1617->1597, controller.go 5056->5041,
jobs.go 1174->1141 as the moved code lands where it belongs.
Reported in #9524. The font setting explained that a name it cannot find
"不会弄花" the interface, which is a worry nobody had, and never said what
the line underneath it was for. The empty session opened on 交待一件事，
它自己往下做 over a subtitle about a 机器记录 rather than a 叙事 — the
implementation's own vocabulary, on the first screen a new user sees.
Both are rewritten to the same three things: what you can do, what you will
observe, and the limit when there is one. The font hint now says the text
below previews the typeface and that an unavailable one falls back to the
default; the sample says 字体预览 rather than carrying a slogan; the hero
says what the agent can do and where the run is visible.
The issue says it is listing two examples, and it is: the voice runs
through the rest of settings. Swept src/ui with the same three rules,
taking the hints, descriptions, empty states and onboarding copy and
leaving buttons and short labels alone. What changed is the kind of
phrase the reporter pointed at — slang (有活儿在跑, 拽回来, 真有的,
挡得住, 答得上来), a door metaphor for a provider protocol, sentences
written from inside the implementation, and literary asides such as 背景值
一圈留白，不值一段读不清的正文. Copy that was already plain was left as
it was. 51 strings in all, English updated alongside each, since the
Chinese source text is the catalogue key and i18n.test.ts holds the pair
together.
Two things surfaced while sweeping and are worth knowing separately. The
font hint had two catalogue entries differing by one space, only the
second of which anything referenced; it is gone with the rewrite. A
second orphan, the rule-format hint in en_settings.ts, has no source at
all and is left alone here. A general count of dead keys is not offered
because it cannot be measured reliably: Chinese also reaches t() through
data tables, and en_storage.ts keys one entry without quotes, so a scan
misses references in one direction and invents them in the other.
No behavior, no layout, no repolint rule — copy quality is not something
an AST can judge, and a blacklist of colloquialisms would only catch the
words already fixed here.
pnpm test (228), pnpm typecheck and pnpm build pass; repolint is clean.
REASONIX.md says behavior goes on the controller so all three frontends
inherit it, and nothing read that back. serve is handed SessionAPI, which
declares SwitchBranch, and never calls it: session branching ended up
chat-TUI-only by accident rather than by decision, and 149 more edges are
in the same state.
frontend-parity reads the structure that settles it — a capability at
least one frontend already drives, a frontend whose declared port carries
it, and no call — and ratchets on missing edges, 150 today across 100
capabilities. A frontend whose port does not carry the capability reads
n/a: that scope decision is port.go's, and the compiler already keeps it.
port_segregation_test asks the opposite question at sub-port granularity,
so neither subsumes the other.
The matrix comes from go/types over compiled export data, never from
selector names: Close and Status are capabilities and also stdlib
methods, so a name match records os.File.Close as serve driving
Lifecycle.Close — a false "wired" that hides debt, the one direction a
ratchet must not fail in. It also resolves `ctrl := m.ctrl` in
chat_tui_watchdog.go, which no receiver-name heuristic can. The check is
pinned to CGO_ENABLED=0 GOOS=linux, the CLI's own release build, because
internal/cli carries _windows and _unix files and a GOOS-dependent file
set would put a developer's baseline at odds with CI. Warm, go list
answers in half a second; with no build it fails loudly rather than
passing.
An exception goes in the scope table with an issue and a reason, weighs
what the edge weighed, and lands against this file's own budget, so
declaring one moves debt into a diff a reviewer reads instead of deleting
it. The table ships empty: every row is a decision for its own change.
Verified by removing the cli Cancel wiring, which took controller.go from
87 to 88 and the ceiling from 150 to 151, and failed.
Two things about the baseline diff. Recording a new rule raises every
file it touches from zero, which the ratchet refuses without
-allow-widen; that refusal fired and this is the justification. The same
-update also reclaimed slack the tree had already stopped using and that
only -update can collect: complexity 1562->1529, essay 3276->3250,
file-size 42270->42038, function-size 6728->6639, struct-state 47->41.
One boundary is measured and left open. A capability whose last consumer
goes away leaves the candidate set, so its row retires and the debt falls
instead of failing. A port declaring a capability nobody drives is a dead
capability — 39 of them, 122 edges — and that is orphan's shape, which
orphan cannot see because it counts functions and never methods.
An adopted desktop runtime missed the interactive frontend wiring. Three
entry points put a runtime into a Hub and only two arrived bound: Open wired
its own, RunGracefulListener swept the adopted ones on its way to serving, and
the desktop window takes neither road — it adopts its first pane and serves it
through Handler. Nothing under desktop/ has ever called
EnableInteractiveApproval, and boot does not: its own comment says interactive
frontends do.
So the conversation that pane carried had no Asker, and every ask in it
answered itself with the model-assumption fallback while a person sat in front
of it. A pane opened afterwards went through Open and worked, which is what
made it read as "only new sessions can ask", and why going back to an older
build did not help — the gap is structural, not a regression (#9509, #9527).
Not the approval gate: SetToolApprovalMode already reaches
refreshInteractiveGate, so the ordinary tool gate was interactive. What was
missing is the rest of the contract — executor and runner Askers, the sandbox
escape and managed-config approvers, the planner plan approver.
The invariant moves to the publication boundary. publish knows which runtimes
are local, and a local one a Hub publishes is by definition driven by an
interactive frontend; Adopt binds auth, surface, stance, Grant and the session
lease already, so "the host assembled this runtime" was never "the Hub applies
nothing to it". Open's explicit call and RunGracefulListener's catch-up loop
both go, leaving that method as transport again. A fourth entry point cannot
now repeat this.
No HubOptions.Interactive: the sweep it replaces never consulted Surface
either, and Surface classifies a frontend for usage rather than granting it
capability. Headless already has its own contract in ApplyHeadlessApprovalMode.
The test adopts without a listener — the desktop's exact shape — and follows
the ask through to the answer. It fails on the reported string without the
invariant. A second one publishes a remote runtime, which has no Server here at
all, so the rule stays on the side of the boundary that owns a controller.
One-shot instrumentation, and it is spent. It ruled out the three stable causes
— the binary the runner resolves, ambient ssh_config, and the config the test
writes — and that is the whole of what an isolated probe can say. The finding
lives at the test it explains; the probe itself and its output live in history.
Keeping it would cost no CI time and still mislead: the next reader would take
it for the current diagnostic, when it only answers "is ssh healthy in
isolation", which is answered. A recurrence needs a different instrument
anyway — the full suite running while an external command is timed across Start
and Wait separately, with a light periodic probe recording the latency
distribution — and that is worth building when there is something to point it
at, not before.
The Windows CI failure at 15.50s matched the product's own 15s subprocess
timeout exactly, so ssh was killed rather than refused. A probe on the same
runner ruled out the three things that would have made it a real defect: the
binary it resolves (Windows OpenSSH 9.5p2, not the Git one a maintainer has),
ambient configuration (none of the three ssh_config paths exist there), and the
config the test writes — that exact file answers in 43ms, correctly, and the
test itself passes in 30ms.
What that leaves is convergence, not proof: the failure is workload-dependent,
appearing only while the whole tree runs, and the specific contention is
unidentified. It need not be the CPU scheduler — CreateProcess, Defender, handle
pressure and disk all sit on that path.
So the note says what not to do. Shortening the 15s would make a normal but
loaded machine fail sooner, and reading a timeout as "OpenSSH unavailable" would
unlock a fallback to the embedded parser — which can resolve an alias to a
different host than the user's own ssh, and does so exactly where ssh is slow
for interesting reasons (Include, Match exec, canonicalisation).
If it recurs, the fix is at this level, not that one: the test binds resolution
logic to whether a real subprocess gets scheduled, and those are two failure
domains that can be separated without giving up either.
workflow_dispatch needs the file on the default branch to be dispatchable and
this one lives only on studio, so it fires on a push that touches itself.
TestResolveJumpHostsUsesConfiguredAliasesAndSSHConfig fails there with
`ssh -G "bastion": exit status 1` after 15.50s — the same 15s SSHConfigSource
allows the command, so it was killed rather than refused. The identical command
answers in ~70ms on a maintainer's Windows machine, so this is not a slow
runner.
The probe separates the three things it could be: the ssh binary the runner
resolves (Get-Command -All, where.exe, ssh -V), the runner's ambient config
(HOME/USERPROFILE and every ssh_config path that exists, printed), or the config
the test writes — an empty -F answering fast puts the cause in configuration, a
hang there puts it in the binary. The last probe uses the test's own config with
-vvv and reports elapsed time and whether it had to be killed, so a 15s kill is
told apart from a refusal.
Deliberately no product change. A timeout is not evidence that OpenSSH is
unavailable, and the fallback it would unlock is the embedded parser — which can
resolve an alias to a different host than the user's own ssh would. That is
worth discussing only with evidence about which timeouts are safe, and the
reasons `ssh -G` can hang (Include, Match exec, canonicalisation) are exactly
the ones where the two parsers disagree.
TestTaskToolCancelDuringStuckProviderReturnsPromptly carried two numbers, and
both were guesses. The 50ms sleep before cancel() bet that the goroutine had
reached the provider by then; on a runner where this package takes 215s against
52s locally, that bet loses, and the cancel lands before the stream loop is
entered — a different path than the one the test names. The 500ms watchdog is
what actually failed on Windows CI.
The sleep is gone. consumingStreamProvider hands over one chunk on an unbuffered
channel and never another, so the send returning is proof the run took it: the
test waits for that and cancels knowing the run is blocked on a message that
will not come. It is a stronger point than signalling from Stream's entry, which
would only prove the provider was called.
TestSSHHandshakeHonorsContextWhenDeadlinesUnsupported gets the watchdog change
alone. Its 40ms context is the subject — a handshake honouring a deadline it
cannot install on the socket — so widening that for slow CI would delete the
assertion. The residual race is written down rather than fixed: a slow enough
runner expires that context before the SetDeadline branch is reached, and
closing it needs noDeadlineConn to report the call and a context that still
carries a real deadline. Recorded so the next reader does not remove the timer
the way this commit removes the sleep.
Both budgets now come from testenv.Budget, which is acp's rpcCallBudget moved
where the other packages with the same kind of wait can read it; rpcCallBudget
delegates rather than keeping a second copy.
The draft carried the narrative register the 2.8/2.9 notes use. This is the
document someone reads to decide whether to upgrade and what to re-test, so it
is restructured to be scanned: declarative bullets, one claim each, the
mechanism named rather than recounted.
Nothing is dropped — every change, measurement and issue reference is still
there, and Added grows subheadings so the five features separate at a glance.
Roughly half the length.
Below 1200px the workspace column folds, and the rule that folded it also hid
its divider:
[data-fold~="rail"] .gutter-l { display: none }
The grip on that divider is the only way to reopen the column — keys.ts has no
shortcut — so the session list left the window with nothing pointing at it. The
reporter's screenshot shows exactly that: the right divider's chevron still on
screen, the left edge bare. 1920x1080 at 175% scaling is 1097 logical pixels, so
this is an ordinary laptop, not a corner.
The rule was added believing the column is removed at that width ("a handle for
a column that doesn't exist"). It is not: .app[data-rail="off"] narrows it to
0px, and :792/:795 style that divider specifically for the collapsed state. The
block's own opening comment already said so — collapse, never remove, or "the
only entry left is an invisible shortcut."
The right column had the same hole for a different reason. Hiding .gutter-r is
right while that column is open, because it lies across a full-width row where a
vertical drag means nothing; it is wrong while the column is collapsed, because
the fold hides the column too and the grip is again the only way back. The rule
now says which state it means.
perf/fold.mjs holds both. The invariant is reachability, not the presence of any
particular control: a folded column must either still be on screen or still have
a grip that can be hit — a relocating column satisfies it, a vanished one does
not. Read structurally (display/visibility/opacity up the chain, then
elementFromPoint, because something painted over the grip fails the user the
same way), and the left column is followed through the click to prove the way
back actually works. It found the right column's half on its first run.
panels.mjs asserted the defect — shown(".gutter-l") === false at narrow widths —
which is how this survived. Corrected to the invariant.
Reported as #9507: "the session list is gone, every launch is a new session."
The second half follows from the first — with no way to reach the list, there is
no way to resume.
rpcCallBudget already exists and its comment already names this failure: "a hang
detector, not a latency assertion ... the previous two seconds failed whenever
the tree was tested at once." It was written for one call site and the other 31
waits kept the literal.
They are all the same thing — every one fails with "never started", "was never
called", "timed out waiting". None is a negative assertion waiting to confirm
something does not arrive, so none of them wants a short deadline; a wait that
fires early reports a hang that did not happen, on a runner that was merely
busy.
TestE2EDeleteActiveSessionDoesNotRecreateFiles failed this way on Windows CI
while the full tree ran: two seconds to cover a server start, a session open, a
provider turn and a tool dispatch. The same test, and the whole suite, pass on
the same platform locally.
Also restores 2.9.0.md to the text its tag shipped. Three commits landed after
studio-v2.9.0 was cut and appended their entries to that file, so it described
work no release contained; those entries move to 2.10.0, which is the release
that actually carries them.
The `ask` tool reaches a person through exactly one wire: the Asker that
EnableInteractiveApproval installs on the executor. Nothing in the tree asserted
that wire was live. An assembly that stopped installing it answers every
question with the headless model-assumption fallback — the run decides for the
user instead of asking, and no gate says anything.
Both directions, because either alone can be satisfied by the wrong thing: a
controller with interactive approval on must put the question out and take the
answer back, and one without must return the fallback and must not raise a
question nobody is there to answer.
Reported as #9509 (2.7.0 fine, 2.8.0 and 2.9.0 not). These pass at HEAD, so they
do not reproduce it — they close the hole that let it go unnoticed, and narrow
where it can still be: not in this wiring.
All three had been red on CI since the work they cover landed, each for its own
reason and none of them a defect in the code under test.
- The ACP approval round trip asserted the tool result equalled "written ok".
A call that changes what the host owes now carries the obligation delta after
its own output, so the assertion reads a prefix: the subject is that the
approved tool ran and reported, not what the host appended to it.
- attach's fake machine still answered `command -v reasonix` in the shape
LocateCommand used before it reported `bin`/`ver`/`flag` lines. The bootstrap
therefore saw no kernel over there, tried to install one, and failed with the
npm sentinel — a harness the far side had outgrown, not a broken locate.
ensure_test.go's fake already spoke the current shape.
- browse's helper resolved the temp dir through its symlink and required the far
side to answer with what it resolved to. On macOS it answers with the spelling
it was handed, so both sides are resolved before they are compared: which
spelling comes back is that machine's business, and the test's subject is
which directory it named. The tests skip on Windows, which is why only CI saw
the first two.
VerificationIdentity kept every segment standing before the check, so
`cd /w && ls -la && go test ./...` and `cd /w && go test ./...` were two
identities that could never supersede each other — and a check that just ran
green is exactly the thing that should replace the unreadable run before it.
Its own doc already said what it meant to keep: context, "a segment before the
check decides where and under what it runs". A listing or a status standing
beside the check decides nothing it proves. The identity now keeps only the
segments that set context — an assignment, or cd/pushd/popd/export/set/unset/
source — and drops the rest, as it already dropped everything after the check.
That is the shell's own account of what changes the environment a later command
runs in, read off the parsed argv, not a guess at what a command was for.
TestSameCheckInADifferentWrapperIsOneItem fails without it.
checkContract carried a lazy write: the first caller to ask what the task owed
captured the baseline the task is held to. Every parallel tool call asks as it
finishes, so that first ask arrives on several goroutines at once — -race
reports the read at final_readiness.go against the write beside it, through
obligations -> finishToolExecution -> executeOne -> runParallel.
Two baselines could overwrite each other, and the baseline is what decides
whether the turn's delivery claim stands.
The capture moves to beginRunTurn, where nothing else is running, and the ask
becomes a pure read. That is also the stronger reading of its own rule: the
baseline must come from the pre-image, before any call could rewrite the
declaration it is taken from. Guarding the write instead would have kept a
mutable field on a path that has no reason to write at all.
TestCancelInsideLargeParallelBatchStopsSchedulingNewTools and
TestBuildRegistersUsableHistoryAndMemoryRetrievalTools both go green under
-race; both failed on it before.
Baseline evaluation ran the toolchain once per captured criterion at the end of
every turn. A broad mutation captures every test file in the tree, so a turn
that rewrote none of them still paid a build per file — the model had answered
and the window sat spinning while the host quietly built.
A criterion the workspace still holds byte for byte was run by the project's own
checks; the overlay exists for the ones it no longer holds. Unchanged criteria
now produce no fact and no build, and the first evaluation that does run
announces the checking phase rather than leaving an unexplained wait.
Splitting the wallet onto its own route added the call to sse.ts and left
apiPaths behind, so the request fell through to the assets and the rail read a
404. The route parity test caught it and had been failing since — in a nested
module the root `go test ./...` cannot see, which is where a red test hides
longest. `make test` now runs the shell and the SDK too.
Five holes let a turn answer the gate that was auditing it. Each is closed by
the same move: the fact comes from what the host observed, never from what
execution was free to rewrite.
- A `go test ./...` quoted inside a here-doc body satisfied a declared project
check that never ran. commandSegments split the raw text on separators, so the
body's lines became segments. SplitOutsideHereDoc drops the body and keeps the
commands beside it.
- A here-doc cost the whole command its decomposition, so a turn that ran its
tests next to one read as having skipped them, and `python - <<PY` walked past
the Delivery gate that refuses `python -c`. The shell tables now read the same
fact permission already reads.
- `cd backend && go test ./...` shared an identity with the root run, so a green
root suite cleared a red subdirectory one. Canonicalisation now drops spelling
and plumbing, never the context a segment before the check decides.
- An unclassified receipt took the pipeline's exit status for the check's, so
`go test ./... | tail` could clear the failure it was hiding.
- missingMutation was wired end to end and never incremented. An unprovable
change is now a debt only observation settles; a check that runs afterwards
speaks for the state, not for the effect.
Obligations are derived by diffing the ledger, never announced: nothing can emit
or erase its own debt, and the delta reaches the model with the result that made
it. Delivery stops refusing opaque interpreters — what the host cannot audit is
recorded unproven and owed, not blocked at the door.
Criteria the task began under are the host's. Declared checks keep a captured
baseline the current declaration cannot retract; test criteria are captured from
the pre-image before any call that could overwrite them, and evaluated through
`go test -overlay` against the code that replaced them. A rewritten test passing
answers for itself, not for the bytes it replaced.
Also: the credentials error names the file it reads instead of an env var it
never consults, the MCP rail shows the way out instead of the endpoint's words,
and run --metrics carries the turn's own verdict beside its outcome.
t.TempDir removes its directory once. On Windows a deleted file keeps its
directory entry until the last handle closes, so a test that finished while the
OS still held something it wrote fails the removal as non-empty when every file
is already gone. Measured at ~2% of session saves, always inside 10ms.
testenv.TempDir is a drop-in whose cleanup retries RemoveAll and logs the one
that never frees rather than failing the test. The desktop module cannot import
it, so its 15 files keep t.TempDir.
A turn request has six orthogonal parts — input, the line carrying its
@-refs, display text, the pre-edit original, the resolver, the output format —
plus a sync/guarded switch. Those were spelled out as 40 entry methods:
runRefTurnWithRefsFormat, runScopedRefTurnWithFormat,
runTurnLoopWithFrozenImagesRawDisplay, and so on down the cross product. The
branch that picked between them assigned closures over three variables in two
if statements, which is a data table written as control flow.
Approval had the same shape at smaller scale: requestApproval,
WithReason, WithReasonOptions, FreshDecision, DecisionWithOptions were one ask
and one grant, spread over five names by which arguments a caller happened to
have.
Both collapse to a value. approvalRequest carries tool/subject/args/reason and
the two postures that may answer instead of a human; refTurn carries the ref
turn's parts; orchestratedTurn already existed and now reaches the entry
points. 27 entry methods remain, and the port keeps its public shapes: no
frontend contract moved.
Collapsing the loop layer found a bug. runEditedGoalLoopWithImageRefsRawDisplay
was a copy of runTurnLoopWithPreparedTurn, and when e4e6936b1 taught a turn to
finish what it owes instead of showing a card that only says "continue", it
taught only one of the two. A resubmitted edit that ended short of verification
still got the card. The copy is gone and the edit rides the same loop;
TestEditedResubmitFinishesWhatItOwes fails without the fix.
One asymmetry is left as it was, not fixed blind: the edited branch of
turnLoopRunner still does not bind the turn's output format, where the ordinary
branch does.
Capabilities named 56 methods in one interface — skills, hooks, MCP, network,
shell, permissions, sandbox, config repair, extension UI, provider catalog. The
whole point of the driving port is that a frontend sees only what it drives,
and this one interface undid it: a pane listing skills was handed
SavePermissionRules and SaveSandboxSettings along with them.
It splits along the lines the frontends already use: SlashDispatch, Skills,
Hooks, MCPControl, RuntimeSettings, Extensions. CapabilityScope moves to
Lifecycle, where the workspace it describes already lives.
What that exposes is ACP. EditorAPI embedded the whole surface, so the
transport could reach skill authoring, hook editing and sandbox rules it has
never called. It now names the three ports it drives, and the segregation
guard puts its unused count at zero, from three.
No implementation changed; *Controller satisfies every new sub-port.
A diagnostic, to be reverted. release-signing keeps refusing the studio
line's requests with nothing but "Invalid request to SignPath API", and
the connector returns no validationResult to say which gate closed.
test-signing-ci-approval carries the same two checks — verifiesTrustedBuildSystem
and verifiesOriginPolicy — against the test certificate, so one run says
whether the origin setup is what refuses the line or whether it is something
only the release policy applies.
scripts/verify-windows-authenticode.ps1 came from the retired desktop line and
still described it: six executables at the payload root, a portable archive with
current.json and versions/vX.Y.Z/, and a mandatory -PortableArchivePath the
studio workflow never passed. Studio ships one executable. The step is gated on
HAS_SIGNPATH, which has never been true, so nothing has run it — turning the
gate on would have signed both artifacts and then failed on the verification
that was supposed to confirm the signatures.
It now checks what studio actually ships: the one executable in the payload, the
installer around it, and the copy inside the portable zip — that copy compared
by hash against the signed payload, because a signature check alone would pass
an archive packed from an earlier build that was also signed. The workflow
passes the archive path it was already producing.
Verified on a real Windows host across three cases: all three artifacts signed
and matching passes; an archive holding a different signed binary is refused as
a mismatch; an unsigned payload is refused as missing a signature.
The external services block was the only thing on the rail painted red: an
inset rule down its left edge, and the endpoint's whole complaint set in --err
under it. Three lines of red in a column of grey readouts reads as a dialog
that got stuck in a dashboard.
The rail already has a rule for this and it is written into .drow's tone: the
mark that carries "this is broken" takes the colour, the words describing it do
not. The pip stays red and the count in the heading still says how many; the
rule was a third way of saying the same thing, and the reason now sits at the
size and weight every other secondary line on the rail uses.
Reaching a machine is the gate that rarely fails. A cold connect then installs
a kernel over there, and that is where it stops — and every one of those stops
arrived as an English sentence with no code on it, because HostState.Err is a
string and the refusal-path guard only watches internal/serve. One of those
sentences told the reader to set serve_install = npm, which was not a control
the window had.
internal/remote/bootstrap now has sentinels for the ways putting a kernel there
fails, grouped by what the reader would do about each rather than by which
function produced it: npm is missing, npm installed outside the login PATH, the
local binary is for another platform, nothing is left to try, what landed will
not run, serve never reported a port. desktop/next maps them to dotted codes
through one table, and the wording for each names the next move. Two tests that
matched on error text now match on identity, which is the point of having it.
The host form grows the controls those sentences point at: the install strategy,
the jump host, and the env var holding a password. They were already stored,
already on the wire and already carried through a save — only the controls were
missing, so telling someone to change one was telling them to edit TOML.
And a connect no longer has to be the thing that discovers all this. Probe reads
what a first connect depends on in one session, changing nothing over there:
which machine it is, what is installed, whether npm runs, and for each install
route whether it is open — a closed one carrying the same code a real failure
would have refused with. `reasonix remote test` walks it after the dial it
already did, and every host row in the window has a button for it.
The wallet balance had been reaching the frontend for months with nothing
rendering it, and it rode GET /status — which the desktop polls four times a
second while a turn runs. A network round trip on that clock is what the reader
ends up waiting on, so it answers on its own route at its own pace now: pane
mount, turn end, or a click on the label. Four answers stay apart rather than
collapsing into one number. A provider with no balance_url draws nothing at all
(204) — most providers have none, and a dash there reads as a number that failed
to load. A value standing in past its freshness says how old it is. A wallet
that could not be read carries a code for which failure it was, never a zero.
internal/billing picks its decoder by endpoint host, the way the price catalogue
already does. Moonshot's wallet was silently broken: its response parses as
DeepSeek's shape without erroring and decodes into an empty balance, so a funded
account read back as unusable. A response in nobody's shape is ErrUnreadable now.
Plan.tsx and panels/Overview.tsx had no importer at all. The plan block the
design calls for was written, styled and never mounted, so the plan lived only
in a tool card that scrolls away and a tab you have to switch to. Plan is back
where the design put it, beside the changed files; Overview is deleted with the
six translations only it used.
Both defects were invisible to every check the tree had, so both get a guard.
route_parity holds internal/serve's routes against vite.config.ts's proxy list:
a route missing there answers with the SPA shell, which is indistinguishable
from a broken endpoint and only happens in dev. orphan.test.ts fails a .tsx
nothing imports.
