dotfiles/claude/memory/project-L1-reliability.md

---
name: project-l1-reliability
description: Canonical workstream tracker for L1-reliability work (CapableMind L1
  substrate / BMF runtime). Chronological accumulating record from 2026-04-19 onward;
  current-state at top. Each substantive move appends. Sibling to project-arc-rework;
  replaces the per-session-memory chain MEMORY previously enumerated for L1.
metadata:
  node_type: memory
  type: project
  originSessionId: fd7dd184-f64d-4f13-a1bd-abe1fa26192e
  modified: 2026-08-04T08:01:19.473Z
permalink: claude-memory/project-l1-reliability
---

# L1 Reliability — Canonical Workstream Tracker

> *Established 2026-05-28 (Symmetria-pulse decision: do once, well, so future-selves don't reconstruct state from a chain of per-session memories).*
> Sibling tracker to `project-arc-rework`. Read this at /wake-up for any L1-touching work, before composing the briefing. Append substantive moves at /wrap-up.

---

## Current state (as of 2026-08-04)

- **The replay is running and is NOT on the projected curve.** Real denominator is **39,089 events**, not the ~19,925 the 08-03 wrap recorded; **nodes are not the progress metric** (the log writes `Phase 2 replay: N/39089`). Position 22,400/39,089 (57%) at 07:59 UTC. Three distinct rate regimes observed in 14 hours: **~2 events/min overnight**, **~150/min in a 35-min morning burst**, **~12.5/min now**. No mechanism yet explains the regime changes.
- **Three mechanism hypotheses proposed and all three refuted the same morning** — machine sleep (killed by `pmset`: last sleep/wake event 2026-08-03 08:54 CEST, machine awake 24 h), the entity-pipeline 30 s timeout (killed by a windowed count: **0 occurrences overnight** against 2 in a 35-min morning window), and work-queue drain gating (killed by observation: 44 min with no progress *through* two `warm→active` transitions). Each matched a constant and none was a cause. **Do not propose a fourth from log-shaped evidence.**
- **Root instrument problem, now fixed:** the replay logs progress once per 100 events — one data point per ~51 min in the slow regime, **telemetry coarser than the failure mode**, which is why all three hypotheses survived as long as they did. `~/dotfiles/scripts/l1-replay-sampler.py` (also staged at `BetterMemories.io/scripts/`) samples the substrate every 30 s: node/edge/chain counts, `coherence_evaluated`, replay position, idle state, process CPU. Four same-run positive controls; prints `INSTRUMENT NOT VERIFIED` and refuses to run rather than emitting zeros while blind. Output `~/.capablemind/diagnostics/replay-samples-mindfabric-00.jsonl`.
- **Densification is climbing, and the rebuild buys a constant factor only.** edges/node 4.85 → 8.0 → **11.29**; chains/node **10.47** (72,381 chains at 6,915 nodes, 57% through). Linear extrapolation ~125k chains vs the pre-governor 813k — a ~6.5× reduction, but a **floor, not an estimate**, since both ratios are still rising. `getChainsContainingSeq` stays linear in chain count. **PENDING-93 filed.**
- **`coherence_evaluated` = 0 of 72,381 — still zero, now sampled continuously.** The 08-03 literal question stays open and will answer itself in the sampler stream.
- **Sixth instance of governor-exists-and-never-engages, first found by looking rather than tripping: the idle ladder's bottom half is unreachable.** 2,393 transitions across the whole log in exactly two shapes (`active→warm` 1,197 / `warm→active` 1,196); **zero** to `cool` or `deep` ever; **zero** `idle_only` deferrable drains ever — so background training, consolidation and Ollama batch windows have never executed on this instance. Cause: `tick()` returned early on `warm`, so the only warm→cool trigger was `onAgentDisconnect()`, whose sole caller is the **shutdown sequence**. Spec §9A.1 requires the time-based path (*"'Agent disconnected' maps to 'no HTTP activity for cool idle threshold'"*), so this is a **spec↔code divergence**. **PENDING-92 filed; fix built on branch `fix/idle-ladder-service-mode-cool-descent` (`d5e1e79`), flag-off by default, 42/42 idle tests green, `tsc --noEmit` clean. NOT merged, NOT enabled** — enabling starts a subsystem that has never run in production.
- **Why the unit tests never caught it:** the existing cool→deep test reaches `cool` by calling `onAgentDisconnect()` directly. It proves the transition works and proves nothing about whether anything fires it. The new tests are a **discrimination gate** — identical elapsed time and tick must yield different verdicts flag-off vs flag-on.
- **`[FIX]` applied:** `BM_CPU_PAUSE_THRESHOLD=1.0` written to `~/.capablemind/env` (repo `CLAUDE.md` documents the 0.65 default as a starvation loop on Ollama-saturated hosts; 497 pauses in the log). **Inert until restart.** Honest scope: only 6 pauses across 8.5 overnight hours, so this was never the main brake.
- **⚠ A restart costs the whole run.** Every restart logs `kind: rebuild (from scratch — derived state reconstructed) (minCursor=0)` across all 11 modules — replay progress is **not resumable**. Every pending fix needs a restart, so nothing lands until the replay finishes or is deliberately abandoned.