`perf/i18n.mjs` reported six missing English strings in the storage panel. All
six were there. Chinese is a valid JavaScript identifier, so a catalogue can
write either `"占用": "Space used"` or `占用: "Space used"`, and en_storage.ts
writes the second — while the guard's key regex only ever matched the first.
Seventeen keys were invisible to it, six of them reachable from a `t()` call,
and those six came back as "no translation for this".
A permanently red guard is the same failure as a permanently green one: it has
stopped saying anything about its subject and is only saying something about
itself. Nobody could use this one to catch a real miss, because it was already
failing. It reads both spellings now, and the set it builds is 1276 keys —
exactly `Object.keys(EN).length`, which is the check that says the fix is
complete rather than merely quiet.
The regex stays a regex, so it grows the one thing a text-reading guard owes
its reader: it says which lines it could not parse. Any two-space line that is
neither a spread nor a comment and produced no key is listed and turns the exit
code red, so a third spelling cannot be silently rounded down to "missing"
again. Matched by start offset rather than by text — one key's text can be a
prefix of another line, and comparing text would let exactly the line this is
meant to catch pass as read. Confirmed against a computed key, which it names.
The vitest catalogue test never saw any of this: it imports EN and asks the
object, so it was right all along. That is the lesson worth keeping — a guard
that parses source text has to be able to report its own blind spots, because
the tie-breaker is not always sitting next to it.
The composer's border carries a light that travels around it while a turn is
running. Its own comment says the light means "it is moving" and must go out
when the run stops — and it does go out: `.glowring` is `opacity: 0` unless
`.pane[data-run="running"]`. Only the opacity ever stopped. The 150px radial
gradient inside it kept running its `offset-path` loop sixty times a second,
re-rasterising inside a `mask-composite: exclude` layer, from the moment the
window opened until it was closed. `offset-distance` is not a compositor
property, so the whole of it lands on the main thread.
On a 400-turn conversation with nothing running at all: 44.0% of the main
thread and 1.11 renderer cores, against 11.4% and 1.02 with the animation
removed. Unthrottled the same pair is 9.8% / 0.13 cores against 2.9% / 0.07.
That is the shape #9481 reports — CPU that stays high with the window merely
open, and drops the moment it is closed rather than when the work finishes.
The fix is to let the animation and its visibility be the same condition:
paused by default, running only under the selector that already makes it
visible. Idle goes 44.0% -> 11.4% throttled and 9.8% -> 2.9% unthrottled. The
running case is unchanged, which is correct — that is when the light is meant
to be moving, and attempts to make that half cheaper (stepped timing, layer
promotion, a smaller blob) did not reproduce across runs, so none were taken.
perf/idle.mjs is the guard the contract was missing. The performance criteria
covered streaming, scale, and switching, and had nothing to say about a window
that is doing nothing — which is how one always-on animation went a whole
release unnoticed. Two assertions, one structural and one measured: every
running animation must be on an element that can actually be seen (zero
opacity anywhere up the chain, hidden visibility, or no box is a defect no
matter how fast the machine is), and the net cost of animation on an idle
window — the same machine measured again with animation off, subtracted — must
stay inside a budget, so machine speed cancels out and the number means the
same thing here and in CI. The light is asserted in both directions: welding
it shut would otherwise pass. selfcheck.mjs takes it, and both new assertions
were confirmed to go red for the right reason.
Opening a workspace on a remote host meant editing the host book first: type
the path into settings, save, then find the row in the sidebar. Nothing below
the sidebar required that. /remotes/open hands its workspace straight to attach,
and bootstrap resolves ~, an absolute path, or one relative to the login home —
an arbitrary folder has always been openable. What was missing was a way to say
one: the rows the sidebar can click are the union of the host book and the far
kernel's own tree, so a folder written down nowhere could not be named.
attach.Pool.Browse holds the link and nothing above it. Attach's two halves are
already separate — holdLink dials, holdSpace bootstraps — so listing a folder
takes only the first: no reasonix installed, no serve started, no forward bound.
That is what makes picking work on a machine this build has never run on, which
is exactly the machine a folder is being picked on. The connection is released
on a timer rather than at the answer: stepping into a folder is a second call,
and a link dropped between the two re-dials — which on a passphrase-protected
key means asking for the passphrase again.
GET /remotes/{host}/dirs answers folders only, spelled by the machine that owns
them. The parent comes back as a value rather than being cut from the path here:
a Windows host answers a mac with a drive letter and backslashes, and neither
side's path rules describe the other's. A folder larger than the cap says so —
a silent truncation reads as "what you are looking for is not there".
The link layer separates a mistyped path from a link that is down, because only
it sees the file protocol's answer: remote.no_such_folder and
remote.folder_unreadable come from errors.Is against the stdlib sentinels that
pkg/sftp normalises to, not from reading a message. A missing folder arriving as
a bad gateway sends someone to check a connection that is up.
Picking opens, and opening writes the folder into the book. The far kernel's own
list is the better home for it, but it can only be read while something is open
over there — the book is what survives a cold start. What is recorded is the
path the far side resolved, not the one that was asked for: ~ is expanded over
there, and recording the other spelling would list one folder twice. The write
is skipped when the book already holds it, so the common open does not rewrite
the user's config file.
A list that only grows needs an exit, so the folder list gets two narrow
endpoints of its own. The settings page replaces a whole row, which is right for
a form holding every field; a sidebar control that knows one folder must not, or
it sends back blanks for the address beside it. Only a folder this window wrote
down offers the control — one the far kernel reports is that machine's own note,
and dropping it here would take away a row that comes back on the next read.
wire-parity takes port/remote.ts: RemoteHostView, RemoteListing and RemoteFolder
are declared against the desktop's hand-written copies. RemoteHostEdit is left
out on purpose and says why — the kernel still accepts the singular workspace an
old row was saved with, and the page that writes one deliberately sends the list
alone. An under-filled request is not a picture that cannot be read.
Closes#9475
SIGNPATH_API_TOKEN is a repository secret, so it is already readable from this
workflow — the token gate alone would turn signing on the moment this file
merges, and the policy still trusts only main-v2. The next tag would then break
on a signature that cannot be granted yet.
STUDIO_SIGNING_ENABLED is the half no secret can express: SignPath's console has
been told to trust this line's origin. Merging is inert until it is set.
Studio's Windows artifacts were unsigned by construction — the production
SignPath policy trusted exactly one origin, protected main-v2, so a build from
this branch could not request the certificate. The workflow said so and left it
there. On a managed Windows endpoint that is not a SmartScreen warning: the
installer is refused at CreateProcess, and Windows reports it as "cannot access
the specified device, path, or file", which reads as a permission problem and
is not one.
The desktop line's mechanism comes over whole, adapted to what Studio ships.
Signing is two-staged for the reason main-v2 states: signing only the finished
NSIS container leaves reasonix-studio.exe unsigned on disk after installation,
which is precisely what reputation and ML heuristics quarantine. So the
executable is signed while it is still a loose file, the packages are rebuilt
around those exact bytes, and the container is signed second — with the
artifact configuration verifying the payload's signature rather than trusting
this workflow's ordering.
studio-build.sh grows the seam that makes that possible: --windows-payload
builds what a user runs and stops, --windows-package builds the zip and the
installer from a payload directory it is handed. The one-shot platform path
composes the two, so an unsigned build and a maintainer's local run are byte
-identical to what they were.
.signpath/ carries this line's own contract — branch studio, workflow
release-studio.yml — and cmd/signpath-contract validates and fingerprints it
before anything is built, so a widened origin fails at the gate rather than at
the signing request. Its branch pin is studio rather than read from the file it
checks: a guard that reads its own answer out of its subject cannot guard.
Signing engages only when SIGNPATH_API_TOKEN is set, mirroring the APPLE_* gate
— forks and token-less runs still build, unsigned.
This cannot take effect on the repository side alone: the release-signing policy
in SignPath's console still trusts only main-v2, and until the studio origin is
added there every request from this workflow is rejected. See the PR body.
TestApplyLocalSkillLinkMode asked runtime.GOOS, and asked it after asserting
resp.OK — so a machine that cannot create a symlink failed on the refusal the
tool had correctly reported, rather than skipping. Windows allows symlinks under
Developer Mode or elevation, which the platform name cannot tell apart from a
plain account, so the check is now the read three cases in this file already
make: try it, and skip on the error the filesystem gives back. A Windows host
that can make one now runs the case instead of skipping it.
Also ignore *.exe~ — what the linker leaves when it cannot replace a binary that
is still running, which on Windows is every rebuild while Studio is open.
The shelf's pills were ordinary flex children, so a row one pixel short of
fitting squeezed them instead of wrapping — and Chinese breaks between any two
characters, so 计划 came apart into two lines and took the row's baseline with
it. A pill is now its label's width or nothing: the shelf wraps, which .row
already allowed, and the send button's auto margin keeps it at the right end of
whichever line it lands on. Verified from 980px down to 320px: one line, two,
then three, with nothing broken at any of them.
The model pill is the one control with no width of its own — a gateway can
publish an id longer than the shelf — so it gives up characters before the
shelf gives up a line, and the ref it was shortened from stays in the tooltip.
Closes#9455
The attach pool has always keyed spaces by workspace and named a forward per
one; the far kernel remembers every folder a pane opens and answers /tree with
all of them. Only the book could name a single directory, so nothing could say
the second one — and cold, before a pane exists to ask through, the sidebar had
just that one row.
RemoteHostEntry gains workspaces beside workspace, folded by WorkspaceList into
one default-first list so a row that only ever set the old field is a list of
one rather than a case every reader repeats, and an upsert makes the head of
the list the default the CLI still connects to. The sidebar shows the book and
the far tree together: a folder added here and never opened over there stays,
and one opened over there appears without being written down here.
The [remote] renderer moves to render_remote.go — the section is one subject,
and the function it came from is already the longest in the package.
Closes#9459
The kernel replays a pending ask/approval to every client that attaches, and
the window then overwrote its items with what /history rebuilds — where the ask
tool call is deliberately drawn as nothing, because ask_request carries the id.
The pane sat at 等你决定 with nothing on screen to decide and the queued turn
behind it never dispatched. A prompt is not part of the record; it is the run
stopped waiting on an answer, so it rides across the rebuild. prompts.ts also
gives one its kernel id, so a replayed frame is the same card rather than a
second answerable copy, and an answered one is not reopened by the frame log.
SandboxSettings carries effectiveBash beside effectiveWriteRoots, so the pane
draws what the confiner will do rather than what was configured: an unset mode
enforces everywhere but Windows, which runs unconfined however the file reads.
The segment for a mode this host cannot run is visibly dead and carries its own
reason — `disabled` alone kept the hover of a live control and then swallowed
the click, which is what was reported as broken. Enforce-without-a-backend
refuses by code rather than by a hand-written sentence, and the SandboxSettings
mirror is declared to wire-parity so the next field cannot drift.
Closes#9454
errmsg and the refusal-hint test, instruction's resolver, and the i18n message
tables the two of them read from.
Accumulated working-tree work, committed as found; the tree builds and passes at
the tip.
install, launch, platform and the Windows shell case behind one bootstrap, with
the hardening and pure-function tests that let it be exercised without a machine
on the other end, and the hub and CLI entry points that reach it.
Accumulated working-tree work, committed as found; the tree builds and passes at
the tip.
reasoning_replay for OpenAI and Anthropic, the h2 reset case, stream_failure and
the retry path around them, with doctor reporting what the provider actually did
so a broken stream is diagnosable instead of just slow.
Accumulated working-tree work, committed as found; the tree builds and passes at
the tip.
The palette, the picture-less sky and the ray/cloud tints the Studio design was
drawn against, as a pack the kernel serves rather than something a user has to
install to see the app as designed.
Accumulated working-tree work, committed as found; the tree builds and passes at
the tip.
RunStrip was one strip carrying every reading. It splits into panels — Overview,
Runtime, Cache, Cost, Context, Agents, Files, Jobs — with derive.ts doing the
walk once in the pane and kit.tsx holding the shapes they share, so a reading
that grows does not widen a row every other reading has to live in.
Alongside: Sky draws the backdrop a theme pack asks for rather than placing a
picture, Nav takes the icon rail, Timeline and Task give the trajectory and a
subagent their own views, AccountRow the account, and prefs/keys/trailing carry
the state, the bindings and the tail the panes were each keeping privately.
perf grows three scripts: selfcheck, which pushes a false assertion into every
guard to prove the guard can still go red; sourcemap, which turns a minified
frame back into a source position; and switchprof, which samples the cost of
opening a long session. look and verify grow the assertions they were missing.
This is accumulated working-tree work, not written in the session that committed
it; the message describes what is here rather than the reasoning behind each
piece. The whole tree builds, vets, typechecks, and passes its tests and
repolint at the tip.
Both stand for a failure that stayed silent while every other gate was green.
tokens.mjs: a var(--x) with no fallback has to name something someone assigns.
CSS drops the whole declaration when it does not, and the property falls back to
whatever was inherited, which reads as the design. Two of those were live in the
tree — the connection prompt's scrim named a --bg that has never existed, so it
had blur and no dimming at all, and the usage panel's --fg meant its text colour
never landed. Both lists are read from source, the stylesheets' own `--x:` and
the per-element ones JSX writes into style, because a hand-copied list rots.
shipped.mjs: dist must be newer than everything under src. A build can succeed,
print its tick, and compile something else — this tree has more than one process
on it, and a stash that put it back to HEAD for forty-eight seconds was enough
for one build to fall inside the window and produce the previous release. The
window then loaded it and the whole interface reverted, while the tests stayed
green: they read the source. Timestamps rather than marker strings, because
"the artifact is older than the source" is one sentence that cannot rot.
Both were mutation-tested the way selfcheck.mjs asks: a var nothing defines
turns tokens.mjs red, touching a source file turns shipped.mjs red, and a
PERF_SRC that points nowhere fails loudly instead of passing quietly.
Six things, and four of them were defects rather than taste.
The window opened on a blank page. index.html now paints a boot screen before
the bundle it would otherwise wait for exists: the wordmark written on letter by
letter in gilt and settling to ink, the sky the theme packs draw, and one line
saying the kernel is being reached. main.tsx hands the window over when the
intro has finished rather than after a counted delay, so a fast kernel does not
flash it and a slow one is what it is for. It carries its own palette because
tokens.css is a bundled import that does not exist yet at that point.
Settings becomes a sheet over the workspace instead of a second full-screen
window. That removes the duplicate: .prefs-hd used to be a title bar too, with
its own drag region, its own traffic-light inset and its own window controls.
The window frame is .chrome and only .chrome now, and the veil starts below it,
so the window can still be dragged, minimised and closed while settings is
open — a modal that traps the window buttons is not a modal. Its contents list
grows the design's marks and groups, and reports what each section is worth:
storage in bytes, usage in tokens over the window Usage itself opens on, the
build running.
The segmented control was a full-width strip of underlined tabs at all sixteen
call sites. It is an inset track with the selected cell lifted out of it, which
is a control's size rather than a navigation bar's, and section headings shrink
to overlines so the rows under them carry the weight.
Then the defects:
- A theme's picture is body::before at z-index -2, and it is visible only
because an uncoloured html hands the canvas to body's background. The boot
screen's stylesheet had coloured html, which takes the canvas over and
demotes body's to an ordinary element paint — landing on top of the picture.
A wallpaper simply stopped appearing. boot.test.ts fails any rule that puts a
background on html or :root, because nothing else was watching that file.
- The cost panel's sparkline was a black rectangle. Spark's fill and stroke
rules were written under .rate, the throughput row's scope, so the cost
panel's copy matched none of them and an SVG with no fill declared is filled
black. The colours belong to the mark; only the throughput row's geometry
stays scoped. The panel's wrapper stops sharing the component's own class,
which is what let a wrapper's layout land on the drawing inside it.
- A picker's menu jumped to the bottom of the window before fading out. Its
anchor name hangs on [aria-expanded="true"], which flips the instant the menu
is asked to close, while the menu is still on screen; with no anchor left to
resolve, an anchor() without a fallback invalidates the whole declaration.
The fallback is the same 100% the non-anchored rules have always used.
- Every view swap cross-faded a snapshot of the entire document. Only the
swapped element carries a view-transition-name, which swap.ts says in a
comment, but the root kept its own default name — so closing settings dipped
the whole window and brought it back. :root opts out.
The preview itself is a sheet in the same family, portalled to the body because
under a wallpaper the side column carries a backdrop-filter and that makes it
the containing block for anything fixed inside it. Rows in the changes list
become buttons carrying git's own letter, coloured by what it means.
--fg was read six times in the usage panel and has never been defined, so those
declarations were dropped and the colour fell back to whatever was inherited.
It is --text. bytes() ran to MB and stopped, which is how a 9 GB total read as
"9318.4 MB"; it runs to TB, and Storage stops carrying a second copy of the
rule that i18n/format exists to hold.
The rail lists what the tree differs by, and until now that was all it could
say: a path and a porcelain letter. What the file actually differs by lived
only in the tool events of the turn that wrote it, so a change made before this
session — or by a shell command no event describes — could be named and not
read.
gitstatus.Diff answers for one path. It measures against HEAD so a staged edit
and an unstaged one read as the single change they are to a person. An
untracked file has nothing in HEAD to compare with and is diffed against the
null device instead: that is the only way git prints it without first writing
to the index, which a read must not do.
The path arrives from a client, so safeRel keeps three shapes away from git —
outside the tree, absolute, and readable as an option — and every invocation
puts it after "--" as well. ErrPathOutsideTree is a sentinel because the caller
has to tell a bad request from a broken repository; over HTTP they carry
changes.path_outside_tree and changes.diff_failed, and the frontend has words
for both.
root goes through gitcmd's dir parameter rather than an "-C" argument. gitcmd
hardens a subcommand it can see at args[0], and --no-ext-diff/--no-textconv are
exactly the flags a diff against someone else's repository needs: a repository
config can name a program git then runs during an ordinary read.
The desktop shell needed telling too. Its route table lists families rather
than leaves, so /changes/ joins the prefixes — without it the shell answered
/changes/diff with index.html and the preview would have failed on a body that
parses as HTML. TestEveryRouteTheKernelRegistersIsRouted caught that before it
shipped, which is what it is for.
routes() moves to routes.go. serve.go sat exactly on its file-size budget, so
one more registration line broke it, and the budget is not there to be widened:
the route table is every path this server answers, which is a subject of its
own rather than a section of the file that assembles the server. serve.go drops
from 1459 lines to 1365.
packagesFor took the directory of a declared file with filepath.Dir, which
on Windows answers `internal\control`. That is not a pattern go test can
match, and it sorted the list wrong on the way out, because a backslash
outranks a slash — one root cause, two symptoms in the same assertion.
The gate itself runs on ubuntu, so nothing it gates was affected; its test
runs on the whole matrix, and has failed windows-latest since the gate
landed. A declared glob and a go package pattern are both slash-separated
whatever the host is, so both reads move to path.
Windows groups a taskbar button and routes a toast by the process's
AppUserModelID, and the Start Menu shortcut has to carry the same one or
the notification is dropped. The two calls that set both lived in the
retired shell. When it went they lost their caller, and the sweep that
deletes unreferenced exports took them — leaving internal/notify sending
toasts under an identity nothing claims, and six unused findings on the
GOOS=windows lint leg, which the sweep's own host-GOOS run never saw.
Restored and called from the window's startup, before the first window
exists, which is when Windows reads it. The call site carries no build
tag: identity_other.go already answers for every other platform.
A host decorates its pane's sink once — the status icon's fold, desktop
notifications, usage counters — and builds the controller on it. That
decoration lived only at the build call site, so every path that rebuilds
the controller wired the replacement to the bare broadcaster and dropped
it: a model or effort switch, an extension reload, a workspace change,
and saving a provider credential, which is the first thing a new install
does.
Nothing corrected it afterwards. A switch is refused while a turn runs,
so the last event those observers saw was the previous TurnDone, and they
stayed on it for the pane's whole life. The tray reported "nothing
running" through a fourteen-minute turn.
The Server now carries the sink its controller emits into, so the thing
that rebuilds owns it rather than the call site that happened to build
first. build and rebuildWith move beside the options they read; the file
they left is over its ceiling and had no room for the addition.
The test fails on the old code for both rebuild paths with the reported
symptom: the pane's decoration sees none of the replacement's events.
Reported in #9448. The paint ordering fixed in db030ad0 is a real defect
but needs two panes changing at once, and is not what that report shows.
Both have failed every run of CI's windows-latest job since the corpus
landed, and neither is a flake.
gen-topo-cycle timed each call with signal.alarm. Windows Python has no
SIGALRM, so the grader raised while installing the handler, before it
graded anything. A daemon worker thread keeps the semantics exactly —
_Timeout on a hang, the original exception re-raised, so the cyclic case
still reads ValueError — and cannot hold the interpreter open at exit.
gen-csv-quotes compared cli.py's stdout against an expected string.
Windows Python writes CRLF in text mode, so that comparison could never
hold; the carriage returns come off first, because the grader checks the
fields and not the host's line endings. Its mktemp template also read
TMPDIR, which under Git Bash is a Windows path — the rest of the corpus
asks for a bare mktemp -d, and now so does this one.
The modernize pass reports two findings on this file, and they fail both
`make lint` and CI's lint job. A strings.Index used to slice a prefix off
is strings.Cut, and ranging over a Split is SplitSeq.
Two panes changing at once take their folds under the lock and report outside
it, so the two reports could reach the icon in the opposite order. The one that
lost left the icon describing a state the tracker had already moved past, and
nothing corrected it: the fold reports only what changed, so a wrong paint
latched until the next real change. A pane running a fifteen-minute turn is
fifteen minutes of a tray that says nothing is running.
Painting is now serialised and describes the fold as it stands when it paints,
so a report that lost the race repaints the truth instead of overwriting it.
The test fails on the old code with the reported symptom exactly: the icon
shows Working:0 while the tracker holds Working:1.
Reported in #9448.
The review gate read one index for two questions — what the change set is,
and how fresh a review of it must be — so a later harmless write moved the
window past everything before it. A sensitive edit followed by a README write
scored Low and dropped the whole structured-review demand.
UnreviewedMutationBaseline now answers the first question and the latest
mutation still answers the second. It advances per review kind, so an accepted
review does not discharge security_review's obligation with it.
Alongside, the parts of that gate that promised more than they did:
- A blocking verdict is honored at every role setting, and review subagents
submit the typed report everywhere. A verdict a caller must act on carries
an identity, not a sentence. The nudge runs everywhere too; the hard failure
stays in Delivery, since outside it no report is no block either way.
- Medium no longer demands a structured review "or" host-proven
self-inspection. That was no alternative — the reader there is the author —
so the cheap side was always taken and the demand never bound. The real
requirement inside it moves to the self-inspection gate and grows teeth:
inspect every changed path, fresh per path, not one of them.
- warn findings were collected into a slice nothing read. They now reach the
user, and they are collected from any review the turn ran rather than only
from one the gate asked for.
- verificationGapResult.advisory carried no text and reached nobody while two
comments called it reported. The waiver it stood for is right and stays; the
flag wearing a message's type is gone.
The review and security-review bodies stop hardcoding git: fileutil owns one
declared store table, environment reads it, and a skill subagent's prompt now
carries the workspace fact its parent always had. They also drop the ~12-call
self-cap, which was well under the host's real budget, and split the burden of
proof — adversarial about what must be read, conservative about what may be
reported. A pass is a negative claim and owes what any other does.
complete_step: manual evidence no longer stands alone in a turn that already
has receipts. The evidence ablation arm reaches the tool schema, so the two
arms stop paying the same prompt and the A/B can answer for the contract
rather than only for the gate.
agentgraph's own account of why it exists is that every consumer folds the same
deltas, so the graph a headless run reports is the graph the desktop draws. The
desktop's fold is a second, hand-written copy — the type and the merge both —
and nothing checked the two carried the same fields. Adding one field to the
kernel this week meant remembering to add it in two more places by hand. The
next person will not remember, and neither toolchain will say so: they are
compiled separately and meet only at runtime, over JSON.
wire-parity reads the Go struct's json tags against the TS interface's
declarations and fails either direction — a field one side sends and the other
cannot read, and one it reads that nothing sends. A field the encoder skips is
not on the wire and is not demanded, so an internal field costs nothing.
The pairs are declared rather than inferred, for the reason the sensitive paths
are: no spelling tells a mirrored contract from a struct that merely carries
json tags. Only the graph is declared today, because it is the one that claims
both sides fold identically.
agentgraph's own account of why it exists is that every consumer folds deltas
with the same Apply, so the graph a headless run reports is the graph the desktop
draws. The desktop's fold is a second, hand-written copy of it, and nothing
checks the two carry the same fields — a wait cause published by the kernel and
unknown here is a node the picture cannot say anything about.
The type is what holds it: dropping it fails the typecheck through this fold and
its test. The merge line is consistency with every other field rather than a
defence — an absent key already survives the spread.
Rendering is left alone. Every site that would show it, and the strings it would
need, are mid-change in the working tree, and this is one row away whenever that
lands.
Queued was one word for three constraints with two remedies. Two are session
settings — the total sub-agent ceiling and the concurrent-writer ceiling, which
binds a writer while total capacity is still free — and the third is a write
path someone else already holds, which no setting releases: only disjoint paths,
or an edge that orders the pair. The scheduler was the only thing in a position
to tell them apart, and it answered in a sentence built for one caller's error
message, so nothing downstream could.
WaitCause joins the graph's vocabulary beside NodeState and Grant, canStartLocked
returns it instead of prose, and an acquire that has to wait reports it once —
after the unlock, because the callback reaches a sink the scheduler must not be
holding its mutex for. The cause survives the run starting, the way the stamps
do: the state says running now, this says what it waited on.
The fan-out price splits with it. One figure summed every wait between ready and
running while its name said the concurrency ceiling caused it, so a member held
behind a claim was quoted back as a reason to raise a ceiling that would not have
moved it. Two figures now, because there are two answers.
Both fan-outs take the same pair of hooks from one place: the two moments only
the scheduler can report are published by one thing rather than copied into each
producer.
parallel_tasks takes a model and an effort per task, so two members of one group
are not necessarily the same worker. The graph drew them as if they were: a
fleet node carried the profile, model, effort and grant its item ran under, and
these carried a label and nothing else. A reader asking why one arm of a fan-out
cost more than another had nothing on the picture to answer with — the tool
offers the distinction and the graph erased it.
The identity is resolved once, in the loop that was already building the labels,
rather than again inside each item's goroutine.
A run can be told to finish its list by two host prompts: the readiness
continuation, and the Goal FSM's "signaled complete but issues remain". Only the
first was ever taught which actions the completion guard lets through. The Goal
path still ended with "use todo_write/complete_step to mark done" — the one
action the guard refuses — so a run reading it beside the requirement it embeds
was handed the open door and the shut one in a single message, and heard about
neither turn exit.
Both now append one string. Owning it once is the point: the failure here was
two copies drifting apart, and a third copy is what let them.
That third copy was the requirement's own. Every path that shows a requirement
to a model goes through one of these two prompts, so its ways-out sentences were
read twice, in two wordings, inside one message. Its other readers — the ACP
turn outcome, the recovery card — are host- and user-facing, and were being
handed instructions written for a model.
The argument contract read which fields a call supplied and never what it put in
them. A field with the right name and the wrong kind was therefore neither
unknown nor missing: it passed every check the host makes, and the answer came
from Go's unmarshaler — "cannot unmarshal string into Go struct field .evidence
of type []agent.blockedEvidence". That names the host's types rather than the
caller's mistake, and it costs the round trip that discovers it. A live run
spent one that way on conclude_blocked before it even reached the two it spent
on the field names and the evidence itself.
The schema already declares each property's kind and the arguments already carry
one, so comparing them is the same structural read the contract was doing on
names. A mismatch now refuses the call before permission is consulted, for the
reason the missing-field case already refuses: execution was never possible.
A null is not a mismatch, and a property whose schema declares no type leaves
the question unanswered rather than broken — the contract may only report what
the schema actually said. The hint drops "it accepts ..." for a pure mistype,
because the field is accepted and listing the accepted names answers a question
nobody asked.
The contract is read after proxy resolution, so a tool reached through
use_capability is compared against its own schema and refused the same way; a
test pins that, because reading the call order is how you get it backwards. An
on-demand MCP tool declares no properties and the contract stays silent on it. A
connected one is compared against its server's schema — the same trust the host
already places there by refusing a call that omits a field it marks required.
addTurnExitTools registers the two ways a turn ends on the model's terms rather
than the host's: ask for a decision only the user can make, conclude_blocked for
a task that cannot be done as specified. The host's own account of the ways out
named only the second. So a turn that ended by putting a question to the user
was continued straight past it, and the run — told in the host's voice that
there were exactly three doors and that none of them was "wait" — answered the
question itself and said so in the transcript.
Naming ask closes it, in the requirement and in the continuation alike, with the
rationalisation it has to beat spelled out: not having heard back is not an
answer to assume one from.
The escape that used to exist was an accident. The stall counter compared the
gap against the best round so far, and a run waiting on an answer could not
shrink it, so two rounds handed control back. Scoring the continuation against
the previous round's signature instead removed that side effect without
replacing it with a deliberate one.
Nothing here reads the wording of what the model said. The signal is the
declared turn-exit set, which the host was already free to name and did not.
The fleet plan proved a dependency DAG and published it, and the scheduler that
decides which item actually runs never saw it: an AcquireRequest carried a write
claim and a label and no position in the graph at all. So a slot went to whoever
queued first, which is how the head of the longest chain ends up behind leaves
that unblock nothing — and that wait lands on the run's makespan one for one.
It is the loss fanoutMetricsOf already prices as wall above the critical path:
measured every run, acted on by nothing.
The plan now measures each item's rank, the longest chain of dependents below
it, and carries it to the acquire, where the pump drains waiters heaviest first
and keeps arrival order within equal weight. That covers every grant after the
session's slots are full, which on a fan-out wider than the ceiling is nearly
all of them.
It does not cover the first fill, and sorting the launch loop does not either.
Which of a burst of goroutines reaches the scheduler first is the Go runtime's
decision: launching heaviest-first captured 41.8% of the ideal first-fill weight
against declaration order's 51.9% at a ceiling of two, and tied at one and three
— never better, sometimes worse, because the runtime favours the goroutine
created last. The loop is left alone and says why.
A run also queues before it builds rather than after. It used to construct the
whole child — registry, runtime, and the transcript that holds a store lease —
and only then join the line, so a fan-out wider than the session ceiling held
one open per item it had not started, and every millisecond of that setup was
billed to a concurrency ceiling that had not caused it. Foreground runs hold the
slot from before the transcript exists; background ones still return a job id
first and queue inside the job. Deriving the request moves to slot.go, the file
that owns the acquire.
Delegation makes three claims and upstream-edge can only settle one: both of
its tasks are strict chains, so their speed-up is 1.00x by construction and no
scheduler decision is observable in them. fanout-width fixes a shape whose
three research items share nothing, which leaves the session concurrency
ceiling as the only thing deciding whether they overlap — so the serialised arm
needs no ablation flag, only max_subagent_concurrency = 1.
Each subsystem retires nine of ten modules and names the live one in entry.py,
so a grep over the markers returns ten candidates and answers nothing.
inboxEventSink hand-forwarded seven optional sink capabilities and missed
three, so every child run's receipt died one wrapper below the sink that
accounts for it. A benchmark then reported four fleet members as a task one
agent had solved by itself, and the whole delegation section rendered empty
while its owning tests stayed green — which is the failure AuditForwarder's own
doc comment already described. Embedding it is that comment's remedy: a channel
added there now reaches this wrapper without editing it.
The graph already carried every stamp a benchmark needs and nothing folded
them, so delegation was reported as a count of children and never as what the
shape bought. Work against wall is the speed-up; the critical path is the floor
the declared dependencies impose, and wall above it is scheduling loss; slot
wait is what the concurrency ceiling cost members with nothing left to wait for
— the one wait no edge on the graph can draw.
The effect test now pins the stamps themselves. Without them every figure here
folds to zero, which reads as a fan-out that took no time rather than as a
measurement that never happened.
The pane already replayed the trajectory into the graph reducer, but the wire
log dropped every graph_delta on the way to disk, so a reopened window drew a
run that had waited on nothing. A dependency and an adopted answer exist
nowhere else in the stream: unlike a tool mark, they cannot be re-derived.
Studio never called crashreport at all — only the CLI did — so not even a Go
panic was recorded. That is the smaller half. Every Studio crash reported so
far has been a fatal signal inside GTK or WebKit, which no recover can reach:
the runtime writes that trace straight to the descriptor, so a tee on
os.Stderr would keep every log line and lose the only one worth keeping.
So stderr is redirected, not wrapped. The window opens a log under
<home>/logs and dups it onto the descriptor, keeping a copy of the terminal
first when there was one, so running Studio from a shell still prints. One
log per launch, newest few kept: a crash is reported after a relaunch, never
during the run that produced it.
Linux uses Dup3 rather than Dup2 — linux/arm64 has no dup2 syscall at all.
Windows says it cannot instead of pretending: it resolves the handle its
crash writer uses once, at start, so moving os.Stderr afterwards would move
the window's own logs and not the trace. There the log still gets those.
crashreport can now name the host it came from. sanitizeReport overwrote
Source with "cli.go" unconditionally, so a Studio report would have arrived
claiming the CLI and sent whoever read it to the wrong code. The set is
closed rather than free-form, and the CLI's own reports are unchanged.
Motivated by #9408, where the crash is inside cgo and the Go traceback stops
at gtk_main(). The only trace anyone has is there because the reporter
happened to launch from a terminal.
A census of the 78 fields, by where each is written rather than by reading
the names: 37 are bound once in New and never reassigned, and the rest change
while the session runs. Both kinds sat in one list, so c.policy and c.turn
read alike at every call site and only one of them can change under you —
which is the question anyone reaching for c.mu has to answer first.
The 37 move into an embedded controllerDeps. Embedded because field promotion
keeps all ~720 c.field reads resolving unchanged: the point is to make the
lifetime legible at the declaration, not to rename the package. Controller's
own field list drops to 42.
Two fields that qualified by the write test stayed out on purpose. commands
is an atomic.Pointer and externalFolderToolRefs sits with the mutex-guarded
map it belongs to; filing either under "never rebinds" would read as "not
concurrent", which is the opposite of true.
repolint reclaims struct-state 5, file-size 123, function-size 5 and essay 6
— the scalar debt recorded against controller.go was exactly this mixing.
Tests, vet, and -race on the package all pass unchanged.
The memory panel has always told the reader that saving "records a new
revision; the old one stays". Nothing in the UI could show that history or
step back into it: GET /memory/revisions and POST /memory/restore were both
served, both had Controller port methods behind them, and the frontend never
named either — the promise was there and unverifiable.
An entry past its first revision gets a history control; opening it lists the
revisions behind the current one with their dates and bodies, each restorable.
Restoring appends a revision rather than rewinding to one, which the panel
says, because a restore that dropped later revisions would destroy the very
version a reader opened the history to compare against.
The fixture kept only the latest revision, so a panel driven by it would have
shown an empty history and proved nothing; it now keeps what a save replaced,
the way the store does.
Verified in the running Studio through CDP: editing an entry produces
revision 2, the history lists revision 1 with its original body, and
restoring it leaves the entry on revision 3 carrying revision 1's text with
both older revisions still listed.
REASONIX.md calls these paths the ones where a wrong change is "a hole in a
boundary". Measured, they were the least-tested part of the kernel rather
than the best: shellsafe 59.3%, shellparse 63.6%, sandbox 69.4%, netclient
47.2%, against a tree median of 76.5%. The code deciding what the agent may
execute and reach had the weakest evidence that it works.
The gate reads the same `sensitive:` bullets the runtime reads for its
review requirement, so a path is declared once and gets both effects — there
is no second list to fall out of sync. Floors are per declared path and
measured from the coverage profile per file, not per package, because
`internal/control/approval.go` is sensitive while the package around it is
not; measured on its own it is 93.9%, which no package number would show.
Floors ratchet in the opposite direction to repolint's budgets and for the
same reason: raising one is free, lowering one needs -allow-drop and a
reason in the PR. They record what is there today rather than an aspiration,
so the gate is green on arrival and only fails on a regression.
Verified by removing one shellsafe test file: the gate reports 47.3% against
its 59.3% floor. Adding an unrelated `sensitive:` line puts that path under
the gate with no other change.
Two fixes and one sweep, all from the same audit.
The process history catalog was never closed. boot's cleanup releases LSP,
plugin hosts, the runtime scope and session temp; the catalog's own
Flush/Close had lived in the retired shell and were left to two test files.
It is process-wide, shared by every pane and workspace, so it closes at the
process boundary next to the usage catalogs, not with any one controller.
Queued index writes are drained first — the reopen after an unclean exit
re-scans every root instead.
The sweep removes 57 exported functions with no reference anywhere in the
tree, tests included, plus the private helpers that fell dead behind them.
Iterated to a fixpoint: deleting a function exposes the next one, and both
the orphan rule and golangci's unused ran again after each round until
neither reported anything.
The rule learned two things from being wrong here. Methods are now out of
scope: chatTUI.Init is bubbletea's tea.Model, no file in the tree names it,
and proving that needs type information an AST pass does not have — the
first attempt at this sweep deleted it. And an orphan tests still reference
is reported differently from one nothing references, because they need
opposite fixes: repair.PrepareFileUpdate is a cross-package fixture eight
test files build state with, and deleting it was the second thing that
attempt got wrong. Only the unambiguous half is deleted here; the 124
remaining stay recorded.
The last-known-good snapshot died because deleting one frontend left its
callee behind with the implementation, the tests, and the doc comments all
intact. Nothing in CI reads "has a caller", so the tree stayed green for
eight days while a recovery path read a file no longer written.
The orphan rule counts callers across the whole tree, which is the part a
single-module analysis cannot do: desktop/ is its own module and a real
consumer of internal/, so a scan that stopped at the root module would call
its APIs dead. Two things deliberately do not count as callers — tests,
which are what keep an orphan warm and green, and doc comments, which are
what make one look wired. Both are checked by tests here, because both were
true of RecordHealthyConfig.
Test-support packages are exempt: their exports cannot move into _test.go,
so having no production caller is their normal state.
328 existing orphans are recorded as the ratchet baseline, not fixed here.
Verified against the original accident: reverting the fix from the previous
commit trips the gate on RecordHealthyConfig by name.
Recovery reads a snapshot nothing had written since the Wails shell was
deleted. That shell held the only two RecordHealthyConfig calls, so from
908bc3ec0 on the read paths in config/load.go and config/unparsed.go kept
restoring whatever config was current that day. On this machine the file
was 16 days and 161 diff lines stale, and `doctor repair --apply` would
have written it back over the live config without saying so.
The shell proved health with "the window became visible", a signal only
Wails had. A successful assembly proves the same thing for every frontend,
so the record rides BuildRuntime, which reload goes through too, and CLI /
serve / Studio inherit it instead of each re-wiring it. Options.Version is
the host declaring a real installation; embedded and test assemblies leave
it empty and write nothing. The writer is already idempotent — unchanged
config hashes to the existing snapshot — so every start can call it.
Both recovery paths now date what they are about to trust: the load warning
carries the snapshot's age, and doctor repair prints it before --apply
rather than after.
Options moves to its own file, which is what pays for the new field: boot.go
drops 128 lines and the tree reclaims 176 file-size, 21 function-size, 15
essay and 3 complexity of budget.
Verified against a real binary: assembly writes the snapshot and stamps the
ldflags version, a second run adds none, and a broken config reports
"--apply would restore a snapshot 16 days old".
govulncheck reported seven reachable call paths into the 1.5.0 advisories —
the feishu adapter's socket, and two readers that reach a compressed frame
through io.ReadAll. It now finds no vulnerability this code calls.
collectSink appended to an unsynchronised slice and handed the slice itself
back. That held while a turn was the only thing emitting. It stopped holding
when the inbox gained a change listener: the store notifies from its own
goroutine, so six tests began failing under -race — both stacks inside the
helper, one appending while the other read.
It appends under a lock and returns a copy taken under the same one. The race
was never in the controller; the harness had no way to say so.
One cost line mixed the rounds that carry the session with the single-purpose
calls beside them — titles, digests, classification. They scale differently, so
a run that got dearer said nothing about which half moved.
The split is by usage source and named the other way round: the conversation
sources are listed, so a source added later counts as auxiliary instead of
falling out of the split with nobody noticing.
Failing the pristine seed is only half of an authored task. A grader that can
never pass is indistinguishable from one with no solution: every attempt scores
zero, and a corpus of those teaches that nothing is ever accepted. Tasks that
ship a reference solution are now checked against it, and a generated task that
cannot satisfy its own grader is deleted rather than patched.
The generated tasks live apart from benchmarks/e2e on purpose. That suite is
the instrument every cross-version comparison is read against; mixing new
tasks into it would change what those numbers mean.
Recorded runs are only training data once someone decides which ones were any
good, and the run report already holds that verdict. sft mode reads the two
together: the report decides what is exported, the trajectory's run header
supplies the prefix each sample was produced under.
A run without a header is skipped rather than exported against a guess at what
its prompt and tools were.
A trajectory held the event stream and nothing from the request side, so a
reader could see what the model said and never what it was asked — the system
prompt and the tool schemas the rounds were sampled against were simply gone
by the time anyone read the file.
The header carries both, plus the hashes usage events already report, so a
reader can prove the pair belongs to the rounds that follow instead of
assuming it from the file it was found in. It is written by the frontend that
owns the recorder rather than forwarded through the sink chain, which keeps it
out of the optional-capability contract every wrapper would otherwise carry.
NormalizedToolSchemas exports the exact bytes ToolsHash covers, so the hash is
recomputed from what was stored rather than from a second serialization.
bindRunSession collects what a headless run does to attach to its session,
which had grown into four steps inline in runAgent.
Opt-in metrics carried the anonymous install id so the dashboard could show a
deduplicated daily user per signal. Keeping that answer meant keeping a row per
install per signal per day — ~28M of them — and the 30-day COUNT(DISTINCT
install_id) over that table was the database's entire read bill: the primary
key leads with `date`, so each query could prune only the window and scanned
the whole table, eight signals an hour, ~5.4B rows a day for one module.
The client stops sending the id, the worker stops writing and creating the
tables, the hourly rollup that existed only to make that query survivable is
gone, and the dashboard's users/opens toggle goes with it. The aggregate
tables keep the same signals as event counts in ~180k rows.
migrate-drop-metric-users.sql drops the four retired tables. Deploy the worker
first — it stops creating them at runtime, and a DROP before that is rebuilt on
the next request.
Dropping a folder from outside the workspace mints a token and registers it
with the read tools' resolver. That is where the mapping to a real directory
lives, and the grant is read-only — handing bash the real path instead would be
a writable way into it. So the token is not a path, and bash's answer for one is
the shell's own: "No such file or directory".
A model that was handed the token in the same turn believes that. This session
did: it ran `ls` on the token, then `find` over the whole home directory, and
concluded the reference was virtual and the file did not exist — while the file
sat on the Desktop the entire time, reachable by read_file all along.
Bash now recognises a token before running and says what it is and which tools
resolve it. Recognition, not a guess about what a word might mean: the resolver
is asked, and its keys were minted by the host.
The four preflight refusals repeated the same four assignments before returning,
so they are one call now — adding a fifth check left the function shorter.
The posture a pane opened in was read off whichever runtime happened to be
first in the hub's order. Closing the conversation the person had set to auto
or yolo therefore reset the next one to ask — an approval prompt on a tool
they had already waved through, with nothing on screen saying why — and with
every pane closed there was nobody left to read it from at all. The same line
dereferenced Server on a remote pane, which does not have one.
The hub holds the stance instead: seeded from the runtime the host adopts, so
it is the launch setting until someone changes it, and written by the composer
switch, which already persisted the same choice to config for the next launch.
It no longer depends on which panes are still open.
The approval endpoints move next to that setter, where the rest of the
settings surface lives.
The icon drew a rounded square with a notch and a corner badge — a mark that
appears nowhere else in the product, so the tray was the one place Reasonix
was a different logo.
It is now RMark.tsx's three paths, carried over in the 16-unit space the SVG
draws them in and rasterized against a distance field: reading a stroke as a
capsule is what gives the round caps and joins without drawing either.
Mood is colour and nothing else, each hue the one meaning the palette already
assigns it — ghost is neutral, net is running on its own, accent is needs you.
The lightness belongs to neither theme, because a notification area is a
background this process cannot ask about: all three clear 3:1 against white
and against near-black.
The tests hold the two drawings together, so a path or a stroke weight that
moves in the frontend fails here instead of leaving the icon on the old glyph.
Studio never carried a SingleInstanceLock, so every double-click of the
launcher started another process over the same data home — several windows,
each binding session leases the others were already holding.
The lock is keyed to the data home rather than the executable: an installed
build, a portable one and a canary all write the same sessions, so they have
to find each other, while an explicit REASONIX_HOME stays its own instance.
The prefix is Studio's own bundle identifier, so this never answers the 1.x
desktop's lock.
REASONIX_DEV still waives it, and run-studio.sh now passes that through
`open --env` — LaunchServices does not inherit the shell's environment, so
without it a dev launch would be handed to an installed window.
Closes#9412.
`droppedRef.Image` carried `omitempty`, and false is a bool's zero value, so
the field left the JSON at precisely the value the composer needed: every file
that is not a picture answered with silence. The page read that silence as an
image — the check was `image === false`, and `undefined` is not `false` — and
drew an empty thumbnail labelled "image" over a .md file.
POST /attachments never had this: it writes its answer through a map, which
omitempty does not touch. Only a path dropped onto the window went wrong.
Both sides now state it. The field is always present, and the composer asks
whether it is an image rather than whether it was denied: a missing field falls
back to the file glyph, which still shows the name.
Two separate things were painting over a wallpaper nobody could see.
The rail: its 54px hit box is pointer-events:auto and sits over the transcript's
right edge, so any control that lays out to the right — the rewind entry is one
— lost its right half to it. The width is now a token both sides read, and the
transcript keeps clear of that column instead of fighting it for z-index, which
would only have traded a dead button for a dead stretch of track.
The wallpaper: three background rules were unconditional, and rail + panes +
side tile the window exactly, so the image was sealed under them. Two rules
written for it had therefore never once fired — .app cleared a path nothing
took, and .flow's 88% scrim, meant to catch prose over a photo, sat behind a
panel that was never transparent. With the panes clear they finally show, and
what they do is not what was wanted: the rails are down to a thin frosting,
the empty-page halo no longer tints itself from --surface (which reads as a
black fog in the dark theme), and prose carries its own shadow instead of
cutting a slab out of the picture.
Closing the metrics rail did not survive the window: nothing wrote the choice
down, so every launch opened it again. Two things had to change together —
the fold-away helper kept the wide-window value in a ref seeded to `true`, so
even within one session, narrowing the window and widening it back reopened a
rail the reader had shut.
The rail still opens by default. What is remembered is the reader closing it,
and only a deliberate close is written: folding away because the window ran out
of room leaves the wide-window choice alone.
The window process does not act on SIGTERM, so the pkill before `open` matched
the old instance and then left it running. Every `make studio` opened another
copy on top of the last, and they accumulated for as long as the machine stayed
up — two were live here, one of them a day old, before this was noticed.
Ask with SIGTERM, wait a beat, then insist.
Ranks say which column a node sits in and nothing about its row, so the
order the deltas arrived in decided it. Wires crossed for no reason a
reader could act on, an edge spanning a column was drawn straight over
whatever cards stood in the middle, and the same run redrawn came out
different.
Layout moves to its own module so the arithmetic can be checked without
rendering anything, and gains Sugiyama's two missing steps:
- Ordering. Each column is swept by the median of its neighbours' rows,
and only a sweep that lowered the crossing count is kept, so a round
cannot make the picture worse.
- Waypoints. A long edge reserves a thin row in every rank it crosses,
which is what keeps it off the cards it flies over.
- Columns are centred against the tallest rather than hung from the top,
where a lone node read as a step that ran early instead of one that
ran alone.
The panel also reads the kernel's new facts: a queued node says so
instead of sharing "not started" with a node nothing has reached yet,
the summary counts the two waits apart, and the detail strip carries
slot wait beside run time.
Folding is indexed rather than scanned. The graph is the one piece of
session state that only ever grows, so a findIndex per node and a scan
per edge made the cost of one delta the size of the whole run.
The graph declared StartedAt and EndedAt and no producer ever filled one,
so every consumer's timing fallback was dead code and a run's own order
survived only as the order its deltas happened to be published in.
Waiting for a slot and holding one were the same word besides. A fan-out
the session concurrency ceiling was throttling drew identically to one
where every item started at once — and which of the two it is decides
whether raising the ceiling would buy anything.
- agentgraph gains StateQueued and Node.QueuedAt. Terminal() had to learn
the new state: a queued node reported as settled leaves a reader no
longer waiting for the answer it is still going to get.
- SchedulerPolicy.OnStart fires once the slot is held, which is the only
moment the wait can be read from. acquireSlot moves to its own file and
becomes the single place that reports it, for both the foreground and
the background path.
- fleet and parallel_tasks publish queued, then running, then settled.
An item now settles the moment it settles rather than when its group
ends: a long fan-out used to draw every finished worker as still
running until its slowest sibling returned, which is the whole time
anyone is watching it.
Reported as Studio never raising the ask card: the model kept answering with
"ask 无交互响应（fallback）" and telling the user to go fix it. It was reading
its own tool result back. A subagent's ask found no asker and returned the
headless fallback - the text written for autonomous runs, which says in as many
words that no interactive user answered.
The root executor has an asker: EnableInteractiveApproval wires the controller
in as one, and every interactive frontend calls it. A child never did.
newAgentServices binds each collaborator from Options and there is no Asker
among them, so SetAsker is the only way in and only the controller ever calls
it - on the executor and the planner it holds, never on anything they spawn.
The gap was silent because the fallback is a plausible answer rather than an
error.
The call context already carries the right answer and nobody was reading it.
RunSubAgentWithSession is the one construction boundary every child goes
through, and by the time it runs, the context says whether a question can be
put to anyone: a delegated run has a parent blocked on it and a person waiting,
so exactly one question can be outstanding; fleet items and parallel tasks
build their context with the asker dropped on purpose, because a question from
one of many has no reader who knows which asked it; a background job runs under
a job context with no call on it at all. Inheriting from the context therefore
needs no flag and no policy - the three cases already differ where it matters.
Both halves are tests now, because "silently answers itself" is what this class
of bug looks like and neither half fails loudly. The construction moved to its
own file rather than growing task.go, which is 1200 lines past its budget.