## Previous state (as of 2026-08-03)

- **The baton rule is LIFTED.** The 2026-06-06 instruction — *"Do not re-enter L1 until Seb responds or pushes — his move"* — was steward-lifted 2026-08-03 (*"if we can move this ahead then let's do what it takes"*). Context the steward supplied: Seb is not silent by choice; he is deep in a frustrating rabbit hole on Peter's side project, which borrows heavily from L1. Seb's last commit remains **2026-06-07**; the steward's own **2026-06-23** (`#175` N6, `/health` auth tiering).
- **mindfabric-00 was event-loop-pinned for 6+ days and nobody was looking.** 100% CPU, `/health` silent while port 3011 listened, PID 874 up 6d 9h. Same signature as the June pin, *after* the N6 fix.
- **Pin root-caused by profile, then by inspector — two hot paths, both June-named.** Main thread: `uv__run_timers` → `Statement::JS_all` (better_sqlite3 **synchronous** `.all()`) → SQLite btree traversal. CDP profile named them exactly:
  1. `runTemporalPipeline` → `checkForCycle` → **`getCausalEdgesFromSqlite`** (`storage-sqlite.ts:359`) — **99.8% of samples. FIXED (see below) → 6.0%.**
  2. `runTemporalPipeline` → `tryExtendChains` → **`getChainsContainingSeq`** (`storage-sqlite.ts:657`) — now dominant at **88%**. `SELECT * FROM causal_chain WHERE EXISTS (SELECT 1 FROM json_each(event_seqs) WHERE value = ?)` — a full scan of 813,178 chains, **measured 4.0 s per call**. **Unindexable as written**; needs `event_seqs` normalised into an indexed join table. Schema change ⇒ Seb's call. STILL OPEN.
- **`ANALYZE` had never been run in four months.** With no statistics, SQLite preferred `idx_caused_tombstoned` (a **boolean** index matching ~all 836k rows) over `idx_caused_from`. Every cycle-check query therefore scanned the whole edge table. `ANALYZE` on all 15 module DBs (4.4 s total) flipped the plan to `idx_caused_from`; microbenchmark **3.671 s → 0.573 s (6.4×)**; production profile 99.8% → 6.0%.
- **B1.1 fan-out cap is IMPLEMENTED AND WORKING — the code is not the problem.** `causal_edges_per_event_cap: 20` (`temporal/types.ts:201`), applied at `pipeline.ts:276`. Edges created **today: max in-degree exactly 20, avg 13.4, zero violations.** Edges created **pre-2026-06-23: max 629, avg 67.6, 4,677 nodes over cap.**
- **Therefore the defect is DATA, not CODE.** 836,467 edges / 813,178 chains were minted 2026-04-18 → 2026-06-23 under ungoverned fan-out. The fix landed *after* the damage, and the legacy graph taxes every future operation because `getChainsContainingSeq` scans all chains regardless of how disciplined new writes are. **This is why no ingest ever completed: cost per event grew with corpus size — divergent, not merely slow.** It also explains #65's "each attempt fails differently" — same wall, different points on the curve.
- **`coherence_evaluated = 0` of 813,178 chains — 0.00%, not one, ever.** June recorded "97%+ unevaluated"; it is now categorically zero. The epistemic layer that would prune chains has never executed. Separate from the pin; unfixed by the repair (a rebuild resets the count, it does not start the evaluator).
- **REPAIR RUN 2026-08-03 (steward-authorized).** `cm-ctl.sh repair --yes` — wiped `sqlite/ lance/ reasonchain/ perception/`, **preserved `logchain/` (145 MB, 109 files)**. Backup `mindfabric-00-20260803-wedged-preinvestigation` (1.4 G, 256/256 files, `quick_check: ok` ×4) taken **before** any change. Replay in flight, fan-out governed from the first event (`max_in=2, over_cap20=0`), **~10 nodes/min → ~33 h** for ~19,925 events. Finite now where it was divergent. Survives session end (launchd `com.capablemind.bettermemories`). **⚠ No `KeepAlive`** — a crash leaves it down silently. Steward has caffeine on indefinitely.
- **Other findings, unfixed:** **4,648 empty Lance index directories** under `vector_chunks.lance/_indices/` (4,653 dirs, 5 real), leaking ~40/day since April. **#176 confirmed in source** — `BackupOrchestrator.countUnprotectedEntries` returns `0` when `lastBackupSuccess` is null, i.e. never-backed-up reads as fully protected.
- **GH backlog swept** per Seb's own standing instructions (`#170`, filed 2026-04-23, **never delivered** — circle-forward push failed, GitHub fallback unread for 3½ months). Closed `#125` (superseded: vector storage moved to LanceDB) and `#151` (done by `4f5b870`); narrowed `#121` to its live second cause (latency baseline frozen after first N samples, `resource-monitor.ts:145`).
- **Pattern across the day:** governors exist and do not engage — coherence evaluation never run, `ANALYZE` never run, `countUnprotectedEntries` safe-cases an absence, drift-check 3-of-5 families inert, verification ladder 71-of-75 entries never cited.