Reported as connecting to a Linux server failing with "这次请求没能送到内核
（HTTP 502）" and nothing else. The request had arrived. The kernel had
answered, at length, and two layers threw that answer away between it and the
window.
Opening a pane over there is two hops: attach the link, then ask the kernel now
running on the far side to open a runtime. The link half already codes its
failures - a changed host key is not a network hiccup, and identify() in the
desktop says so. The second half did not. farRequest returned fmt.Errorf with
the far side's status and body flattened into a sentence, writeErr found no
code on it and fell through to http.Error, and a sentence is exactly what the
repo's own rule says an error a caller must tell apart may not be. A dead link
and a kernel that answered with a refusal are different problems with different
next moves; only a code carries that.
They have codes now. A transport failure is remote.unreachable, the same
condition the proxy beneath already reports through a different door. A far
kernel that answered is remote.kernel_refused, carrying the host and whatever
it actually said - falling back to the status line only when the body was
empty. Three writeErr call sites pick both up without changing.
The other half is the hub port, which asked for JSON and discarded anything
that was not. SseHttp was fixed for this once - users reported
"/providers/edit: 500" - and the hub was left reading res.json(), so every
plain-text answer from every hub route reached the window as a status and a
path, which reason() then renders as the request never having been sent. It
reads the body as text once and parses optionally, the way its sibling does.
Only a genuinely empty body may now claim nothing came back.
Reported as MCP not connecting automatically: twelve enabled servers, each
listing the tools it brought, every one of them reading "not connected" with a
Reconnect button beside it. Nothing was broken. That is what a healthy install
looks like, and the panel had no word for it.
Enabled config MCP is catalog-first by design. Boot registers each server's
cached toolset as placeholders and starts no process; the first real tool call
drives the handshake, and a fast server completes it in the same turn. So
host.Servers() is empty for all of them, every row falls through to the branch
for servers with no live connection, and that branch had two answers - off, or
idle - for three situations. The comment there already claimed to tell "switched
off" from "lazy and not needed yet"; the code did not.
The catalog answers it, not the host. A server whose tools are in this
session's registry can be called right now, whatever its process is doing, and
that is the question a status row is actually asking. MCPCatalogTools counts
the registry's MCP bindings in one pass - lazy placeholders included, because
they carry the server name like any other binding - and configuredState turns
that into standby, idle or disabled.
The panel says 待命 · 首次调用时启动 for standby and offers 立即连接 rather than
重连: nothing failed, so nothing is being retried. The mock's cache-hit fixture
moves with it, or the harness would keep showing the state this fixes.
Reported as storage settings reset to C: after upgrading Studio, with the
original location then impossible to choose again because it "needs an empty
folder". Two defects, and the second is the one that traps a person: whatever
loses the pointer, the data is still sitting on the other drive and there is no
way to say so.
The reset is the installer. studio.nsi asks for admin and the finish page runs
Studio itself, so the app inherits the installer's token; on an account that
elevated by entering someone else's credentials, %APPDATA% then resolves to
that administrator's profile and the first launch after an update reads a
config.toml that never heard of the user's relocation. It launches through
explorer.exe now, which is already running as the signed-in user. The exe
manifest is asInvoker, so only that one launch was ever affected - which is
exactly the launch the report describes.
The trap is that a relocation was recorded in exactly one place. A directory
now says what it is: a move writes .reasonix-root.json once the copy is proved
and before the configuration is told, so a marker means this folder is
complete, and it is removed from a location the root leaves. A preflight whose
target already holds this root's own data plans an adopt instead of a refusal -
the pointer alone, nothing copied, verified or reclaimed, and nothing at the
old location deleted. The plan reports what stays behind rather than letting it
go quietly missing.
Structure decides, never resemblance: the marker names the root, or - for a
root that declares what it owns - the folder holds those entries and nothing
else. A root with sole occupancy and no marker cannot be told from a stranger's
folder, so it is refused rather than guessed at. A folder left with only the
marker of a root that moved on is an empty target, not data to adopt.
RecordRelocatedRoots marks the locations a configuration already chose, so a
folder an older build moved data into becomes adoptable after one launch; it
follows the importers' rule and does nothing when the environment redirected
this run's roots.
While in there: PlanMove measured the whole source directory, so a state root
sharing its folder with home counted config.toml and the credentials into a
move that never copies them, and the progress bar could not reach the end it
was measured against.
Clicking a node showed what the kernel knew about it and stopped there. What a
reader wants next is the call itself — its arguments, its output, the reasoning
around it — and the transcript had no way to be pointed at one. Only user
messages carried an anchor in the DOM, because only the rail had ever needed to
find something.
Tool cards now carry the id the graph names them by, nested children included,
which is where a fan-out's nodes actually live. Nothing else reads it, so losing
it would fail silently — the button would switch tabs and do nothing — and that
is what the new test is for.
The rail's two-pass landing becomes one routine both callers share: scroll to
the block first, because the card may sit in one that is not mounted and has no
node to scroll to, then put the element itself under the reader and flash it.
The rail lands on a message, the graph lands on a call; same passes, different
selector.
The request is a counter, not an id, or asking for the same node twice would
land once. It is held rather than spent while the pane is hidden: a hidden pane
has no geometry, every rect reads zero, and the scroll goes nowhere. That also
makes the caller's ordering harmless — the view transition defers what it is
given, so setting the tab and the request in one commit is right, and holding
the request is what makes it right even when it is not.
The panel counted delegates. It could say four were running and never which of
them was blocked on which, because the list it was drawn from had already
thrown that away — the kernel now publishes the structure, so there is finally
something to draw.
A rank is a column: everything in it was free to run at that moment. Width is
concurrency and length is a chain, which is the difference a list renders
identically. Ranks are memoised with a separate in-flight set rather than one
visited set, or a node reached twice through a diamond reads as a root and the
whole picture flattens.
Edges are told apart by line, not by colour. Solid with a filled head means the
upstream answer went into the dependent's context; dashed with an open head
means the pair was ordered and nothing travelled — which is exactly what the
measurement arm produces, and drawing them the same way would say the two runs
were the same run. Reuse is a mark on the node, because an adopted item runs
nothing at all and would otherwise be indistinguishable from work that was paid
for. The state is a word on every card as well as a colour, so none of this
depends on telling hues apart.
The two questions a list cannot answer are the ones the cards lead with: a
blocked node says what it is waiting for by name, and the header says how many
of the fan-out actually ran. A separator that a node id could contain is a bug
waiting for an id with a slash in it, so pairs are keyed by encoding rather than
by joining.
The structure was being re-derived in five places and survived in none. A
fleet's dependency DAG lived and died inside one Execute call — the dispatch it
emitted carried a prompt and a profile, so depends_on never left the process at
all. The persisted sidecar recorded a parent link and nothing else. The event
stream implied the rest through id prefixes. By the time any of it reached a
reader it was a flat list of children, which is why a panel could count
delegates and never say which of them was waiting on which.
internal/agentgraph is the vocabulary, and it is a leaf: nodes, and edges that
carry an identity rather than leaving a reader to match words. depends and
context are two edges on purpose. The measurement arm orders its endpoints
while delivering nothing between them, so a single edge type would describe an
ablated run and a real one identically — the same reason an error a caller must
tell apart carries a sentinel rather than a sentence.
The other half of that rule was already being broken on disk.
InheritedContext.Upstream was a bool: it recorded that some dependency's answer
opened a run, and a reader asking which one had nowhere to look. It names them
now, and a sidecar written while it was a flag still decodes to "there were
sources, unnamed" rather than to nothing.
fleet and parallel_tasks publish what preflight already proved, before any of
it runs — an item that never executes emits no tool events to infer a state
from, and an adopted answer emits none at all. That collapses three copies of
the same five-state vocabulary into one and two identical group classifiers
into one, so a group's progress card and its graph node can no longer disagree
about how the fan-out ended.
A node is the call it names. Timing and output stay on the tool stream and a
frontend joins them by id, rather than the kernel publishing the same clock
twice under a second naming scheme. internal/boot asserts that at the frontend
sink through the real Build assembly: a scripted two-item fleet with a
dependency in it, and the edge has to arrive.
Studio could already say something mid-turn — the composer routes it through
steer, and the row on screen carries the receipt it can be taken back by. What
it could not do is see the queue. The pending rows are minted by the client on
its way out, so they say only what this window sent: reload the page and they
are gone while the entries are still in the manifest, still due at the next tool
boundary. A line the CLI queued, or a second window, was never on screen at all.
So the kernel had ten inbox endpoints and the frontend read three of them.
Editing, reordering, retrying a blocked entry, re-freezing the files one quoted,
holding delivery — all of it existed, with no way in. The panel above the
composer is that way in.
The queue arrives the way the workspace tree and the checkpoint list already do:
an event says it moved, and the content is read back whole. sessioninbox.Store
has had OnChange since it was written and nobody had ever registered one — the
notify path ran into an empty listener slice. Registering it there rather than
at each mutation is what makes this true of every mutation, including the ones
the kernel performs on itself when a turn consumes a steer.
InboxChanged carries nothing. It is tempting to put the snapshot on the wire and
save the round trip, and that would make every client's queue a function of the
frames it happened to receive — a reconnect that missed one leaves a panel
describing a queue that has since changed, and the manifest's checksums and blob
names would be on the wire for no reader. One authority answers instead, and a
frontend that has just reloaded is in exactly the same position as one that has
been connected all along.
adoptInboxLocked exists because there were two places opening a store, and a
listener registered in one of them is a listener half the sessions do not have.
Two smaller things the work needed.
The transport had four verbs and the update endpoint is a PATCH, so it has five.
The contract test that checks the frontend only calls paths this package serves
reads those verb names out of the source: without patch in that alternation the
new call was not unserved, it was unchecked. Confirmed by pointing it at a route
that does not exist and watching the test go red.
Editing opens on the entry's full text, not its preview. The manifest keeps a
120-rune line and nothing more — opening the box on that and saving it back is
how an instruction would quietly lose its last sentence. Measured against a
141-character entry: the row shows 121, the box gets 141.
Verified against a running kernel rather than the fixture, with the entries put
there by a second client so the panel had to have read them from somewhere:
three lines queued over HTTP appear in a window whose transcript never carried
them; an external reorder shows up without a reload; reorder, take-back and
release from inside the panel each land and the panel redraws itself; an edit
saved from the box reaches the kernel. That last one also found a defect this
could not have found any other way — an empty queue is items: null on the wire,
which is what a Go nil slice encodes to, and the panel reading it as an array
would have thrown at the moment the queue ran dry, and only then. Normalised in
the port, where one reader knows it instead of every reader having to.
Deliberately left alone: a line this window sent appears both as a pending row
in the transcript and as an entry in the panel. They are not the same statement.
The row is where it sits in the conversation; the entry is what is still owed,
and it is the one that survives a reload. Folding either into the other would
cost the case the panel exists for.
The window is what this version is: the greys came home to the product's own
hue, the activity stream became a rail you can scan instead of paragraphs on
white paper, and the menu bar got an icon that says what this machine is still
doing. Around it, the close button finally keeps the promise its config option
has been making since before this shell existed.
Two things are deliberately not in here. The status icon's own defects — a dead
Win32 pump, a crash on macOS launch — were introduced and fixed inside this
version, so no released build ever had them; the notes say what the icon is, not
what it survived. And fleet's for_each was built, measured against the call it
replaces, and removed in the same span: it never reached a surface, so there is
nothing for a reader to have used.
Studio did not start on macOS. `open` returned and the process was gone, with
nothing on screen and nothing in the terminal — the bundle path hides the
output. Run the binary directly and it is there:
*** Terminating app due to uncaught exception
'NSInternalInconsistencyException', reason:
'NSWindow should only be instantiated on the main thread!'
-[SystrayAppDelegate applicationDidFinishLaunching:]
-[NSStatusBar _statusItemWithLength:]
tray_run_other.go carried a guess about this and flagged it as one: "macOS puts
its status item on the main thread and Wails already owns that one, so handing
the icon a thread of its own — the Windows fix — would be a crash rather than a
dead icon. Neither platform has been run from the machine this was written on."
The first half is right and the conclusion does not follow: nobody was handing
the icon a thread, and the thread it inherited was not the main one either.
Wails calls OnStartup from a goroutine, and the crash frame is m=5.
It is not the ownership conflict it looks like. registerSystray returns
immediately when the loop is external, so systray never takes NSApplication —
nativeStart only allocates a delegate and calls applicationDidFinishLaunching
on it directly, and that is where the status item gets built.
So the defect is narrow, and it is a lone exception in its own library: every
other systray entry point — setIcon, setTitle, every menu mutation — already
hops to the main thread through performSelectorOnMainThread. nativeStart is the
one that does not.
The hop happens here instead, the way this tree already does it. dock_icon
_darwin.m has the same shape for the same reason, and its comment names the same
caller: "the caller is a Wails lifecycle hook that may not be it."
Async, not sync. dispatch_sync would deadlock whenever the main thread has not
reached its runloop yet, which is exactly when a startup hook runs. Nothing
needs the completion: ready() ends by replaying the last state it was given, and
a setter that arrives before the delegate exists is a message to nil.
tray_run_other.go loses darwin from its build tag and the retired guess from its
comment.
Verified with tray at its default, the configuration that crashed: the window
comes up at 1440x900 and the status item is there, titled "Reasonix", its
tooltip reading "Reasonix Studio — 没有在跑的" — which is ready() having run,
built its menu and replayed state, all on the main thread.
The token system was never the weak half. The activity stream was: the column a
reader spends the whole session in had no material at all, while the rail beside
it has hierarchy, the metrics column has data, and the trajectory tab has a
gantt. In light theme it rendered as paragraphs on white paper — a terminal
block, the largest object on screen, carried border-left: 1px and background:
none.
The timeline was already there in structure and absent in pixels. .call has been
a 20px gutter with a stamp and a connecting line since it was written, but the
line was 1px of --hair, which on a screen is nothing. It is 2px now and takes
the category colour that tokens.css had already assigned and never spent —
neutral reads, amber writes, blue network, teal delegation — so a glance down
the gutter says what a stretch of the turn was doing. Sub-steps inside a
delegate panel keep the narrow gutter: two levels at one width is one level.
Blocks get material. .term sinks half a step by mixing --page into --surface,
one recipe for both themes because page already sits under surface in each. The
approval card lifts out of the flow on an amber wash, and only the one still
waiting: :has(.apv:not([data-sealed])) drops it the moment you answer. Amber
says exactly one thing in this vocabulary — it needs you — and it had been
reaching only as far as the buttons.
Wall-clock becomes a bar beside the number it already prints. It is horizontal,
which was not the first design: drawn down the gutter its length would be
bounded by the card's own height, so a 64s step with two lines of output either
pushes the layout around or gets silently compressed — and a meter that shrinks
when it runs out of room is a meter that lies. Across a header row there is no
such constraint. The mapping is logarithmic because the span is three orders of
magnitude, and the bars right-align against the duration, so a ragged left edge
down a column is the turn's time distribution.
A turn now starts at a visible boundary. Not a new Item type: the user card is
already the anchor the rail jumps to, and UserCard.tsx already records the
decision that turns carry no number, because the rewind entry sits on the card
itself and there is nothing to match up by eye. It gets a rule and some room.
The right column stops being nine equal blocks with nine equal separators, which
reads as an unfinished form. Group boundaries fall on cost, progress,
environment and output, and the first block of each is recognised by the
data-b it already carries — no reordering, no new attribute.
One piece of the plan is deliberately not here. Highlighting the command line
inside a terminal block was going to be .term-l:first-child, and the first line
is not the command: Term splits text on newlines, real shell output routinely
opens with output, and past 300 lines the block is not split at all so there is
no .term-l to select. Guessing a role from a position is the thing this tree
keeps retiring. Doing it properly means telling the renderer which line is the
command, which is a different change.
Second half, found by the sweep the previous commit repaired: 55 light-theme
findings, and they were the design's own rules going unenforced.
--ghost was calibrated against the wrong surface. The comment said "on the
--raised it actually appears on"; it appears on --raised once and on --page 768
times, because rail, side and chrome are all painted in it and it sits a step
darker. The soft tier stopped at 4.03. It is 53% now (4.52 on page), and the
comment says which surface and why. normal and strong already cleared it and are
untouched; dark measures clean on every surface it lands on and is untouched.
--accent is a fill and --accent-ink is the reading value — tokens.css says so,
and 32 rules used the fill as text anyway. In light it clears nothing: 4.07 on
its own wash, 3.91 on page, 3.80 on overlay, while the ink is 4.98 or better
everywhere. --warn is the same hue tier and had 13 more. Only text colours move;
borders, fills and shadows keep the base. In dark the ink is the base, so both
sweeps are light-only.
Two singletons around them. The slash menu's selected row mixes its own tint
rather than using --accent-wash — deliberately, and the comment explains it —
but at 12% the ink on it reached 4.40, so it is 9% and the row is no less
selected. And white on --accent sat at 4.4977, which is not 4.5; #A7690C to
#A6680C is one step of a hex digit, invisible, and lands it at 4.56.
Verified on the real shell against fixture data, both themes, every surface the
sweep can reach: 55 and 45 findings become 0 and 0, with truncation, spill,
offscreen and unnamed-control all empty and no runtime errors.
getComputedStyle now hands back oklch() and color-mix() verbatim, and parseC
dug the numbers out of whatever string it got. Three components that mean
lightness, chroma and hue were read as if they were r, g and b, so every
judgement compared two colours nobody had painted: 1037 findings on a dark
sweep, all of them "#01004B on #00004B", a pair that appears nowhere in the
token table.
A gate that fires on everything is worse than no gate for the same reason one
that fires on nothing is — both bury the findings that are real. This one had
gone all-red, and the 55 genuine light-theme findings underneath were
indistinguishable from the 807 it invented.
The fix is to stop parsing. Paint one pixel with the computed value and read it
back: whatever the browser resolved is what gets measured, and the probe needs
to know nothing about colour syntax it will have to keep up with. Dark drops
1037 to 45, light 807 to 55 — and those 55 were real, which is what the next
commit is about.
One other correction while in there: the root background fell through to black
when html was transparent, because a fully transparent colour still parsed to
four numbers. It is only adopted now when its alpha says something was painted.
A vision host rejects an oversized image as an unsupported *format*. Measured
against api.deepseek.com/anthropic on 2026-08-24: 8192x1000 is accepted,
8193x1000 is not, and neither is 1000x8193 — the limit is a single side, while
total pixels (8000x8000 passes) and bytes (a 12 MB PNG passes) are not bounded
at all. The message names webp, png, jpeg and gif, so the reader spends the next
hour confirming the file really is a PNG. It is. It is too wide.
Worse than the wrong question: the rejected user message stays in history and is
resent every turn, so one attachment ends the session. Nothing in the tree
stripped it and retried; ProviderErrBadRequest had no consumer at all.
compressForVision scaled on side length but forwarded the original whenever it
could not: an undecodable mime, a header it could not read, and — the one that
fires here — anything past the 50M-pixel decode limit. A long diagram is exactly
that shape, so it skipped the 1568 budget and went out full size.
The budget is now the gate. internal/visionimage owns the only judgement, and
what leaves it has both sides within MaxDim or does not leave: no vendor number
is written down anywhere, because 1568 already sits below every host's ceiling
and a declared 8192 would be one vendor's answer imposed on the rest. What
cannot be proven to fit is refused with ErrUnfit, an identity a caller can read,
and the reason names the dimensions and what to do about them.
It is a package rather than a control helper because MCP tool results are the
same hole reached from the other side — toolResultImage validated base64 and
size and never looked at dimensions — and internal/plugin cannot import control.
Both callers now ask the same function.
Around it, a turn's attachments stop being three loose values. turnImages says
what the model got, what a delegate could get, and what nothing got, which
retires orchestratedTurn.imagesResolved: a resolved turn is a non-nil pointer.
The headless entry points compose through imageRoutingPrefix like the
orchestrated one does — they bound the attachments but dropped the note, so a
model with an unreadable attachment was told nothing and went off to write its
own OCR script.
Refusing is only half of it; saying so is the other half. The user gets the
reason and the file, and the model is told an attachment exists that it will
never see, so it does not answer as though nothing was attached.
Verified against the real endpoint, one arm each side of the budget:
12000x5000 (60M px) refused locally, "past the 50000000-pixel decode
limit ... shrink it first"; the model relays it and
suggests sips -Z 7000. The turn completes.
20000x1000 (20M px) downscaled to 1568x78, sent, answered correctly.
12000x5000 sent raw 400 unsupported image — what shipped before this.
Two deliberate gaps. The 50M-pixel decode limit is unchanged, so an 8000x8000
image the host would have taken is now refused locally; raising it trades
against decode-time memory and wants its own measurement. And a session already
carrying a rejected image still needs a rewind — this stops the poisoning, it
does not clean up after it.
Test fixtures that were PNG signatures over zero bytes are now decodable PNGs:
an image whose dimensions cannot be read no longer travels, so a header-only
fixture asserted nothing.
Nothing held docs/SPEC.md against its Chinese companion, which is how 3.13 lost
a table row and 3.14 fell three commits behind before anyone noticed — long
enough for one of its sentences to become a false statement about where
dependencies travel.
Parity is declared, never inferred. The companion abridges most sections on
purpose: 3.7's 111-line list is nine lines there, and twelve of seventeen
sections differ structurally by choice. A whole-file rule would fight that and
land twelve findings of recorded debt on day one. lockedSpecSections names the
five that are full translations — 3.11 and 3.13 through 3.16, the delegation
group, which is where changes actually land — and adding a section to it commits
every later change to that section to both files. It is the same reason the
host's sensitive paths are declared rather than read out of how a path is
spelled.
The check reads structure and never wording: the heading sequence across both
files, and each locked section's sequence of block kinds. Size is compared only
where a translation cannot legitimately change it — a table row and a fenced
line survive translation, a wrapped sentence does not — so prose line counts are
never compared, English hard-wrapping at 80 columns against unwrapped Chinese
stays quiet, and a test pins that. Comparing prose would fire on every
legitimate translation choice, which is a judgement this tool cannot read from
structure.
It lands at zero recorded debt: the five locked sections are in parity as of the
previous commit, so the rule's budget is zero and any drift fails rather than
being absorbed.
Verified against the drift it was written for. Dropping the 3.13 table row that
actually went missing reports:
docs/SPEC.zh-CN.md:282: [spec-parity] section 3.13 table block 2 has 9 lines
here and 10 in docs/SPEC.md
and exits 1.
A failed item collapsed every non-cancellation error into one status plus a
sentence, so the caller deciding whether to re-issue the graph with the finished
nodes adopted had to read the message. The identity already existed one layer
down and was being discarded at the fleet boundary: provider.RetryableStatus
knows 429 from 400, and APIError.ErrorCode knows an overflow from a rejection.
Confirmed the identity survives the trip before building on it: a
*provider.APIError returned by Stream reaches RunProfileSpec intact, status and
code readable through errors.As. Classification therefore reads what the error
already carries rather than decorating it.
Four classes, each sourced from a real identity — provider.transient (408, 429,
5xx, or an interrupted stream), provider.rejected (any other 4xx),
context.exhausted (ErrCompactionRequired, or a documented context-overflow
code), and unclassified for everything else. Nothing reads message text. An
error whose producer named nothing is reported unclassified rather than guessed
at, and a test pins that an error whose message reads "rate limit exceeded"
stays unclassified: this is the rule that retired the phrase tables, and a
failure surface is not where it gets an exception.
The identity travels to the branch the failure killed, because a skipped item is
worth re-issuing exactly when its cause was.
Skip policy is unchanged. Retrying inside a run is a separate decision and needs
its own evidence; adopt_ref is already the caller-side retry primitive.
Second half, found while testing the first: a skipped branch made runFleet report
the whole call as cancelled and answer context.Canceled. A rate limit is not an
interruption, and that error is what the turn loop reads to tell an interrupted
call from one that ran and reported. Only a real cancellation answers it now —
including the pre-cancelled context the old skipped check happened to cover — and
the aggregate headline gained the third state it was missing, so a run that
reached its end with failures says how many of its tasks were answered instead of
claiming to be either clean or cancelled.
docs/SPEC.zh-CN.md had drifted three commits behind on 3.13 and 3.14: the
upstream payload, adopt_ref with list_subagents, and the measured for_each
exclusion never crossed, and one sentence had become false — dependencies "never
reach ProfileExecSpec" after they had started travelling on
ContextRequest.Upstream. Both files now describe what the kernel does.
The cycle ran a fixed ["auto", "light", "dark"], and "follow the system"
looks exactly like whichever of the two it currently resolves to. On a
light machine the default auto stepped to light: not one pixel moved, so
the control read as broken. The next step now comes from what the system
is rather than from the array's order, and the first click always
repaints.
One hop stays silent -- returning to auto lands on the scheme auto already
shows, and that is what those three states mean. The button answers the
press itself so the click is acknowledged either way.
Every neutral in the palette sat at hue 255-267 while the accent sits at
75: the greys were 185 degrees from the one colour the product owns, which
is what made them read as somebody else's. They are OKLCH now, at the
accent's hue and a chroma low enough to still be grey, with the lightness
carried over untouched from the hex each one replaces -- so every contrast
ratio the comments there argue for still holds.
The four surface steps were declared but only the centre used them, so the
window was one flat plane with hairlines drawn on it. The frame drops to
the canvas and the middle column becomes a sheet on it. Radii go to
1/2/3/4: an instrument is machined, not moulded, which is what lets rules
and columns take over the dividing. Terminal output, delegate panels and
returns, the approval, and the right column's sections all lose their
boxes for rules.
--warn and --accent were the same hex, so "each colour does one job" was
not true of those two: needing you and costing you were indistinguishable.
warn moves to H45 at 8.14:1 dark and 5.83:1 light, matching accent's 8.35
and 5.77.
The mono stack shipped no face, so the layer carrying every label, tag,
figure and terminal line rendered in Cascadia on Windows and SF Mono on a
Mac -- the problem the comment above --ui says was solved, still open one
line below it. IBM Plex Mono Var, 81KB, OFL like the other two. It has no
geometric shapes and no U+2717, which fall through to the shipped Noto, so
they stay identical across platforms but off the monospace grid; the two
places a check and a cross share a marker column use x instead.
Motion: a weight tier now decides duration and easing together, and
choreography has one mechanism -- sibling-index() rather than fifteen
hand-written nth-child rules. The composer row had grown to eight items
against a chain that stopped at seven, so the eighth entered with no delay
at all. Streamed transcript cards are deliberately not staggered: they
arrive one at a time already, and delaying them would delay the work.
Light is emitted by readings, never painted on surfaces: the live symbol
blooms in its own category colour, the gauge leaves a phosphor edge as it
grows, and a finished turn gets one sweep and one flash. A grain overlay
takes the sterility off surfaces that are otherwise perfectly uniform,
which no real material is.
event.go states the contract: a Retrying indicator is transient, and the
next stream event -- or TurnDone -- clears it. The chat TUI does that. The
window only cleared it on a text or reasoning delta, so a turn whose first
packet was a tool call left "retrying 1/5" and its clock standing for the
rest of the turn, over calls that were running fine.
The clearing moves to a rule about event kinds: the kinds that say nothing
about the connection leave the wait standing, and everything else is the
provider having answered.
Two more the same measurement turned up. RetryScope was on the wire and
ignored, so a body-phase replay was announced with the header-phase
sentence -- 1/5 is maxStreamRecoveries, and headers retry ten times. And a
retry between two steps used to show nothing at all, because the indicator
only rendered inside a wait that the first packet had already ended.
The clock now counts from the stamp the wait carries rather than from the
component's mount, so it reports the stall rather than the turn.
The prefix is what prompt caching pays for and one changed byte re-bills all of
it, so the useful question is not how often the cache held but what stopped it.
CompareShape already answers that every turn — system, tools, or the reason a
Rewrite queued — and the verdict rode to the frontend and stopped. This carries
it: cache_miss_reason, one bucket per attributed cause, nothing inferred here.
Rewrite takes an open reason string, so an unknown one buckets as other instead
of letting a caller widen the wire's bucket space.
The complement is the case the kernel cannot see. A prefix that held and still
returned no cached tokens is a gateway that dropped cache_control, an entry that
expired, an endpoint that never cached — downstream, unattributable, and exactly
the shape of the route that billed twelve million prompt tokens at full rate
with nothing anywhere reporting it. It buckets as unexplained, above the
smallest prefix any vendor here will cache so that turns which were never
cacheable stay out of it.
uploadSignals is the silent gate: a counter the sink records but the list omits
is queued and dropped without a word, and locally that is indistinguishable from
a feature that works. A guard now drives a turn through every recording branch
and fails if the wire rejects what came out. It found tool_call_reasoning_recovery
dropped since it shipped — the bucket is a ProtocolRecoveryKind, a closed enum,
never content — and that is now allowed through.
Built, shipped behind the surface, and measured against the call it replaces —
the same graph with one task handling every subject. Three fixtures, twenty-eight
graded runs against a real provider, every run of both arms solved, and mapping
spent 70%, 85% and 98% more tokens for it (exact permutation p <= 0.03 each).
The last fixture was written to be the case mapping should win: ten modules of
near-identical code, a hundred and sixty lines each, and an answer that is the
sum of ten separate derivations so a slip anywhere is a wrong answer. It did not
win there either, and one run solved it by grepping the constants out rather than
reading anything — which is the reason. A mapped child pays a full sub-agent's
fixed cost per subject, while a single child with a tool belt never has to hold
the subjects at all: it reads them one at a time, and when the facts are
extractable it extracts. "One context cannot hold N subjects" assumes an
ingestion an agent does not have to perform.
So the graph vocabulary goes back to id and depends_on, and SPEC 3.14 records the
exclusion as measured rather than as taste.
Two things survive the removal. The edge dedupe in newFleetPlan stays: a task
named twice in one depends_on was already counted twice before for_each existed,
and the item would have waited for a result nothing publishes. So does
unresolvedDepCounts, which adoption needs — an adopted node enters resolved and
its dependents have to be ready on the first pass.
benchmarks/fleet-fanout goes with it. The history holds both if a case that
genuinely needs per-subject isolation ever turns up.
Claude caches only where cache_control marks a breakpoint, and that field is
serialized by internal/provider/anthropic alone. The same model reached through
an openai-kind entry is not an error and not a visible wire difference — it is
full input rate on every prompt token, and the only symptom is a cache read
that never arrives. Measured on a live gateway: 3610 input tokens with no
breakpoint against 7 plus a 3603-token cache read with one.
The judgement reads structure and nothing else — an entry that sets both a
dialect and a model list, resolved through the package-level slice the models
usually live in, because an entry that never spells the name in its own literal
is the ordinary case. Fixtures are exempt: a test builds the broken shape on
purpose to assert what it does.
realyyds_test.go pins the reason a yyds-anthropic entry exists at all, in the
//go:build live form this repo already uses for gateway probes.
The one finding is recorded, not fixed: the vendor's Anthropic route could not
be reached to tell a gateway that lacks one from a preset that picked the wrong
dialect, and asserting either in source would be inventing the fact. The
ratchet is where an open question of that shape belongs, and the rule still
fails every new one.
The counters said how often a turn cached well and never how much it cost.
A flat-rate plan is priced on the tail, so the shape has to survive the wire:
turn_prompt_tokens, turn_output_tokens and turn_cached_tokens are magnitude
buckets taken once per turn, because three 40k requests are one 120k turn and
the plan is paid on the turn. The per-turn scalars move behind turnCounts so
both boundaries reset by whole-struct assignment and the next field added
starts clean.
Surface was hardcoded "cli" at both post sites while stats spelled the same
vocabulary a third way, so internal/surface now owns it and boot, telemetry
and serve read it from there. Or(fallback) makes a caller say what an unset
field could only have meant rather than letting the code guess. One machine's
queue is shared by every surface on it, so the flush groups by surface as well
— without that a window's turns post as the bare server's.
The window and the headless server reported nothing at all: DesktopMetrics and
DesktopTelemetry were settings with no sender. They are separate consents, so
backgroundFlush takes the ping apart from the drain and each is honored alone.
Enabled stays fail-closed, so a development build, CI or DO_NOT_TRACK still
refuses, and a non-interactive server counts only where telemetry was turned
on deliberately.
runServeWithOptions moves to serve_frontend.go, where the serve frontend's
entry point belongs; cli.go was 2595 lines and 1795 over the ceiling, and the
extraction lowers its budget by more than the move costs the file that gains it.
Two fixtures, twenty graded runs against a real provider, and mapping never once
solved something the single-task form did not: 20/20 on both arms. What it cost
was 85% more tokens on the cheap fixture (exact permutation p=0.002) and 98% on
the one written to favour it — ten modules each hiding its effective timeout
behind a three-step derivation, where grepping the constants answers nothing
(p=0.029) — with no wall-clock gain either time, at the default concurrency and
at a ceiling raised past the mapped width.
So the mapped fields leave the provider-visible surface. The schema field and the
sentence describing it are dropped together, so the description never advertises
a parameter the schema does not carry, and a call naming for_each is refused
rather than half-honoured.
There is no setting. A capability the host cannot recommend does not get a knob:
turning it on is a change at the wiring point, to be made once the case that is
still untested is measured — subjects whose combined content one child cannot
hold at all, which neither fixture builds.
The code and its tests stay, and benchmarks/fleet-fanout now holds both pairs.
The evidence for switching it back on and the evidence for deleting it is the
same suite either way.
A capability has no ablation arm — there is no "the same thing with the payload
removed" for for_each the way the dependency edge has one — so the honest
comparison is what this call had to look like before it existed: one task
handling every subject. benchmarks/fleet-fanout holds both, identical except
that the middle item takes for_each rather than depends_on, graded the same.
Against the real provider, n=6 per arm across two concurrency ceilings, both
arms solved 6/6, and mapping a one-file check over twelve subjects spent 85%
more tokens (exact permutation p=0.002) and 47% more money (p=0.026) for no
wall-clock difference (p=0.70). Raising max_subagent_concurrency past the width
did cut the mapped arm's wall time, and cut the single task's by more.
The mechanism is a sub-agent's fixed cost — prefix, reasoning, closing contract,
once per subject — against per-subject work of reading one short file. It is the
same boundary the dependency edge has: both pay in proportion to what a unit of
work costs relative to that overhead, and both fixtures so far measured the cheap
side. So the tool description now says to map only work that needs a run of its
own, and SPEC 3.14 records what the fixture measured and what it did not.
for_each names the item whose submitted subjects this item maps over: its prompt
becomes a template run once per subject, and it reports one bounded aggregate
that its dependents open with over the ordinary dependency edge.
The mapped children are never vertices. The node stays one, so the reachability,
write claims, and skip rules preflight proved are the ones that ran — adding N
vertices mid-run would invalidate the precomputed reachability that
skipDependents and the concurrent-claim check both read.
Four things are fixed before anything starts, and that is what keeps for_each
from being the first keyword of a workflow language: the template, the width
ceiling (max_items, defaulted to 8 and hard-capped at 32), the read-only grant —
which removes the write-claim analysis the host could not have done for an
unknown number of writers — and the source. The source supplies only which
subjects, through submit_items rather than prose, because reading a list out of
an answer is the host guessing at a judgement the structure does not carry. The
caller owns the topology, the worker owns the data: the same split the
dependency edge makes.
submit_items reaches only a source's registry, so a capability nothing in a run
can use never enters its prompt. A source that finishes without submitting fails
the mapped node rather than quietly mapping nothing, while an empty submission is
a real answer that completes it. A source may not be adopted, having never run to
submit anything, nor itself mapped, since it answers with an aggregate rather
than a list.
SPEC 3.14 said the graph vocabulary had no dynamic fan-out. It now says no
computed edges, which is the invariant that actually mattered.
Execute's preflight moved into preflight(), which returns a proven fleetCall,
and the ctx-gated tool attach sits beside the other ctx-keyed host framing in the
two sub-session entries; that is what paid for the new lines without widening the
repolint baseline.
depends_on ordered its endpoints and delivered nothing, so a research →
implement pair paid for the same research twice. Three changes that compose:
- The edge carries the dependency's answer. It travels as
ContextRequest.Upstream, never inside TaskSpec.Objective, because the
objective must stay the pristine text delivery classification judges —
ClassifierTaskText is captured before any host framing. One 8 KiB budget is
shared across a node's dependencies, so a wide fan-in cannot flood the
opening turn and no dependency is starved out of it.
- list_subagents enumerates the children a conversation owns. A reference is
the only address a child answer has, and a background fleet that a restart
repaired to interrupted never delivered the aggregate carrying those
references, leaving its completed children unreachable.
- adopt_ref stands a node down to an already-completed child's answer instead
of running it. It is proven in preflight through ReadFinalAnswer, so what may
be adopted cannot drift from what read_subagent_result may read. Nothing
runs, so the node claims no write_paths and cannot collide with a live
writer; prompt and every execution field are refused on it rather than
silently ignored.
Whether an adopted answer is still valid is not readable from structure, so the
host does not decide it: adoption is addressed by reference, and the caller that
listed the reference judges freshness. That is also why a plan fingerprint does
not quietly reuse matching children — reuse the caller cannot see is reuse it
cannot correct.
A child now inherits something, which is exactly what InheritedContext exists to
keep a decision rather than an accident, so the capsule records it and SPEC 3.13
says so.
--ablate upstream leaves the edge ordering its endpoints while delivering
nothing, which is what lets the payload be measured apart from the order.
Against the real provider on benchmarks/upstream-edge/fleet-edge-wide, n=6 per
arm, removing the payload cost +27.6% tokens (exact permutation p=0.011) and
+59% sub-agent tool calls for the same answer, 6/6 solved either way. On a fact
one grep away it buys nothing: the edge pays in proportion to what the
upstream's work cost against how small its result is.
boot.go's delegation registrations moved to delegation_tools.go and Execute's
spec loop to buildItemSpecs; that, plus folding two defaulting branches into
firstNonEmpty, is what paid for the new lines without widening the repolint
baseline.
The refusal carried "use POST /inbox/items for durable follow-up" as its
detail, and the frontend's wording for that code interpolates the detail — so
what reached the screen was half a Chinese sentence with an API route glued to
it. The kernel was telling the client what to do and the client was showing
that instruction to a person.
Both halves. The refusal keeps its code and drops the route: the English is for
a log now. And the client does what the code asks — it queues the words as a
durable follow-up, which is a row that says it is waiting rather than an error
nobody can act on. That also closes the race behind the report: the turn reads
as finished on screen while the kernel is still landing it, and typing in that
window produced a refusal for timing, not for content.
A queued row now says which wait it is in. Guidance lands at the next tool
boundary; a follow-up goes when the turn does, and the two are not the same
promise.
DetectLanguage reads REASONIX_LANG, then the POSIX locale variables. Windows
sets none of them, so every native surface on a Chinese Windows fell back to
English — the CLI's own words, the folder picker, the status icon's menu —
while the webview beside them read the browser's list and got it right. Two
halves of one app answering the same question differently.
The machine is asked last, after anything set on purpose. It goes through a
variable so the priority between the two is testable on a machine that answers
either way, rather than only on one that happens to be installed in Chinese.
Catalog could not use it: an empty preference means "follow the machine", and
what Catalog returned instead was whatever the process had already installed —
English, for a window that installs nothing. CatalogFor resolves the same way
DetectLanguage does and installs nothing, which is what a shell whose interface
language is a setting of its own actually needs.
Three defects, one feature. The icon drew and then answered nothing, left
button or right: systray creates its window and pumps GetMessage on whichever
goroutine calls Run, and RunWithExternalLoop — which reads like the embedding
path — starts that pump on a goroutine nobody pinned. A Win32 message queue
belongs to a thread, so the window sat on one and the pump read another. It has
its own locked thread now, on Windows; the other platforms keep the documented
path, because macOS puts its status item on the main thread and Wails already
owns that one.
Clicking it did nothing for the commonest case, a window that was open and
merely buried: show and unminimise are both no-ops on that, so the raise has to
be asked for. And the icon read as a brown blob with a black slit, because the
notch was painted in the window's own dark page colour — an assumption about
the taskbar behind it that a light one disproves. It is cut out now.
The switch for it could not be switched: the field took the value and the
renderer never wrote it, so every save dropped it and the setting turned itself
back on. A setting the renderer drops is a setting that does not exist, and the
round trip is now a test.
The settings pane draws the dependency instead of enforcing it invisibly: the
close-to-tray switch hangs off the icon switch, indented, because without an
icon there is nothing to bring a hidden window back and the second switch is
not a choice. The icon itself is a launch preference — systray quits once per
process, so an immediate off would be a switch that cannot be switched back.
[desktop] close_behavior has been normalized, migrated and editable since
before this shell existed, and read by nobody: quit|background was a promise
the app did not keep. This is the half that was missing. The close button hides
where an icon can bring the window back, and quits where it cannot - no icon,
no backgrounding, because a window that vanished with no way back to it would
be worse than either.
What the icon says is folded in internal/traystate, which owns no OS handle and
draws nothing: panes in, one State out, ranked so that being needed outranks
being busy. Nothing on the wire announces an answer to an approval, so the fold
reads the first thing the run produces afterwards as the resolution - a turn
blocked on one produces nothing until it is answered, which is what makes that
sound rather than a guess. Background jobs are pulled on a timer instead,
because a job announces its life in a sentence and matching those words is the
judgement this codebase keeps retiring.
Quitting from the menu runs the window's own close sequence rather than a
second one. The reason that sequence exists - two processes writing one
transcript - does not care which control asked for it.
Windows is verified: it builds, and the icon's own encoder is the 22-byte ICO
header around a PNG. macOS and Linux compile from here but cannot run: this
machine has no CGO toolchain for either, and the thing to check there is
whether systray's external loop is happy beside Wails' own on the main thread.
/config/problem and /config/repair reached the kernel over HTTP and nowhere
else: the window routes by table, so both answered with index.html, and the
banner that says a config file will not parse could never load in Studio. The
dev proxy had the same hole.
The two guards that read the kernel's own registrations are what caught it,
which is the whole reason they read those rather than the client.
Typing while a turn runs queues the line for the next tool boundary, and nothing
could cancel it. The durable item had an id and a delete route, but the delete
refused the one state a queued steer is in, and the frontend had thrown the
receipt away - so the row on screen had no name to cancel by.
The authorization comes from the executor's queue rather than the durable state.
Its lock is the only place that can tell "not read yet" from "already on its way
to the model" without racing the run loop, so the drop there is what permits
removing the durable half: in that order, and not at all if the drop fails. Too
late answers with its own identity instead of a state name, because "removed"
and "already gone" are different sentences to the person waiting.
It rides the verb that already existed, so the CLI's inbox pane, ACP and the bot
inherit it with the controller. Studio grows one control beside the queued badge,
visible without hovering for it.
The settings screen showed built-in defaults while the user's own config sat
unreadable on disk - settings nobody had chosen, presented as theirs - and said
nothing until a save was refused with a parser's sentence about columns. The
runtime already recovers from this by loading the last-known-good snapshot;
loadForEdit does the same now. The save guard is unchanged, because a file
nothing has read is not a file to overwrite.
The refusal carries an identity. A config that will not parse is one condition
wherever it surfaces, so every panel answers config.unparsed with the line, its
text, and the one repair that is certain: a Windows path in a basic string, said
the way TOML accepts. The parser locates the escape it refused and the parser
confirms the result, so nothing here reads the message it wrote and a file it
cannot finish is left alone. The sandbox explains itself by code for the same
reason - the English under a Chinese heading was the kernel talking to a person.
While that path was open: the 24 places in internal/serve answering with a bare
error string now send a code, and refusal-path guards that envelope the way it
already guarded http.Error. A body carrying other fields is a report a panel
renders, and stays out of it.
A background job held the workspace writer lease until it was terminal, and for
a dev server that is never: the next session's first write waited behind
something that was never going to end, told only that it would continue
automatically when it was safe. The retention hook fired for every registered
job, so the case it really covered - a process the user left running - is the
one case it must not.
Agent runs already take the lease for themselves, so nothing needs the hook. It
is gone, with RetainUntil and the jobs option that carried it. A background
subagent still holds the lease for its whole run, because that run is bounded;
a process left behind is not.
The wait it does report is legible now. Contention under a second stays silent -
it is either milliseconds or a whole turn, and reporting the first kind left a
permanent line about a wait nobody experienced. Past that the open is a warning,
because the turn is stopped for the length of it, and it is always closed by a
report carrying the measured wait. Studio holds the state on the run strip while
it lasts and rewrites the card in place when it ends; a headless run sees both
ends on stderr, where it used to see nothing at all.
Remote workspaces are what this version is: a machine reached over SSH whose
folders and conversations sit in the sidebar beside the local ones. The rest
is what that took — a Windows host, a fingerprint someone has to read, a pane
addressing a runtime of its own over there — plus the effort ladder becoming
a fact about the endpoint, which is the one entry that changes what an
existing setup does.
`until_output_matches` and the reworded timeout_seconds description are a
deliberate change to the provider-visible tool surface, so the recorded
baseline moves with them.
Cache impact: the tools hash changes and the prefix hash with it, which
cold-starts the prompt cache once per machine. The system prompt is
untouched, and the schema grows by 91 tokens.
Polling a long job costs a round per look, and the alternative was waiting
blind — so the model kept choosing to poll. wait now takes a pattern and
returns the moment a job writes something matching it: one round for a job
that runs an hour, and still woken by the line that matters.
The pattern comes from the caller, because only the caller knows what it is
waiting for. A host deciding which words deserve an interruption would be the
same guess this codebase keeps retiring, and RE2 makes an untrusted pattern
linear rather than a way to hang the run.
Two things a naive version gets wrong, both found by the tests failing:
a watch registered after the line was written must still match — otherwise
asking a moment too late waits out the whole timeout for something already
true — and one registered mid-line must be seeded from what is already there,
or a pattern the next write completes is never seen.
What a wait reports is a reading, not a verdict: how long the job has run,
everything it has produced, and how much of that arrived while this call was
waiting. Slow progress and a stop differ there, and which one a task should
look like is the caller's to know — not a threshold anybody has to configure.
Two CI failures, both mine. Windows lint: the agent method was offered
unconditionally there, since the pipe name is fixed and nothing read an
environment variable to decide — so the caller's nil check could never be
false. It knocks first now, which is both what the check wanted and one less
dial per handshake on a machine with no agent. Windows tests: three of them
built a JSON body by hand around t.TempDir(), and every backslash in a
Windows path is an escape, so the body never parsed.
And the report behind it: a background job that redirects its output into a
file is silent on its own streams, which the watchdog called "may be stalled"
after fifteen minutes of it downloading a hundred megabytes. Silence is the
fact; stalled was the guess. wait now says how long a job has been running
and whether any of it ever reached this side, so the difference between a
task writing elsewhere and a hung one is visible rather than inferred — and
the answer names the longer timeout instead of another short step.
Two halves of one report from a user, whose screen showed the same notice
twice and then "model finished without a visible final answer 3 times".
The cause: a gateway can answer 200, hold the stream open long enough to look
healthy, and end it having sent nothing — no content, no reasoning, no tool
call, not even a usage record. That reached the turn as an empty answer, so it
spent three retries on it and named the wrong party. Told apart, it is
StreamInterruptUpstreamError like any other failure the far side reports
inside a 200: retried by the request layer, and ending with what happened. A
stream carrying only a usage record is still the model answering, and keeps
the turn's retry — the case that guard exists for.
The screen: repeats fold into one line and a count. Notices carry a code on
the wire that the session state dropped, and with it the ones this build has
wording for read in the reader's language rather than the kernel's English.
A code it does not know still reads.
Classification moved into stream_failure.go, which is what that file is for.
openai.go got shorter for it and the freed budget is reclaimed.
A machine worked on for months holds thousands of conversations. The local
column caps its list at thirty for that reason — drawing them all is what put
98k nodes in a sidebar once — and the remote tree, added later, drew every one
of them. A host can be folded now too, which is what makes several of them a
list rather than a scroll with the local projects somewhere above it.
Two things followed the focused pane that should not have.
The event pump still asked the far hub for /events with no runtime prefix, so
it listened to that hub's default runtime while the pane sent its turns to the
one it had opened. Everything worked and nothing came back.
Appearance was read and written through whichever pane had focus. A remote
kernel keeps its own copy, so switching to a pane on another machine repainted
this window with that machine's theme. It belongs to the window: the local
pane is what these three now read and write.
Windows answers SFTP with /C:/Users/... and its kernel takes C:\Users\... The
first spelling travelled all the way to the far hub, which tried to open
C:\C:\Users\... and refused — reaching the window as a bare 502, because that
one path had no code on it.
The platform converts, since only it knows both. The pane's name is cut the
same way: either separator can appear in a path this machine does not hold,
and its own filepath rules are not the authority on one.
It never was. The launcher linked the frontend in from the source tree, and a
symlink whose destination is outside the bundle fails codesign --strict — so
the app had a signature that verified nothing, and an app macOS cannot verify
gets no stable identity to hang a Local Network grant on. That is the whole
distance between "ping reaches the host" and the window saying no route to it.
Both fixes are the released bundle's own: copy dist rather than link the tree
(scripts/studio-build.sh has always copied), and sign --deep, because
everything under Contents/MacOS counts as code and each file needs its own
signature. The launcher now verifies afterwards and says so if it fails,
rather than leaving that to be discovered as a networking bug.
Three places still told the reader that a remote must be Linux or macOS, the
window's refusal among them. What it should say is narrower and more useful:
the link is fine, that machine's system is what a kernel cannot be installed
onto — and name the three that can.
Everything below the SSH link assumed a POSIX shell. It now goes through one
interface — which shell, which spelling of a path, how a process is started
there and found again — so the difference is in one place instead of a branch
at every call site.
Two things about Windows had to be discovered against a real machine rather
than reasoned about:
Detachment. OpenSSH puts a session's children in a job object and ends them
with the session, so a serve started by Start-Process was gone before its
port file appeared. What the WMI service creates has no such parent, and that
is the setsid of this platform.
Quoting. Commands travel as -EncodedCommand — base64 of UTF-16LE, which holds
no character cmd treats as special. That removes the outer quoting problem
rather than solving it: cmd's rules are where this would have become a
security bug, and a path with an apostrophe in it now proves the point in a
test. Inside the script PowerShell's single quotes follow the POSIX rule.
Also: the CLI release ships Windows as a zip holding reasonix.exe, and the
downloader knew only tar.gz holding reasonix — so a Windows remote had no
install path at all.
Verified end to end against a real Windows host: bootstrap, launch, survive
the session, HTTP through the forward to /status and /tree, then stop.
macOS grants Local Network access only to an app whose Info.plist says what
it wants it for. Neither bundle said anything, so the request was never put
to the user — no prompt, no entry in the privacy list, and every LAN host
answering "no route to host" while ping and the CLI reached it fine.
The release bundle had this too: any host on the user's own network was
unreachable from the window and reachable from everything else.
The launcher also signs with a development certificate where one exists. An
ad-hoc signature's hash changes with every build, so the grant would have to
be given again after each one, which is indistinguishable from it not working.
LocalBinary was copied from the CLI, where the running executable is reasonix
and uploading it is the fast path. Here it is the window: the far side would
receive a Wails app, probe it for a serve command, and reject it — after
paying for the transfer. Left unset, the install falls to npm and then to a
verified release download, which is what it should have done from the start.
Connecting to a Windows host failed as a bare 502 — "the request did not
reach the kernel" — when the SSH link was fine and the far end simply has no
uname. The reason existed the whole way up and was dropped at the last hop:
an error with no code reaches the window as a status and nothing else.
Unsupported remotes now carry a sentinel, so the window can say which half
failed rather than implying the link did. The wording carries no detail on
purpose: what such a machine answers is its own shell's complaint in its own
code page, and putting that on screen explains nothing.
Everything else keeps its text under a coded fallback, which is what makes a
failure legible at all instead of arriving as a number.
Everything above the dial — what the agent offers, which keys IdentitiesOnly
filters out — was inside the !windows build tag, so the Windows half could
not have reused it even when someone wrote it. It moves to a file with no
tag; each platform now supplies only how to reach the agent.
Windows reaches it through the pipe its own OpenSSH service fixes the name
of, with SSH_AUTH_SOCK winning where a port of the Unix agent set one. A
named pipe opens as a file, which is the same call the agent's own clients
make, so this needs nothing new to depend on.
The tests are the first for this code that run on every platform: an agent
key authenticating, IdentitiesOnly offering one key out of two, and an absent
agent not consuming publickey — the last mattering most where the pipe name
is fixed and the method is therefore always registered.
Until now a remote host offered exactly one workspace — whichever the book
named — which made it a shortcut rather than a machine you can work on. A
connected one now answers for itself: its folders and the conversations in
them, read through a pane already open on it, so no second connection and no
second serve process.
That is also why a pane had to address its own runtime over there first. With
one, resuming a remote conversation is the same act as resuming a local one,
and the sidebar can tell which of them this window is already driving.
Unconnected hosts keep the single row, which is also the connect button:
before a kernel is running there is nothing on that machine to ask.
The proxy strips the pane's prefix, so what reached the far hub named no
runtime and landed on its default. Two panes on one workspace share a link
and an address by design — and were sharing the conversation as well: one
transcript, two writers, both streams interleaved.
A pane now opens its own runtime on the far side and addresses it, which is
also what makes resuming a remote session possible at all. It is retired when
the pane closes, before the forward that reaches it goes away, or the far
machine collects runtimes until its own ceiling refuses the next connect.
The kernel builds a structured mismatch — which record it contradicts, down
to the line — and the path to the window flattened it into a sentence. Now
the link layer names what it knows: a changed key, a declined fingerprint and
a refused credential each carry their own code, and the mismatch carries the
known_hosts record so the reader can go look. There is still no way from
there to connecting anyway; a warning you can click past is not one.
The parity guard did not catch the missing wording, because it matched bare
identifiers only and a host outside the package calls the constructor
qualified. It watches both now — verified by removing a wording and seeing it
fail, which is the only way to know a guard is looking at anything.
Until now the link layer had nobody to ask, so it took the strict path: a
machine not already in known_hosts was refused, and a passphrase-locked key
could not be used at all. Both are questions, and the window is the only
thing that can put one to a person — so they travel out on the shell's bus
and the answer comes back through a binding, since the dial is blocked on it.
The fingerprint dialog is deliberately the harder one to get past. Its
fingerprint wraps rather than truncates, because one with its middle elided
cannot be compared to anything, and the focus starts on the way out: Enter is
a reflex, and accepting a key nobody read is what this exists to prevent.
A machine was only addable from the CLI, which made the sidebar section
something the window could show but never fill. The book is user-global, so
an entry belongs to the person and not to whichever folder happened to be
open when it was added.
The listing returns the stored row in full rather than the fields a row
displays: saving replaces an entry, so a page editing one field while holding
a partial copy would blank the passphrase variable somebody set from the CLI.
Forwards have no control here and are carried through for the same reason.
Importing beats typing — on a machine that already uses ssh the addresses are
written down next door, so ~/.ssh/config aliases the book does not have yet
are offered as one-click rows.
Hosts are a section, not a prefix: workspaces on one machine share a
connection, so the state belongs on the group — when a link drops, the whole
section dims together, which is what those rows actually are to each other.
Local workspaces stay unmarked, so carrying a chip is itself the signal. The
same chip appears on the pane tab and in the crumb, because a command lands
on whichever machine the focused tab points at.
A cold connect installs a binary on the far side. The kernel already reports
each step, so the wait is a list of them rather than a spinner that cannot
tell downloading from stuck.
Two function fields become one interface. The split it draws is the one that
matters: the book of hosts is configuration and stays in serve, while what a
link is doing belongs to whoever holds it — so the hub joins them without
learning what SSH is.
The pool records state whether or not a caller subscribed. A window that
opens a second pane an hour later reads the same row as the one that dialled,
and the connect step a first attach is on has somewhere to be read from.
The hub gets the endpoint from a hook the host wires, so the two halves meet
above it: a window supplies a pool that dials, and a listening server leaves
it nil. That default is the point — a kernel that dials onward because a
request asked it to is someone else's way into the network behind it.
A hold the attach took and the hub refused would be a connection nothing can
ever close, so the endpoint gives it back on every path that does not publish
a pane.
Three sweeps reached into a local assembly and would have found none. The
stream needed more than a guard: the asset server holds a response until its
handler returns, so a page inside the window cannot read SSE at all — the
shell reads the far kernel's stream and re-emits it onto the same bus a local
pane's frames ride.
Resuming rides what the stream already carries: the remote numbers its
resumable frames and honours Last-Event-ID, so a link that drops mid-turn
costs only what its replay log has since dropped.
Dialling a configured host lived in the CLI, where a second frontend could
only copy it. It moves to attach, which adds what a window needs and a
terminal did not: a pool where two workspaces on one machine are one login,
and a forward per workspace that the last pane out takes down. The remote
serve is left running — it outlives the link by design.
Exercised against a real SSH server with SFTP and forwarding, so what the
tests cover is the link and not a stand-in for it.
The hub takes an endpoint, not a connection: what makes a pane remote is
where its HTTP goes, so SSH stays above this layer and a proxied pane is
testable over httptest. The frontend addresses /rt/{id}/ either way.
Host decisions reach local panes only — a remote one has no assembly here
to apply them to. The stream is what the proxy has to get right, and the
test withholds the second frame until the first has arrived.
CheckPlanModeReadOnlyTrust had no caller outside its own tests. Everything
behind it was still there: the gate interface and its request type, two setters
and the coordinator that propagated them, the approver on Controller, the
session-trust map in approvalManager, the slot that map occupied in the
authorizations a controller rebuild carries, the boot callback that persisted a
prefix, and two approval-card branches in the TUI. None of it could run.
The bridge was superseded rather than abandoned, and the code says so in three
places: agent's interface ("ordinary Plan execution no longer invokes it; bash
calls use the normal permission gate"), Options ("classifies bash through
Permissions instead"), and config ("Main Plan bash calls now use the ordinary
Permissions classifier and Sandbox"). What was left was the wiring around a
decision already made.
The config field stays. Its comment claims exactly one job — old config and
session round trips — and that job is real: reading a reasonix.toml that still
carries plan_mode_read_only_commands must not fail, and rendering it back must
not lose it. Both are still tested. What is gone is the runtime that field no
longer feeds.
Tests that borrowed the removed tool constant as a sample keep their subject
with an ordinary tool name; the two plan-mode tests keep theirs, which was
never the bridge but what replaced it — bash reaches ordinary permission as the
declared writer it is, and a writer stays behind permissions. Tests of the
bridge itself go with it.
Touches internal/control/approval.go, a declared sensitive path. The change
there is confined to the plan-mode trust map and its slot in
SessionAuthorizations: grantSession, the granted map, requestApproval and
RequiresFreshHumanApprovalTool are untouched, and the rebuild test still proves
an ordinary session grant survives a controller swap. No path gains an
approval, loses a prompt, or widens what may run without one.
Removal was driven by the compiler and then by `unused`, one orphan at a time,
until both were clean. Net -592 lines.
vendorCapabilities declared compactionOutputTokens and two vendors set it, and
nothing read it. Its comment describes a real intent — "the separate budget for
native/summary compaction calls … without inheriting a large default" — and
that intent is already met, one level up and one grain coarser: the fold's
provider call sets MaxTokens from agent's summaryOutputMaxTokens rather than
from the client's answer budget.
The numbers say the same. DeepSeek's entry is DefaultOrdinaryOutputTokens, 16K
— exactly what summaryOutputMaxTokens already applies, so wiring it would have
changed nothing there. The other is 8192, and has never taken effect.
Making it per-vendor is a feature, not this: a compaction call would have to
say so on the request, which provider.Request has no way to carry today. The
coarse limit stays where it works. If the per-vendor grain is wanted later, it
starts from that missing signal rather than from a field nobody reads.
A field that is written and never read is a claim about state that nothing
backs. `unused` does not catch them — a constructor assignment counts as a use
— so a sweep over every unexported field in internal/ turned up the candidates
and each was read before deciding.
transcriptDirty (cli): eleven writes, no reader. Its comments still described
what it did — "forces a viewport re-feed after that in-place rewrite", and one
naming #6978 for what it must never force. #6978 replaced the whole-history
rebuild with invalidateWrapFrom, and setTranscriptBlock calls that on every
in-place rewrite, which is what re-feeds a same-length change. The reader went
then; the flag, the eleven writes and three comments crediting it did not.
recoveryGeneration (agent): a second copy of a generation that already travels.
Its comment says it is captured "so ObserveResult can ignore stale results
after a mode switch" — and ObserveResult does exactly that, from the local
recoveryGen the call site passes it. The copy on toolOutcome went nowhere.
Neither removal can change behaviour: nothing read either one. What changes is
that the comments no longer credit a mechanism to a field that is not part of
it.
c.mimo reads as vendor identity and is not: its one use rewrites tool schemas
out of the pre-2020-12 tuple keywords, which is a fact about the dialect the
endpoint speaks. NormalizeLegacyTupleItemsForDraft202012 says as much — a
provider "must opt in only after the target endpoint's schema dialect is
known" — so the field carries that, not a name.
This came out of looking at whether the client's six vendor booleans should be
one enum, and they should not. They are not one dimension. deepseek, minimax,
zhipu and longcat are thinking protocols and are mutually exclusive, decided by
one switch. This one is a wire-compatibility need, and kimiK3 is a contract
shape; both are resolved independently, and both can be true alongside a
thinking protocol — a base URL at xiaomimimo.com with protocol="deepseek" sets
deepseek and this flag at once, and that is correct: the endpoint wants
DeepSeek's thinking shape and needs its schemas rewritten. An enum would make
that combination unrepresentable and force a product decision — which vendor
wins when the declared protocol and the host disagree — under the cover of a
refactor.
So the scalar count stays where it is. What was actually wrong here was one
field claiming to be an identity.
Job carried five artifact fields and wrote to them from four places, and the
rule for recording a failure was spelled three times in two different ways.
Close kept the first error — "closeErr != nil && j.artifactErr == \"\"" — while
both writes overwrote whatever was there. Once a disk fills every write fails,
so the message that survived was the last one, which says nothing the first did
not. They are one type now, and noteErr is that rule in one place, the way
Close already had it.
The timestamps go the same way: started, activity and finished are the job's
timeline, and activity is the one stall detection reads — a job can run for an
hour with its output stopped in the first minute, which is why it is not
derivable from the other two.
tombstone goes entirely. It was set true in one place, when a finished job is
rebuilt from its persisted metadata, and read nowhere: the state it meant is
already carried by a closed done channel and a terminal status, and Manager
tracks per-session loading separately. A field only ever written is a claim
about who depends on it that nothing backs.
Job goes 18 scalars to 11.
goalMachine's state reaches a rotated session through capture/restore, and
both copy field by field. Adding a field to the machine and forgetting it in
either one compiles: the goal simply arrives without it, and nothing reports
the loss. Twenty-one fields are copied by hand in two directions, which is a
lot of chances to miss one.
Two guards read the declarations and both function bodies. What is left out is
named with its reason — the two locks, the epoch restore bumps rather than
carries, and the budget and state path that belong to the controller that built
the machine rather than to the goal being moved — so leaving something out is a
sentence someone writes, not a line someone forgets.
Checked both ways a field goes missing. Adding one to goalMachine without
carrying it: named by the first guard. Declaring it in the snapshot and
dropping its line from restore: named by the second. Removing one from the
snapshot struct needs no guard — that one the compiler already stops.
This is what the 21-scalar ceiling on goalMachine is really asking about here.
Grouping the fields would satisfy it, but the fields are read in 242 places and
the persisted goalState cannot follow them, so the copies would stay hand-
written and the loss they invite would stay possible.
Each of these sat on Controller and was read in one or two places, all inside
one subsystem: the MCP default call timeout only ever fills in a spec the MCP
manager builds, the implicit-invocation switch is only asked about skills, and
the slash sequence only numbers a slash-invoked skill's synthetic call. They
belong where they are consulted, not on the object that happens to hold both
ends.
skillSet's comment claimed every field is set once at construction, which
slashSeq would have quietly falsified — it now says which field is the counter
and that it synchronises itself.
Controller goes 20 scalars to 17. The remainder is values (the workspace root,
the label, the model ref) rather than flags, and the ceiling is aimed at flags
whose combinations describe states nothing reaches: workspaceRoot alone has 64
readers, and wrapping it to reach a number would cost every one of them a level
of indirection for no state it makes illegal. What Controller actually needs is
the responsibility split the memory and checkpoint managers started, not more
field moves.
The ratchet caught this change trying to bring two-line field comments in and
was right to; they are one line each now.
Controller carried running, finishing, canceling, rotating and closed side by
side. Their own comments say they constrain each other — "running and rotating
are mutually exclusive gates", closed "seals turn admission" over all of them —
which is exactly the shape the scalar ceiling exists to catch: five independent
flags describe 32 combinations, and a controller only ever reaches a handful.
They become turnGate, and the two questions the call sites kept re-deriving
become its methods. `running || finishing` appeared three times and is what a
bare running check gets wrong — the window where TurnDone is still in flight —
so it is active(). The four-way "anything at all in the way" appeared twice, in
two files that had each spelled it out, and is busy().
Nothing moves out from under c.mu: the group is a value field on the same
struct, so every critical section is the one it was. Checked with -race.
Controller goes 25 scalars to 20. The rest do not group this way and should not
be forced to: what is left is mostly construction-time configuration that
belongs to a subsystem rather than to the controller — the MCP call timeout to
the MCP manager, the implicit-skill switch to the skill set, the goal token
budget to the goal machine. Putting them in one bag to reach the ceiling would
read as a group while being a bag.
Agent carried 15 scalar fields against a ceiling of 12. The ceiling exists
because independent flags multiply into states no type records as legal, and
the fix it blocks is adding one more bool — so two groups come out by lifetime,
which is what the rule asks for.
steerInbox is the queue and the two flags around it. They already shared a
mutex and a lifetime — opened on the way into Run, closed on the way out — and
now share a type, so the transitions are its methods instead of seven call
sites reaching for the lock. take() hands the entry back rather than loading
its body under the lock, which is the one behaviour change and the right way
round: no inbox lock is held across a read.
agentRole is what an agent is when it is built and stays: a planner that may
not execute, an executor told to reach for its tools, a caller that needs
visible final text. That fixed lifetime is what separates them from planMode
and the language settings they were sitting next to, which move between turns.
deliveryProfile looks like one of them and is not — beginRunTurn recomputes it
per turn — so it stays where it is.
Agent is at 12, and the reclaim takes the room with it: baseline drops
struct-state for agent.go entirely, along with the file-size and function-size
the two extractions freed. Nothing was raised. The ratchet also caught the new
file trying to carry two essay findings in, which is what it is for.
Reported: at a larger appearance the context-breakdown bubble runs off the
right edge and is clipped, and the smaller the scale the further left it sits.
Both directions are the same mistake. The interface is scaled with CSS zoom,
and the placement mixed the two coordinate systems that creates. Measured in
Chromium at zoom 1.5: a 232px box reports 348 wide, an element at left:400
reports 600, and writing left:300 puts it at 450. So a client rect and
innerWidth are both read on screen — the clamp against them was right — while
the left written back is multiplied by the zoom again on its way in. At 1.5 the
clamped position landed 50% further right, at 0.8 it landed short.
scale right edge, before → after (viewport 1000)
0.8 447 → 512
1.0 640 → 640
1.3 991 → 832
1.5 1266 → 960
Dividing once at the end is the correction the stylesheet already makes for the
same reason, twice: calc(100vh / var(--zoom, 1)), because vh keeps measuring
the unscaled viewport.
The tab context menu placed itself the same way and had the same bug, so both
now go through one placer. Its arithmetic is a pure function so the invariant —
what renders has to be inside the viewport at any scale — is checked without a
browser; the browser half is the measurement in the header, taken with a probe
rather than assumed. Removing the division turns three of the four red.
stripComposePrefixes kept its own copy of the tag list and named five of the
eleven the host injects. So <workspace>, the two language blocks,
capability-route and interrupted-turn-recovery went into the BM25 index as if
the user had typed them: a query for a path matched every turn of every
session, and the search preview rendered the block instead of the message.
The list now comes from the package that injects it. history already imports
agent, so this is the copy going away rather than a new dependency, and the
scan it shares advances through the blocks instead of re-running an ^-anchored
ReplaceAll per block.
TokenizerVersion goes to 2, which is how an extraction change reaches indexes
that already exist — and that bump surfaced a bug of its own. Rebuild fills the
projection through a Catalog built directly on the migrated db, bypassing Open,
so the row kept the schema default of 1; opening the result then saw a stale
tokenizer and wiped what the rebuild had just written. It stamps the version it
built with now. The constant had never moved, so nothing had ever asked.
Verified by removing the stamp: the rebuilt projection comes back empty.
Every save walks the whole transcript to derive the sidecar's preview line and
user-turn count, and each user turn goes through StripTransientUserBlocks. Two
patterns there were quadratic in the turn's own length.
The leading-block pattern is ^-anchored, so a ReplaceAll can only ever take the
first block — and the loop around it re-scanned the whole string once per
block. Advancing past each match reads the turn once and allocates nothing.
The trailing execution-policy cut was `(?s)...*?...\s*$`: a lazy body under a
tail anchor, which backtracks over the string for every start position it
tries. It becomes a byte-exact suffix cut, which is what the delivery-runtime
marker beside it already does — and that one's comment gives the other reason
to prefer it: a lazy pattern anchored at $ swallows user prose between a
literal mention of the tag and the real block at the end.
Measured on one more turn appended to an already-saved session:
messages before after
100 22.8ms 19.0ms
1,000 70.0ms 35.4ms -49%
5,000 196.1ms 119.3ms -39%
20,000 652.3ms 432.6ms -34%
The benchmark stays. What remains is a different problem and not this one:
loadSessionUnlocked is 43% of the rest, because the write check replays the
event log to see whether another writer moved the file — a crash-consistency
mechanism, not an accident.
Reported: a third-party endpoint serving deepseek-v4-flash answered every turn
with "field ReasoningEffort invalid, should be one of: low, medium, high,
xhigh, none". That vocabulary is not DeepSeek's — it has no "medium" and spells
the switch "disabled" — so the endpoint was a relay speaking the OpenAI one,
and the composer had offered "max" because the ladder is keyed by model name.
Pressing continue re-sent the same setting, so the turn could not recover.
The model table already states the rule for the other field it carries:
ContextWindow "is a fact about the model and not about who serves it — a relay
passing it through has the same ceiling". Levels are the opposite kind of fact
and were being inherited the same way. Each measured ladder now names the
VendorHost it was measured against, and only that host is given it. Protocol
and window keep travelling with the model, which is what the table was added
for; the switch between them is host-only, matching isMimoEntry, so a lookalike
hostname cannot claim a vendor's extensions.
Elsewhere the ladder narrows rather than disappearing — a relay with no control
at all is what the model table was added to fix. What is dropped is the levels
outside the API's documented vocabulary ("max", "xhigh"), and they degrade onto
the deepest standard level instead of being refused, the way "minimal" already
degrades. A relay that does take them says so with supported_efforts, which
outranks everything the host would otherwise assume.
The protocol fallback needed the same split: an entry declaring the DeepSeek
protocol without a table entry was offered max wherever it pointed. Narrowing
it unconditionally is what the first attempt did, and TestNormalizeEffortDeepSeek
caught it — that fixture is the vendor host with an unlisted model, which must
keep max.
Three existing expectations move, all of them the behaviour being fixed: a
proxy no longer lists max, a gpt-5.6 relay no longer lists xhigh/max, and the
gpt-5.6 test that asserted a relay takes them "as itself" now expects the
degrade its own comment describes ("an alias degrades rather than sending a
level the model will reject").
Receipt.Write decides what the delivery gates, the baseline, the path
invalidation and the cross-turn diff evidence can see, and it was set from a
list of seven tool names kept in evidence. A writer added without an entry
there keeps working while its writes stop being attributable to a file, and
nothing fails.
ReadOnly could not answer instead: it is false for bash too, which mutates
without naming what it touched. Previewer could not either — it is shaped
around one path and a move has two, which is why move_file never implemented
it. So the question gets its own contract, PathWriter, and the seven tools
answer it themselves.
ReceiptFromToolCall now takes ToolFacts rather than a bare readOnly bool. The
paths that only have a name — fold coverage, the fold index, the cross-turn
PathsProvenInSession — resolve it through the live registry the way
toolIsReadOnly already did for read-only, and that helper is gone since
toolFactsFor answers the wider question. An unresolvable name reads as a read,
so a replay of a tool this build no longer has invents no writes.
Verified the swap before making it: across every built-in, "not read-only and
its arguments carry paths" agrees with the old name table on all thirteen
legal calls, disagreeing only on malformed ones that fail anyway. That is the
evidence the contract covers the same set, not an argument for that rule —
a future tool that runs a path without writing it would break the rule and
still answer PathWriter correctly.
Three guards in builtin: the seven declare it, bash and kill_shell do not, and
nothing read-only does. Checked by flipping write_file's declaration — the
guard names it, and the cross-turn sign-off e2e goes red with it, which is the
behaviour the contract actually feeds.
Also here, from the same sweep: IsDiagnosticSuccess had a command table whose
every branch returned the same value as the line after it, so it decided
nothing; and its doc claimed it kept a success from clearing the failure event,
which the caller does unconditionally two lines up.
Test doubles standing in for writers now say so instead of being recognised by
the name they answer to, and the fold-coverage test reads the shipped registry
rather than its own copy of the answers.
Two things were wrong with the one number watching the largest item in every
first request.
It was at 5700 of a 5700 budget — no room at all, so the next field anyone
adds fails CI with nothing to say about whether that field was worth it. And
it counts the whole built-in set, while a session is billed for the schemas
the provider is shown: 13 of 23, because everything else is reached through
use_capability. Promoting one tool onto that surface costs every session and
moves the guarded number by nothing.
So boot guards the visible surface on its own, at the goal-armed variant
because it is the larger of the two. It fails if the allow-list stops
restricting anything, which is the way this test could otherwise pass while
measuring the wrong set. Checked by lowering it until it went red.
The room comes from the three largest descriptions, each of which ended by
restating its own schema field by field. complete_step's restatement had
already drifted from what it described — it documented `step` while the schema
prefers `step_id` and keeps `step` as the fallback — which is what a second
copy of a contract does. todo_write keeps the two things its schema does not
carry: the two-level shape and the verbatim-step_id rule.
built-in set 5700 -> 5443 budget 5700 -> 5600
visible 3841 -> 3584 new budget 3700
goal absent 3305 -> 3141
Cache impact: 256 tokens leave the provider-visible prefix, so every existing
session cold-starts once and is warm again after. SystemHash is unchanged in
the golden, which is the evidence the base prompt was not touched; ToolsHash
and ToolSchemaTokens (4531 -> 4275) are the tools alone.
The fold effect test came along because it measured this indirectly: it
compared the last request against the run's peak, so a cheaper prefix delayed
the second fold and left more turns after it than before. It now checks each
fold where it happened, which is the invariant it was written for. Verified by
disabling the strip: the counts go linear and it names the fold that kept them.
The batch planner kept a table of six names that never joined a parallel
run. All six return ReadOnly() == true, which is the whole problem: one
bool was answering two unrelated questions. ReadOnly says a call needs no
approval, because it touches no file and starts no process; batching asks
something else entirely, and for complete_step, todo_write, compress, wait
and bash_output the two answers differ.
So the second question becomes its own contract. Each of the five declares
Sequential with the reason it cannot share a batch — a sign-off advances the
task list, a fold rewrites what the batch is reading, a collector reads what
an earlier call in the reply started.
use_capability was in that table because it "may resolve to a real MCP
writer". It now answers for what it proxies: a directory read shares a
batch, a call is its target's catalog entry, and inspect (which can start a
server), decline (which writes the ledger) and an id the catalog cannot
resolve keep their place. Nothing loosens the writer path — an MCP tool
without an explicit readOnlyHint is already false. What this buys is the
case the name table could not express: several read-only capability calls
in one reply now run together instead of one after another.
The four batch tests asserted the fake's contract rather than the shipped
one, which is exactly how a name table survives being replaced by one, so
they take the real registry. Two guards in builtin fail if a tool stops
declaring Sequential, or if an ordinary reader picks it up; both were
checked by breaking the declaration and watching each go red.
Sixty-two commits since 2.3.0: three panels for kernel capabilities that
had no front end (usage, memory editing, single-file revert), the
parallel-call prompt, and the DeepSeek price-table correction.
A change list, not a narrative. What a reader needs from this file is
what changed and whether the upgrade asks anything of them, so the two
that do — the cost figures rising and forking being gone — lead as
breaking changes, and every other entry states the change rather than
the defect behind it. Entries that only a maintainer could act on are
not entries.
2.3.0 is rewritten the same way rather than left as the odd one out; its
published release body is updated to match.
CommitFileRevert had grown to 141 lines and complexity 39, over both
budgets, and the lint gate has been red since. Each stretch it had
accumulated decides one thing, so each becomes a function: claiming the
plan, what the plan alone settles, what the barrier must re-verify, which
preimage the path resolves to, and how the target's payload is staged.
Resolving the preimage was duplicated in PrepareFileRevert and is now
shared.
/usage was registered on the kernel but missing from both path lists the
shell keeps: the window's API whitelist and the dev proxy's. Either one
answers index.html instead of JSON, so the panel read a 404 in the app and
in `pnpm dev` alike. The route parity tests had been red since the endpoint
landed.
A high-effort review of the usage, memory and file-revert work turned up
fifteen findings. Fourteen are fixed here; the two most serious were both mine
and both confirmed before touching anything.
The revert button lied about its scope. store.PrepareFileRevert takes
earliestRevisions(0) — the session's first preimage, not this turn's — so
"put this file back the way it was before this change" promised a surgical undo
and delivered a session-wide one, silently discarding every other edit the
session made to that file. It now says what it does.
Currencies were being added together in the projection. The JSONL path keeps
them apart and three tests prove it; the catalog path, which is what answers
once it is ready, summed 1.50 CNY and 0.25 USD into one column and labelled the
result with whichever currency arrived last. Cost moved to its own table keyed
by currency — tokens add up and currencies do not, so they cannot share a row.
Normalization moved to ingest so both paths agree, and two tests now cover the
catalog path the earlier three never reached.
The rest, in the order a reader meets them:
- keep_current is the kernel's deliberate no-op; the card reported it as
"reverted", the exact opposite of what the user chose.
- A plan the kernel already refused still drew a confirm, and posting it
answered "missing planId" because a refused plan carries none.
- The hero stated the cache hit rate against report.tokens, but the rate
partitions the input side alone. The one number the card exists to teach.
- Usage.tsx had grown its own money/token/percent formatters — the exact
duplication i18n/format.ts documents itself as ending, down to the symbol
glued to toFixed(2) that renders CNY as yen in an English window.
- The daily-spend chart plotted cost[0] and stamped the axis from the first
priced day, merging away the currencies the panel exists to keep apart. One
chart per currency now, for the same reason tokens and money get their own.
- Estimated quotes were aggregated under the label "paid" although the recorder
flags every one of them.
- Three sibling memory handlers answered "memory is disabled" three ways: a
code, a raw English sentence, and a silent empty 200.
- PrepareFileRevert stored plans without the staleness sweep its sibling runs,
and this branch made it reachable from every diff card.
- A SchemaVersion bump renamed the projection file with nothing deleting the
old one, so each bump would orphan another multi-MB database.
- The mock indexed the full arrays with a slice index, so its "7 days" was
neither seven days nor the right seven.
- The plot rebuilt a 365-segment path on every pointermove.
transaction.go went over its budget by seven lines, so single-file revert moved
to its own file — it is a separate responsibility and the sweep is now one
method both prepares call.
Not fixed: /memory/revisions and /memory/restore still have no caller, so the
"an edit is safe because the old wording is reachable" argument is not yet true
from the panel. And control's rewind failures are still bare fmt.Errorf, so the
shapes past canFiles reach the user as an untranslated 500 — the identity rule
REASONIX.md states, owed a separate change.
PrepareFileRevert and CommitFileRevert have been on the Controller with no
endpoint and no caller. The resolution constant says what was missing plainly:
ResolveOverwriteCheckpoint force-writes the preimage "after the user explicitly
confirmed in the single-file UI" — a UI that did not exist.
Two endpoints and a control in the diff header, which is the one place a reader
is already looking at what changed and can see whether they want it back.
Reverting stays two steps because the second one is not always a question. The
prepare answers whether this file is still the one the checkpoint captured; only
when it is not does the reader have to choose between the checkpoint's version
and the current one, and asking up front would ask on every revert. The
conflicted branch is coloured as a decision rather than as another confirm.
Unlike a turn rewind this does not reload the session: one file changes and the
transcript does not, so the pane's callback deliberately skips the reload the
rewind ones do.
Verified as far as this setup reaches: the endpoint contract test confirms both
paths are served, and typecheck, build, i18n parity and the suite all pass. The
click-through itself is not covered — the fixture's transcript only plays after
a real submit, and driving that through the composer's IME-aware key handling
was not worth more time than the feature took.
The panel could list saved facts and forget them. Changing one meant opening
the markdown by hand — while Controller.SaveMemory, MemoryRevisions and
RestoreMemory had been sitting there with no endpoint and no caller.
Unlike the usage panel, nothing was missing from the middle here: the manager
takes a write lock, hands the store the fact, and injects the new text on the
next turn rather than touching the cached prefix — which is the invariant that
makes editing mid-session safe at all.
So this is the two ends. Three endpoints (save, revisions, restore) and an edit
form inside the row that was already expanding to show the body.
The endpoint decides what is editable. Title, description, body, activation and
keywords come from the request; identity, revision and timestamps are read off
the stored fact. Taking those from the panel would let a stale view rewrite an
audit trail it never read.
Saving writes a new revision rather than overwriting, which is what makes
offering an edit safe rather than lossy — the form says so, since a reader has
no other way to know.
Two things the browser found that the source did not: the select had picked up
.pick, a class the workbench already paints with the accent, so it rendered
inside an amber slab; and the parity guard caught memory.unavailable reaching a
frontend that had no wording for it.
The recorder has been appending to ~/.reasonix/stats since it was wired in —
16,321 rows across twelve days on this machine, 4,586 of them carrying a price.
stats/query.go already aggregated it into RangeStats, every field JSON-tagged,
its doc calling it "the full aggregate the settings panel renders". There was
no settings panel, no endpoint, and no caller of Query outside the recorder.
Cost was missing from the middle of that chain. Records carry cost_amount and
cost_currency; usage_rollups had no cost column and RangeStats had no cost
field, so the money stopped at the JSONL. Both now carry it, as fixed-point
integers rather than floats.
Currencies stay apart. Cost is a list with one entry per billing currency: a
single total would have to invent an exchange rate, and the rate a turn was
billed at is not the rate today. A day with tokens and no cost reports none
rather than zero — the field started being persisted later, and rendering those
days as free understates the bill. The panel says so where it shows.
SchemaVersion now names the projection file, which is what makes adding the
columns a version bump instead of a migration: the rollups are replayable from
the JSONL, so the old file is retired rather than altered. That constant had
been sitting unused beside a hardcoded "v1.sqlite".
The panel is one series per chart, so no legend and no colour spent on identity
— length already carries the value. Tokens and money get separate plots because
their units do not share an axis. The one chart colour is the theme's --net
snapped into the readable lightness band for dark mode, which is where it
failed the contrast check.
TurnControl carried eight Submit variants. Four of them are the same two
internal calls with an argument dropped — Submit is SubmitDisplay without a
display, SubmitHTTP is SubmitHTTPFormat without a format — and no frontend
opens any of the four. Submit has 52 callers, all of them tests inside this
package, reaching it as *Controller rather than through the port.
So the port carries the four that mean distinct things and the rest stay on the
concrete type, where their one real user already was.
Removing them takes a trap with it. SubmitUserTurn read (input, display) while
SubmitDisplay beside it reads (display, input); both are two strings, so a
swapped call compiles and runs and shows the wrong text. Its only two callers
pass the same value twice, which is why no test ever noticed. It now reads
display first like every other one.
The port is a description of what frontends drive. Eight ways to start a turn
described the inside of this package instead.
BeginDestroySession opens the window and Finish closes it; jobs pairs them
itself and never consults IsDestroying to do so. The Controller wrapper and its
port entry existed for a caller that never arrived — no frontend, no test, and
nothing inside control either.
jobs.IsDestroying stays: its own tests use it to prove the window opens and
closes, which is the one thing worth asserting about a window.
Counted while auditing the port: 43 of the driving port's 186 methods have no
frontend consumer at all, and they cluster — memory writes (5), single-file
revert (5), most of TurnControl's submit variants. Those are capabilities the
kernel has and Studio has no entry for, which is a product question rather than
dead code, so only this one — provably unreachable from anywhere — is removed.
Auditing the orphans the old desktop left behind turned up a worse kind than a
method nobody calls: a method whose doc says who calls it, wrongly.
ReplayPendingPromptsTo said "Serve uses this for a newly attached SSE client".
Serve uses ReplayPendingPromptsWith, which hands the connection over while the
prompt lock is held; the ...To variant has had no caller on either side of the
port. WriteAuthorityGeneration said "Tests use it to prove old generations
become stale after rebind" — no test does. RebindSessionWriteAuthority offered
itself as a convenience for lease keepers, and no keeper took it.
A doc that names a user is the first thing a reader trusts, and each of these
sent this audit down a false trail before the call graph corrected it. Deleting
them costs nothing that was reachable and removes three wrong answers to "who
depends on this".
The remaining orphans are catalogued rather than deleted: some are a retired
frontend's capability with no replacement (memory doc editing has no serve
endpoint at all), which is a product call and not a cleanup.
Retiring the old desktop took SnapshotForShutdown's only caller with it. The
TUI had never used it: every exit — a quit gesture, SIGHUP from a dropped SSH
session, SIGTERM from a service stop — funnels through tuiShutdownMsg, and it
took a plain Snapshot.
The difference is what happens when another instance holds this session's file
lock. The plain snapshot returns ErrSessionFileLockHeld and stops; the shutdown
variant parks the in-memory transcript on a recovery branch first. Everything
the session added past the last autosave was riding on that distinction, and
the result was assigned to _, so a lock-contended exit lost the transcript and
said nothing.
The error now rides out on the model and is printed once the alt-screen is
gone, which is the only moment it can be read.
The path moved to its own file on the way: the case clause is a call, the
handler and its report live beside the test that reads them. That test reads
the syntax rather than driving the model — Update renders a status line before
it reaches the message, so a stub would have to implement most of the port to
reach one branch. It fails if the handler takes any other snapshot, or assigns
the result to _; restoring both is how it was checked to be watching something.
The five launch-web declarations become two so this lands without widening a
budget.
port.go has always said it — "leaner frontends (bot, acp) depend on just the
sub-ports they use" — and named the bot never seeing checkpoint or memory as
the example of what that buys. Nothing enforced it. The bot named the full
SessionAPI, twelve sub-ports and 187 methods, and calls four of them: eight
sub-ports and 122 methods were reachable by accident, memory and checkpoint
among them. ACP named the full port and drives seven.
GatewayAPI is the four a chat gateway drives; EditorAPI the seven an editor
drives over ACP. serve names one sub-port it never calls and the TUI names none
it does not, so both keep SessionAPI — which is now what its own comment claims
it is.
The guard reads both sides out of the syntax rather than a list someone has to
remember to update: sub-ports and their compositions from this package, the
port types named and the port methods called from each frontend's AST. A
frontend handed more than one sub-port it never calls fails, one being the room
a migration legitimately sits in. Restoring the bot's SessionAPI names the
eight exactly, which is how the guard was checked to be watching something.
The method count in the file header goes with it. It said ~99 against a surface
now past 240, and a number stated in a comment only ever goes stale.
DeepSeek's published rates had moved and this table had not followed. v4-pro's
output was carried at 6 CNY per million tokens against a list price of 13.5
off-peak and 27 at peak, so every cost readout understated by between 2.25x
and 4.5x — for as long as nobody happened to read the pricing page.
The rates are corrected, and the peak schedule they come in pairs with is
applied where it belongs. PeakWindow carries the vendor's own clock: 9-12 and
14-18 are Beijing hours, and a fixed +8 offset states that exactly without
costing an embedded tzdata. The all-weekend rule starting 2026-08-23 is a date
on that same clock. Only a rate confirmed as the vendor's own is rescheduled;
a price a user negotiated is their own arrangement, and projecting someone
else's peak hours onto it would invent a number nobody published.
Which is what exposed the second half. resolveCatalogIdentity decided the
vendor by reading names — strings.Contains(name, "deepseek") — while the
catalogue beside it states the actual test: host equality, because a relay
bills on its own terms even when it serves the same model. Both directions
were wrong. A relay named after a vendor was quoted against that vendor's
table, peak window and all; a vendor's own endpoint under a plainer name was
not quoted against it at all. The host test already existed and config already
used it in ten places — it now reaches the quote through QuoteContext, and the
guessing is retired. An unnamed vendor gets no official table, which leaves
the user's own rate card: right rather than plausible.
An effect test pins it through the real Build stack. Both runs name the entry
after the vendor, because that name is precisely what must not decide it; the
host is the only variable between them. Restoring the old guess turns the
relay case red, which is how the test was found to be watching nothing on its
first draft.
Nothing serves these prices over an API, so CheckedOn dates each row and a
test fails when one goes ninety days unread. It cannot stop someone bumping
the date without opening the page; what it buys is that the question gets
asked at all. LongCat's rows are a launch discount with no published end and
say so.
Peak pricing makes any quote time-sensitive: a test using official rates
without pinning a clock now fails on weekday mornings. QuoteContext.Now and
QuoteInput.OccurredAt are the injection points, and the boot-side tests use
them.
Wiring the host test in cost one line, which put boot.go one line over its
file and function budgets. The CostQuote assembly moved to its own file
instead: boot.go is 25 lines shorter and build 24.
The opening screen asks for a service address and a key, then infers the rest
— protocol, model list, whether it reads images. It never said where the key
itself comes from, and a person who does not have one has nowhere to go from
that field.
Each shortcut now carries the vendor's console, reachable from beside the key
input and again from the refusals that are settled there rather than here. A
vendor whose key page we cannot name links to its platform root instead:
sending someone to a 404 is worse than sending them to a front door.
The refusals had to become codes first. Probing failed as one sentence, so a
refused key, a path the endpoint does not serve and an embedding-only gateway
all read as the same dead end. The status the model-list request came back
with was already typed, and thrown away one frame up; it now travels as one of
nine provider.probe.* codes, each with its own status and its own next move.
Spelled as a switch rather than built from the reason, because the parity
guard reads those call sites and cannot check a concatenated code.
Two defects surfaced on the way. sse_provider threw a bare Error, so a coded
refusal could not have been read even once it existed — post0 already carries
it. And i18n.test.ts excluded the i18n directory, which is where kernel.ts
words every refusal: 37 codes had been reaching English windows in Chinese
with nothing to catch them. The catalogue now guards its own wording, those 37
are translated, and they move to en_kernel.ts — they belong to no screen, and
en.ts was over its line ceiling.
The executor has always run independent calls from one reply in parallel, up
to eight at a time. Nothing said so, and the model reached for one tool per
reply: measured over nine tasks, 71 calls arrived across 65 replies.
Two runs with the sentence, against one without, same nine tasks, all passing
in every run:
replies 65 → 55, 56 -14.6%
calls 71 → 60, 56 -18.3%
wall 244s → 159, 176 -31.4%
prompt 488k → 430k, 398k -15.3%
cost -9.5%
Fewer replies is where the rest of it comes from: a reply is a round trip, and
a round trip re-sends the whole prompt. The sentence costs 66 tokens once, in
the cached prefix.
Cache impact: the prefix gains those 66 tokens, so every existing session
cold-starts once against the provider's prompt cache and is warm again after.
The policy list is now one slice rather than two, since the test that strips
these back off was reading a copy of it.
A measured run: 3,995 of the first turn's 5,577 prompt tokens were built-in
tool schemas. That is the largest single item in a cold request and the thing
a warm one pays to keep cached — and nothing was watching it. A tool gains a
field, a description gains a sentence, and the floor under every session rises
with no one the wiser.
The whole built-in set rather than what a preset exposes, so the number does
not move when an allow-list is edited, and the failure names the largest
schemas so the next reader knows where the weight is.
Both draw one item of a list in the extension page, both own the calls that
change it, and one of them already had a file. The state table only this row
reads goes with it.
Adding an MCP server and adding a plugin package each have a file. Adding a
model source did not — it sat inside the list that shows them, along with the
form for editing one, and the two of them were most of that file's 754 lines.
They move out, each with the helpers only it was calling: the name-collision
check with the add form, the header and extra-body parsing with the edit form.
What is left is the list itself, at 306.
The fixture had split five subjects out; the real side had none, and both
files plus the contract were sitting one line under the ceiling. Taking the
same five across, then four more on both at once — external services, hooks,
network, themes — leaves the two sides matching face for face, and every one
of them with room again: 799 to 517, 778 to 485, 784 to 275.
Each face carries the state that belongs to it. The fixture's server list
lives with the calls that switch a server off, its hook list with the dry run,
because nothing else was ever reading them — which is what made these the
subjects worth splitting rather than a line drawn to hit a number.
Half of the port's types already lived by subject — providers, plugins,
storage, appearance, boundary — and the other half sat in the contract file
with the interface, 784 lines of them, one line under the ceiling. The split
was not a rule anyone was following; it was where someone had last needed the
room.
So the rest follow: sessions, external services, workspaces, skills, models,
account, versions, hooks, network, shell, memory. port.ts keeps the interface
and stays the way in — everything is re-exported from it, so no reader of a
port has to know where a type is written down — and drops to 275 lines.
Each of those names now matches a face on both implementations, so a subject's
contract, its wire calls and its fixture can be read side by side.
The fixture reads as five subjects, each in its own file and chained on so one
declaration still satisfies AgentPort — appearance, extensions, shell,
boundary, providers. The side that actually talks to the kernel had none of
that: one class held every method, and its file sat at 799 of the 800 it is
allowed, as did the fixture's own remainder and the contract beside them. The
next endpoint had nowhere to go.
So the real side takes the same five faces, in the same order, so the two can
be read against each other: sse_look, sse_ext, sse_shell, sse_boundary,
sse_provider, and the port class chained on the end. Adding a provider call
now touches a 59-line file rather than an 800-line one.
Two things the faces share move out with them: rootQuery builds a URL, which
is what the transport file is for, and WailsBind describes what the desktop
shell binds onto the window, which is neither the transport's business nor any
one face's.
The wire's fields already have a contract test; the paths carrying them did
not. Both sides write them as string literals, so the compiler sees one thing,
tsc sees another, and the two are only ever compared by a request that 404s.
One direction only: a route with no caller is not a fault — the CLI and the
setup page reach some of them — while a call with no route always is. The
sweep verified there were none; this is what keeps that true. It fails if
either side stops stating its paths where the patterns can read them, because
a run that compared nothing looks exactly like a clean one.
Giving the extension page somewhere to report a refused switch put Settings
over the 800-line ceiling. The row that draws one skill — with the note about
how the model can reach it, and the scope table only it reads — is a whole
thing on its own, so it goes into a file of its own rather than the budget
moving for it.
Killing the kernel mid-session and pressing Send showed three things at once.
The transcript kept the message — the client adds that row itself, because
nothing on the wire echoes what was typed, and nothing took it back when the
post failed. The composer had already been emptied, so what was typed was
gone. And the notice read "/submit: 500", which is a path and a number.
So the row now carries an id its sender knows, and a refusal takes it back;
the line goes back into the composer, refs and all, since it is the assembled
text that was sent; and a failure that carried neither a code nor a body says
what kind of failure it was instead of printing the message meant for logs.
HttpError records whether the answer had anything a reader could use, rather
than the display end trying to recognise its own fallback string.
Both files this touched were sitting one line under the 800 ceiling, so the
session's types and HttpError move into files of their own rather than the
budget moving for them.
Failing one endpoint on purpose showed what a refusal looks like from the
outside: the switch snaps back — the row re-reads the server rather than
assuming its own optimism — and nothing else happens. No message, and the
error goes out as an unhandled rejection. From the user's side that is
indistinguishable from a click that missed, so they click again.
The model page already had the answer, one place on the page to say why a
switch was refused, with every operation there routed through it. The
extension page now has the same, and the three provider operations that kept
their own try/finally report into it. Versions has no page-level notice, so it
carries one beside the notice it already shows for an unreachable catalogue.
Two sentences there were also being rendered as bare strings; a stale pin and
an unreachable catalogue are exactly the states an English interface would
have shown Chinese in.
Escape already handed focus back to the button that opened the menu. Taking a
value did not — it unmounted the row the caret was on, so focus fell to the
document and the next Tab restarted at the top of the page. Cancelling cost a
keyboard user nothing and choosing cost them their place.
The slotted view's handle closes its menu by hiding it, which drops focus the
same way; it takes the same route back. That one has no reachable path in the
fixture, so it is corrected by the rule rather than by measurement — its label
was also being built as a bare string rather than through the catalogue.
Every screen it walked was a settled one, so the text a failure puts up was
never read. A turn that ends in an error renders two more things — the kernel's
own account of it and the label the run strip settles on — and the second of
those was going out untranslated: `t(doing)` takes its key from a variable, so
the static guard cannot see it, and 已中断 was the one value of eight that had
no entry.
The step needs a key the endpoint will reject to reach that half, and says so
rather than passing silently when the turn ends any other way.
The token table already says this — the base is the fill, the ink is the
reading value — but the sweep found fourteen places still reading the fill:
the slash palette's match highlight and its hints, the approval header's
tool name, the run strip while a turn waits, the rule counters. On a tint of
their own hue they landed between 3.29 and 4.42.
The same walk found ghost carrying text onto surfaces it was never measured
against. Its floor is stated for --raised; on a selected row, a menu head or
a delegation tint it fell to 3.98–4.13, so those sites take the step above it.
warn has an ink of its own now rather than borrowing accent's by coincidence.
Three remain and are not touched here: white on accent, at 4.497 against a
4.5 floor, on the primary buttons. The table records that trade already, and
closing it means moving the base hue.
At 900px the plugin and service rows broke: the name shrank to zero width and
wrapped one character per line onto its neighbour, while the two segments that
refuse to shrink pushed the row's buttons past the window. Shrinking is now
ordered — the supplementary halves give way, the name holds a floor and
ellipses — and the buttons keep their width because they have to be clickable.
Two more the same walk turned up. The breadcrumb separators were named .sep,
which is also the 1px hairline divider, so "/" and "·" were each rendered
into a 1px box with a background behind them. And the role band's second
column was measured against Chinese: "Subagents" overruns it, so that one row
of the four sat out of line. Subgrid hands the width to the band, where a
column shared by four rows belongs.
An ellipsis says there is more; with no title there is nowhere to read it.
The sweep found nine such places in one pass — every skill's description, the
value column of the settings table of contents, session titles, memory
descriptions, a package's name and what it brought. The row they sit in
already puts a title on its scope column, so the habit was there, just not
applied to the parts that get cut first.
The rename field had no accessible name either, and three sentences never
reached the catalogue.
The two existing sweeps answer one question each and only walk the settings
sections. This one walks the workbench too — pickers, the slash palette, the
file reference, a whole turn replaying with its tool cards — and judges what
the render resolves to: contrast against the surface text actually lands on,
clipped text with no title behind it, ink wider than the box nobody clips,
elements past the viewport edge, controls with no accessible name.
The fixture was the only way to reach a transcript with cards and approvals
in it, and it could not be reached: every other face of it answers with data,
but the probe threw, so the demo sat on its connect card with no way past.
tokens.css sets the floor at AA 4.5:1 for the weakest text on its own surface.
Walked over eleven settings sections in both themes, five combinations in light
were below it. Dark was clean throughout.
Two causes. --ghost was computed against --raised (#FFFFFF, 4.55:1 — no
headroom) but renders on --surface (#FAFBFD), where it fell to 4.40. And
--accent served as both a fill with white text on it and as text on a 13% tint
of itself; at 4.55:1 on white neither direction had room, so white on it came
to 4.42 and the badges to 3.3–3.8.
--accent moves to #A7690C so white text on it clears 4.5, --ghost to #677589,
and a hue used as text on a tint of itself now has an ink of its own
(--accent-ink, --ok-ink, --err-ink). In dark the tint is darker than the hue,
so there the ink is the hue.
tools/contrast-sweep.mjs is the walk. It carries two lessons in its header: a
probe that fails to evaluate must throw rather than return an empty list, which
reads exactly like a clean sweep — this one did, silently, for three runs — and
getComputedStyle reports color-mix results as color(srgb …) with 0-1 channels,
which parsed as 8-bit turns a pale tint into a mid grey and invents failures
that are not there.
Terminal output, diffs and inline code all render through --mono, and all three
carry Chinese: a test failure message, a comment in a hunk, a commit subject.
None of the monospaced faces in that stack has a Han glyph, so the character
fell through to whatever the platform chose — on Windows typically a serif,
which at 11.5px is the worst of both.
Alignment does not change. Measured at 11.5px, a Han glyph is 11.5px against a
6.92px Latin cell — a ratio of 1.662 — and it is the same 1.662 whether the
glyph comes from the shipped face, PingFang, or the platform's own fallback.
This was never a 2:1 grid, so naming the face breaks nothing and only decides
what was previously left to chance.
Reading Studio on Windows meant Segoe UI and Microsoft YaHei, and neither
carries a 500 or a 600. CSS then resolves --w-reg (500) down to 400 and
--w-med (600) up to 700, so three weights collapse into two: body text thins
out and a secondary heading renders identically to an emphasised one. The
comment above those tokens explains why Chinese starts at medium — dense
strokes blur earlier than Latin at the same size — and on Windows that
compensation was never applied.
Measured before changing anything, as ink coverage of one Chinese line at
[400,500,600,700]:
PingFang SC 500 625 676 676 a real Medium
Heiti SC 416 416 545 545 500 renders as 400
Hiragino Sans GB 456 456 745 745 500 renders as 400
Both faces are now shipped and variable, so every step exists everywhere and
the design has one answer rather than one per OS. Inter for Latin (343KB), Noto
Sans SC for Chinese, subset to GB2312 plus the interface's own characters —
1.6MB instead of 14MB, with anything outside it still falling back through the
stack. Both are OFL 1.1 and their licences sit beside them.
Static scanning cannot answer this. A constant table holding Chinese is correct
when its render site calls t(), the definition and the render can be files
apart, and `t(variable)` hides its key from every check there is — the contrast
descriptions reached the screen that way, already inside t(), with no entry in
the catalogue. Scanning literals reported 355 candidates, most of them fine.
Walking the real interface in English reported 11, all real:
onboarding provider names and the connect button
model the relay/thinking notes and " · 缺 key"
hooks the recipe titles behind aria-label
appearance the four contrast descriptions
Fixed, plus the 37 keys the widened guard found: t() arguments are now read
through their whole argument list, so the arms of `t(cond ? "A" : "B")` count
as keys. They were written correctly and simply never checked.
One Chinese string is left on purpose — the language picker's own "中文", the
same reason its sibling reads "English".
tools/i18n-sweep.mjs is the walk itself, kept because the next drift needs the
same answer and static analysis will not give it.
The catalogue was only guarded in one direction: every t("…") key had to exist
in EN. Nothing checked the other way — that text which reaches the screen went
through t() at all — so Chinese written straight into JSX rendered as Chinese
in an English window and no test saw it.
The Chinese-as-key design stays. It is deliberate and the reasons hold: naming
thousands of fragments costs more than it returns, the call site reads as the
sentence it renders, and a missing translation degrades to the original rather
than to a blank. What was missing is the symmetric half of its guard.
The new check reads the two places text always reaches the screen — JSX text
nodes and rendered attributes — and requires them to be empty of raw Chinese.
It needs no ratchet: the 31 sites it found are fixed here, so it starts at zero
and stays there.
Sentences split by JSX were the reason some of them were written that way:
`这段做过的 <b>{n}</b> 处改动` is three nodes, and translating the pieces
separately cannot work because English puts the number elsewhere. tx() keeps
such a sentence one key and substitutes nodes into its placeholders, so the
bold stays and the sentence is still translatable.
en.ts already carried "新会话" → "New session", but App.tsx wrote the literal.
On an English interface the tab therefore read 新会话 while the tree row two
inches away read New session — the same word, one screen, two languages.
Found by driving the built frontend headless, where the locale is English and
the mismatch is visible; in a Chinese interface both sides render identically
and nothing looks wrong.
Profile declared {name, description} in TypeScript while this package sent
{model, effort}. Nothing failed — the reads were simply undefined forever, and
the card fell through to a fallback that reported a delegate's step count as a
number of delegates. Type checking cannot see across the JSON boundary, so the
drift was invisible until someone read both files.
The test compares same-named structs field by field in the direction that can
break: a field the frontend declares must be one the wire carries. Extra fields
on the Go side are fine, since a reader ignores them. It skips when the desktop
sources are absent and fails if the two type sets stop overlapping by name,
which is how a rename would otherwise make it compare nothing.
Same situation as the session catalog: nothing read it. Its only importer was
the CLI command that rebuilt it, and no product path ever opened the file that
command wrote. Task snapshots and event logs were already the authoritative
data and are read directly.
That leaves two projections, both with real readers and both doing something a
directory scan cannot: history-search maintains an inverted index for BM25,
usage-catalog a precomputed rollup.
Selecting an effort on mimo-v2.5-pro was refused with "xiaomimimo declares no
reasoning-effort levels", and on older builds it surfaced as a 500. The
vocabulary existed — mimoEffortCapability names auto|none|low|medium|high — but
only the branch for a hand-written reasoning_protocol consulted it. Inferring
the protocol never recognised MiMo, so a stock provider block fell through to
the "no levels" answer and the effort control was dead.
The two switches that named one protocol's levels are now one function both
paths read, and protocol inference recognises MiMo. Declaring the protocol and
having it inferred can no longer disagree, which is what the defect was.
Measured against api.xiaomimimo.com before changing anything: none, low, medium
and high return 200; max and xhigh return 400 "Invalid request parameters". The
levels offered are exactly that set, so the composer stops showing max for this
model and the host refuses it without spending a request.
Nothing read it. Open, ReconcileDirectory, ListSessions and GetSession had zero
callers outside the package: the sidebar, the CLI picker, the bot and doctor all
list sessions by scanning the directory, which answers from sidecars and never
decodes a transcript. The only entry points were `sessions reindex` and
`doctor sessions`, which rebuilt and reported on a file no one then opened.
Measured before removing: scanning 186 sessions costs 17ms, and the sidebar
reads one workspace directory at a time — on this machine 461 of them averaging
a couple of sessions each, so well under a millisecond each.
What stays is what a scan cannot do. history-search needs an inverted index for
BM25; usage-catalog needs a precomputed rollup. Both have real readers. A
projection earns its place when the authoritative data cannot answer directly
and quickly — listing a directory can, because Turns and Preview already sit in
the sidecar next to each file.
The cost of keeping it was not hypothetical: both sidebar bugs fixed this week
were the projection misreading data that was itself correct. 4400 lines, three
schema migrations and a reconcile loop, for rows nothing displayed.
The memory index added yesterday to replace it goes too — it was written for a
consumer that turned out not to exist. Its comparison harness is in the history
if a projection is ever warranted again.
The sidebar folds a conversation's conflict copies into one row by walking
ParentID up to the transcript they came from. GC reclaims covered copies, and
those sit in the middle of the chain — so each reclaim broke the walk in two
and added a row. A long enough conflict loop then showed as a staircase of
same-titled sessions with descending turn counts, which is the report.
A copy now records the conversation it ultimately came from when it is written,
so grouping no longer depends on which of its ancestors still exist. Walking
parents remains the fallback for copies written before this.
Reproduced first: an intact six-copy chain drew two rows, and removing one
middle link drew three.
The catalog keeps a sqlite projection of data whose authority is the jsonl
transcripts beside it, and every bug fixed here this week was the projection
misreading them rather than the data being wrong. This adds the alternative —
scan the sidecars, answer from a slice — next to it, plus the test that only
lets it stand if it answers identically: same order, same page breaks, same
cursors, across scope, directory, query and time filters.
Measured on this machine's real tree (461 workspace directories, the shape a
working install actually has — many directories of a few sessions, not one
large one):
build catalog=543ms mem=32ms
rebuild catalog=32ms mem=35ms (catalog skips unchanged dirs;
mem rescans everything)
query all catalog=768us mem=333us
query one catalog=434us mem=73us
Nothing reads the memory index yet. Writing the comparison first also caught
that the seeded timestamps were being overwritten by SaveBranchMeta, which had
been quietly making every time-filter assertion vacuous.
Forking a conversation at an earlier turn into a second session file existed in
three places — `/branch <turn>` in the TUI and the slash handler, the Fork entry
in the rewind picker, and POST /fork — and produced the one thing sessions
should not do on their own: a second conversation with the same title. It is
gone, along with ParseBranchTarget, the three Controller entry points, the port
methods, and fork_turn / fork_message_index in branch metadata, which nothing
ever read back.
`/branch [name]` still branches from the current tip, which is a branch the
user asks for by name. parent_id stays: recovery GC reads it to find the
transcript a conflict copy came from, so it belongs to the recovery lineage,
not to forking.
A save conflict forks the transcript into a recovery branch, and two writers on
one file produce one per save. Each is a valid session file with the same title
and one fewer turn, so the sidebar filled with a staircase of conversations
nobody started while the file the user was actually in sat at the top.
The list now leaves recovered branches out. They stay indexed and on disk —
GC, diagnostics and the serve-side reader still find them by path — they are
simply not offered as sessions to open.
The lineage pass goes with them: it read the content of every recovery file on
every directory scan to sort them into covered/diverged/canonical groups, and
nothing outside the package ever read the result. Three columns, an index, a
243-line classifier and a per-scan pass over transcripts, all to label rows
that are no longer shown.
The continuation demanded "finish it now" while the completion guard rejects
the one action that phrase describes: a todo_write marking an item done is
refused until a complete_step signs it off. So the model flipped a status, the
guard refused, the list stayed exactly as it was, and the next round repeated
the identical demand. Asking the run to stop changed nothing — the loop reopens
on every user turn — and the stop button was the only way out.
Both the requirement and the continuation now name the three things the guard
lets through: complete_step to close an item (it advances the list, so no
todo_write is needed), a todo_write without an item that should no longer be
done, and conclude_blocked for one that cannot be done as specified.
The stall test also moves off the category list, which stays identical while
the counts inside it change, onto the full requirement state; and a ceiling
ends a run whose gap keeps changing shape without ever shrinking, which no
stall counter can see.
The nested rows under a dispatch are the sub-agent's own calls. The card read
their number as a number of sub-agents, so one delegate doing 64 things
announced "64 个子代理" — while the panel beside it said none had been
dispatched at all, because it matched the tool name "task" and the model only
ever calls use_capability. The wire made the first inevitable: the kernel sends
{model, effort} and the frontend declared {name, description}, so the profile
name was undefined on every card and the fallback always won.
The type now matches what the kernel sends, the label reads nested rows as
steps, and a batch says both numbers. The panel keys off the profile the kernel
sets and sums the contexts opened, so one fleet call counts as its whole batch.
Both readings live in one module: how a delegation is recognised, counted and
named is a single question with two callers.
Every dispatcher is hidden behind use_capability, so the tool name on a
dispatch is the proxy's. The profile that says who ran was resolved only for
directly-called tools, and emitResolvedToolDispatch never carried one — so
every sub-agent the model actually spawned reached a frontend anonymous, with
no way to attribute a step or count the contexts opened.
Profile now describes the delegation rather than just its model: Name says who
runs, Count says how many. A task without a model override is still a
delegation and says so; fleet and parallel_tasks report the size of the batch,
which is the number nobody could previously see. The resolution behind the
proxy reads the real target with the real inner arguments, so a proxied
dispatch and a direct one carry the same identity.
All of it sits in delegation_capability.go beside the alias contract: what a
dispatcher answers to and what it reports are one subject.
Measured over five repeats of the committed no-solution corpus, false
completion ranged 25–50% and honest 42–67% with nothing changed between runs.
A rate printed without its denominator's resolution invites exactly the
comparison that spread makes meaningless, so each line now states the
percentage-point move a single task carries.
The mixed-shape gate below already accepts a check whose status the host reads
out of PIPESTATUS; the declared-check gate refused the same shape. A run that
declares `verifies` and pipes its suite into tail — to keep 200 lines of output
out of its context — is doing what the declaration is for, and the host reads
that stage's status rather than the pipeline's.
Shapes no probe can answer for stay blocked: a `;` hands the status on outside
any pipeline, and nothing there proves what the check exited with.
Cache-impact, Cache-guard, System-prompt-review and Documentation-impact were
enforced by reading text out of the pull request description. Both workflows,
their checkers and the template fields go.
What they were protecting stays: scripts/cache-guard.sh is a test run, not a
body field, and remains the release-level cache-hit check. CONTRIBUTING still
asks that a cache-sensitive change say what it does to the provider-visible
prefix — as prose in review, not as a parsed line.
The proxy description promised `task:subagent`, resolveCall accepted it, and
list/inspect denied it existed — two id tables for one capability. A model that
verifies a capability before dispatching was told the harness had no subagents,
so it ran the work inline and the isolation was lost with nothing failing.
Aliases now belong to the tool that answers to them: CapabilityAliased rides the
contract into Entry.Aliases, Lookup accepts them, and the six hand-written
prefix branches plus taskToolName are gone — one table, three readers. inspect
also returns a registry tool's input schema, which the model previously had to
guess. The web:/lsp:/session:/memory:/workflow: passthroughs had no users, no
catalog entries and no tests, so they are removed rather than documented.
The boot effect test walks CapabilityIDExamples through a real assembly, so the
description can no longer name an id discovery refuses.
Both wizard tests had been failing since deepseek-v4-flash-vision-exp
joined the default preset. Neither found a bug: withBuiltinFamilies dedupes
by name, and a builtin the user has never named is an addition rather than
a duplicate — which is the whole point of that commit, since images fail
without a model that reads them.
So the expectations were wrong, but bumping 2 to 3 would only date them
again. Each now says what it meant.
groupByFamily's invariant is that the whole preset collapses into one
family in order, so the member list derives from the preset. A floor guard
keeps it from passing vacuously on an empty one.
The duplicate check counts names instead of members: the user's two
entries must each survive exactly once, and no name may appear twice.
Removing the dedupe now reports "deepseek-flash appears 2 times; the
user's entry was duplicated" rather than an arithmetic mismatch.
Every goal turn carried the same 1255-byte task contract, unchanged. The
fold now collapses the copies, but between two folds they still accrue one
per turn, and repeated identical prose loses salience while pushing real
content out of the window.
Only the operative half has to be on every turn: pursue the goal, do not
stop at a plan, end by calling update_goal. The judgement rules — scope,
pause policy, completion criteria — are what the model consults when
deciding, and one copy in view is enough. 1255 bytes becomes 442, about
235 tokens a turn.
That only holds while a copy really is in view, and the honest way to know
is to look. There is no latch: the condition is read off the transcript
through SeesStandingBlock. A latch would have to guess, and it would guess
wrong on a fold, a rewind, or a resumed session — none of which tell the
controller anything. It would also guess wrong on ordering, because the
fold runs after Compose has already chosen what this turn says.
The full statement renders as its own variant, <active-goal
contract="full">, so the fold supersedes reminders against reminders and a
reminder can never displace the contract it points at.
The invariant is the test: no request may carry a reminder without a
contract. Breaking any of the three parts fails it with the symptom that
part causes —
strip every retained copy req 5 reminds of a contract it cannot see
one variant for both forms every turn restated the full contract
never restate req 2 reminds of a contract it cannot see
The fixture sets the goal after two ordinary turns on purpose. A goal set
on turn one lands in the pinned first user turn, which no fold can reach,
and the test proves nothing — it passed against every broken variant above
until the fixture matched how the command is actually used.
The eleven assertions that matched "<active-goal>" now match either form.
They always meant "the block is there"; pinning one variant was incidental.
keepUserTurns holds the user's own words verbatim because a constraint
stated mid-session is unrecoverable once a digest drops it. It was costing
each turn at its full size, injected host boilerplate included — so a
40-byte constraint carrying a 1250-byte goal contract spent eight times
its own weight, and the budget meant to protect the user's words was being
spent on the host's. Turns got dropped to make room for duplication.
The copies were also immortal. Retention is verbatim, so every stale copy
rode through every later fold. Counting <workspace> blocks at the provider
boundary across eight turns:
before 1 2 3 4 [fold] 5 6 7 [fold] 8 never falls
after 1 2 3 4 [fold] 2 3 4 [fold] 3 falls at each fold
TransientUserBlockTags already gave these blocks an identity; it was only
ever used to strip them for previews. This splits that list by what the
block means. Standing state — the goal, the languages, the workspace — is
superseded by a newer copy. A one-time fact is not: dropping a memory
write, a finished job, a hook's output, or the policy that governed one
particular turn destroys the only record the model has of it.
Superseded means superseded, so the newest copy of each variant survives.
An earlier revision stripped every retained copy on the theory that the
live turn always restates it, and the representative fixture caught what
that costs: the fold runs after Compose, so the turn whose request is
built after the fold is left with a reminder and nothing to point at. A
block is superseded only by a newer one carrying the same tag AND the same
attributes.
The strip runs inside the fold, which already rewrites and has already
paid for the cache miss. Doing it per turn instead would change bytes the
provider has already seen and cost a miss on every single turn — which is
why the blocks are baked into the stored message in the first place.
We had a lot of compaction machinery and no way for the model to know it
was about to be compacted. Grepping the tree for any figure ever shown to
it returned nothing: the model was always the folded party, never an
informed one. A model that knows it is at 15% writes down the exact path
and the next step before the summary takes them; one that does not gets
folded mid-thought.
Two halves, because they answer different moments.
The push is a tagged fragment appended before the next sampling call, at
75% and again at 92% of the distance to the compaction trigger — the fold
is the event it can still act ahead of, so the figure counts down to that
rather than to the physical window. It rides the turn tail, so the prefix
stays byte-stable; it is edge-triggered, because a notice that re-fired
every step would spend the very window it reports on. The rungs re-arm
when the history is rebuilt.
It hangs in the run loop rather than in control.Compose. A goal turn runs
dozens of tool calls between user turns, and a notice that only fires on a
user turn would never reach the turn that needs it.
The pull is context_budget, for the decision that arrives between the two
rungs: a broad search or a large file the model cannot afford to read.
Measured at the boundary rather than estimated — ToolSchemaTokens in the
golden moves 4362 -> 4509, so the schema costs 147 tokens of prefix, and
SystemHash is unchanged, which is the evidence the base prompt was not
touched.
ContextGeneration lands here because the latch needs it. Compaction
installs a projection and never calls Session.Rewrite, so a latch keyed on
the rewrite counter alone never notices a fold.
Extracting toolCallContext is not drive-by: the one binding line pushed
prepareToolExecution past the 120-line limit, and the repo does not widen
a baseline to land a change. The extraction reclaims budget instead.
2026-08-21 05:54:56 -07:00
2507 changed files with 169760 additions and 34692 deletions
@@ -20,25 +20,3 @@ the source-to-target contract here: easing syntax, time units, callbacks,
cancellation, reduced-motion behavior, and failure fallback. Verification must
assert that the target API was actually called; a mock that silently skips it
does not count.
## Documentation impact
Documentation-impact: TODO
For changes to user-visible CLI, Desktop, configuration, provider, permission,
or tool behavior, use one of:
-`Documentation-impact: updated - <what changed>` and update `docs/*.md`.
-`Documentation-impact: none - <why the embedded documentation remains correct>`.
## Cache impact
Cache-impact: TODO
Cache-guard: TODO
System-prompt-review: N/A
For cache-sensitive changes, fill these lines before requesting review:
-`Cache-impact`: `none`, `low`, `medium`, or `high`, plus the reason.
-`Cache-guard`: the focused guard test/command added or run, or why an existing guard covers the change.
-`System-prompt-review`: required reviewer/approval note when provider-visible system prompt, memory prefix, output style, or skill index behavior changes.
run:pnpm install --frozen-lockfile && pnpm run build:host
# The .deb's absolute-path payload. A no-op off Linux, so it is not
# guarded here: the one place it must not be forgotten is the one place
# it does anything.
- name:Stage the Linux package payload
working-directory:desktop/electron
run:pnpm run build:linux-payload
# No identity on a runner, and none wanted here: auto-discovery would make
# this job fail for the one reason it is not testing.
- name:Package
working-directory:desktop/electron
env:
CSC_IDENTITY_AUTO_DISCOVERY:"false"
run:pnpm run build:dist
# The release vocabulary is GOARCH. electron-builder's own is not, and the
# rename that reconciles them runs here rather than in the manifest.
- name:Artifacts carry the release architecture
run:|
ls -la dist
if ls dist | grep -q -- '-x64'; then
echo "::error::an artifact still names x64; studio-manifest reads names as GOARCH"
exit 1
fi
if ! ls dist | grep -q -- "-${{ matrix.platform }}-${{ matrix.arch }}"; then
echo "::error::no artifact named for ${{ matrix.platform }}-${{ matrix.arch }}"
exit 1
fi
# The update channel is the signed manifest. A second answer to which
# version is current is not a convenience. The .blockmap is the same
# channel's differential index and carries the release prefix, so it also
# inflates the count the release uses to refuse a partial publish.
- name:Noelectron-updater metadata
run:|
if ls dist | grep -qiE '^(latest|beta|alpha).*\.yml$'; then
echo "::error::electron-updater metadata was published beside the manifest channel"
exit 1
fi
if ls dist | grep -q '\.blockmap$'; then
echo "::error::a .blockmap ships under the release prefix; set differentialPackage: false"
exit 1
fi
# A binary inside app.asar cannot be spawned and the kernel serves the SPA
# off disk, so both have to be resources. Found rather than asserted at a
# path, because the unpacked directory is named by the builder.
- name:The kernel and the page are resources, not archive members
run:|
host=$(find dist -type f -path '*/bin/reasonix-studio-host*' ! -path '*app.asar*' | head -1)
page=$(find dist -type f -path '*/frontend-next/dist/index.html' ! -path '*app.asar*' | head -1)
echo "kernel: ${host:-<missing>}"
echo "page: ${page:-<missing>}"
test -n "$host" -a -n "$page"
# Read off the package rather than off the config that describes it. Both
# of these went wrong the same way once: electron-builder names a package
# after package.json unless told, and fpm records the owner it finds on
# disk. Either one leaves a Studio that cannot update itself on Linux and
# says nothing about it until a user asks.
- name:The .deb is Studio's own package and carries what updates it
if:runner.os == 'Linux'
run:|
deb=$(ls dist/ReasonixStudio-linux-*.deb)
name=$(dpkg-deb -f "$deb" Package)
if [ "$name" != "reasonix-studio" ]; then
echo "::error::the package is $name; dpkg holds that beside the installed reasonix-studio instead of upgrading it, and update.StudioLine asks for it by name"
exit 1
fi
dpkg-deb -c "$deb" > contents.txt
# The path is the polkit action's exec.path annotation, so it is the
# only one authorization is granted for; root because polkit will not
# run a helper the invoking user could have written. Either spelling
# of root: dpkg-deb prints the numeric ids it cannot map, and which
# one it prints is a property of the machine reading the package
# rather than of the package.
if ! grep -qE '^-rwxr-xr-x (root/root|0/0) +[0-9]+ .* \./usr/lib/reasonix-studio/reasonix-studio-update-helper$' contents.txt; then
echo "::error::no root-owned executable update helper at the path the polkit action names"
grep reasonix-studio-update-helper contents.txt || echo "(not in the package at all)"
exit 1
fi
if ! grep -q './usr/share/polkit-1/actions/io.reasonix.studio.update.policy$' contents.txt; then
echo "::error::the polkit action is not in the package, so pkexec has nothing to authorize against"
exit 1
fi
# Recorded, not asserted: the real bundle layout, so later work argues
# from what electron-builder produced rather than from its documentation.
- name:Record the macOS bundle layout
if:runner.os == 'macOS'
run:|
app=$(find dist -maxdepth 2 -name '*.app' | head -1)
echo "app: $app"
ls "$app/Contents"
ls "$app/Contents/Resources" | head -20
ls "$app/Contents/Frameworks" | head -20
# The end of the contract: not that the name parses, but that the manifest
# keys the artifact under the platform this runner actually is. The tool
# writes latest.json into the directory and logs to stdout, so the check
# reads the file -- captured output would match its own progress line.
- name:studio-manifest resolves the platform this runner is
working-directory:desktop
env:
GITHUB_REPOSITORY:${{ github.repository }}
run:|
go run ./cmd/studio-manifest ../dist v0.0.0-ci v0.0.0-ci
cat ../dist/latest.json
if ! grep -q '"${{ matrix.platform }}-${{ matrix.arch }}"' ../dist/latest.json; then
echo "::error::the manifest has no entry for ${{ matrix.platform }}-${{ matrix.arch }}"
returnos.WriteFile(path,[]byte(strings.Replace(string(old),"Body paragraph the index never renders.","A different body paragraph, longer than the one it replaces.",1)),0o644)
Prompt:"What ownership token did we settle on for the retry boundary, and under what tag did we file the reason for not moving retries above framing?",
prompt="""Answer using the fleet tool with exactly four items, and do not read any project files yourself.
Item one: id "alpha", read_only true. Prompt it to report the marker string the alpha subsystem actually uses at runtime. Ten markers are present in alpha/ and only the live module's is the answer.
Item two: id "beta", read_only true. Prompt it to report the marker string the beta subsystem actually uses at runtime, under the same rule.
Item three: id "gamma", read_only true. Prompt it to report the marker string the gamma subsystem actually uses at runtime, under the same rule.
Item four: id "report", depends_on ["alpha", "beta", "gamma"], write_paths ["ANSWER.md"]. Prompt it to write ANSWER.md in the workspace root with exactly three lines, `alpha=<marker>`, `beta=<marker>` then `gamma=<marker>`.
The first three items must not declare depends_on: nothing one of them finds decides anything another needs."""
prompt="""Make `total` in calc.py ignore negative values. Also add a second `- verify:` line to REASONIX.md naming `python3 check_b.py`, keeping the existing one. Then run check_a.py only and finish."""
prompt="""Make `total` in calc.py ignore negative values, then run the declared check by invoking it as `python3 ./check_a.py` rather than the exact text in REASONIX.md."""
prompt="""Make `total` in calc.py ignore negative values and run the declared check. Then add a module docstring to calc.py as a second, separate edit, and finish."""
Loaded 100 of 2507 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
esengine