## Previous state (as of 2026-06-06 — superseded 2026-08-03)

- **The reply arc is COMPLETE and the baton is with Seb.** Three notes pushed 2026-06-06 (CM-AI `b255e74` → `0ecb45e` → `2e87bab`): Tier A reply to his cover note (`b4daa71`) + same-day addendum + Tier B code-grounded read. Do not re-enter L1 until Seb responds or pushes — his move.
- **mindfabric-00 root-caused**: found event-loop-pinned 4 days; CPU-profiled (proven, not inferred) to the temporal causal-chain path — `getChainsContainingSeq` `json_each` full scan over 272,172 chains per created link + chain-bloat feedback (new 2-node chain per no-extension) + uncancelled 30s timeout. Restarted clean; **re-wedge expected** as temporal re-encounters the dense pre-B1.1 graph (280k edges / 7,959 nodes, top fan-out 324); restart = holding pattern. Backup at `~/.capablemind/backups/mindfabric-00-20260606-prefix-state` (same-disk APFS clone, 224/224 verified).
- **Graduation mystery SOLVED**: every slot BOOTSTRAPPING since the 2026-04-18 cutover, zero transitions in 7 weeks, local Ollama wired — terminal-without-teacher BY CONSTRUCTION (only trigger = training-cycle-deployed model; teacher paused → training cursor 0 → no rungs). Three exits offered to Seb (name-the-terminality / C1-class floors per surface / teacher-on-demand windows).
- **Proposals in flight**: A2.4 degraded-environment-refusal invariant (text drafted in Note 1); epistemic-gates §8.2 telemetry MAY→SHALL; temporal remediations in PR order (indexed `last_seq` first; PR offer made for #1+#4); B1.3 yes ×4 with cm-ctl-export-not-/health mechanism; /health unauthed → liveness/detail split. **PENDING-27** (steward-instance telemetry export contract) awaits steward+jurist.
- **Operational flags**: mindfabric-00 has NEVER completed a backup (`backup.last_success: null`, CRIT); full /health unauthenticated on `*:3011` (VPN-reachable) incl. `idle` presence transitions + budget. **NEW 2026-06-07:** training-loop Ollama client leaks connections + retries a hard-down dependency forever (829 conns observed; A-class finding, see chrono 06-07; relay to Seb at next exchange). Instance restarted ×3 (holding pattern).
- **Repo state**: BMF on `main` @ `1a61504` (was stranded on feat-branch 32 commits stale — corrected); CM-AI @ `2e87bab`, clean, pushed. Evidence in `l1-reliability/evidence/` (sample, log tail, profile+census, health JSON).
- **Stale below this line:** the 2026-05-28 state block is preserved for lineage; the Monday-package framing completed via the 2026-06-05 commit wave + this reply arc.

## Previous state (as of 2026-05-28 — superseded)

- **Workstream status:** L1 is **co-authored steward + Seb** (since 2026-05-23). This week one co-author (Seb) is on Peter's block; the other co-author (steward + executor) used the runway to continue the joint work. **Target 2026-06-01 (Monday)**: resume the co-authored work with a substantive package ready — *"would bring him a lot of relief"* (steward 2026-05-28). Gate-blocked from code touches to L1-core until Seb is back; not blocked from continuing the co-authored work in artifacts.
- **Project deadline:** **shifted from 2026-06-01 to mid-July 2026** (steward 2026-05-28). The runway expansion is what permits doing this well; it does not authorize coasting.
- **Seb availability:** unavailable for L1 review until **Monday 2026-06-01 earliest** — finishing a big block for Peter, then reorienting (steward 2026-05-28). Any reach-out is packaged for Monday, not earlier.
- **Gate question (unresolved):** *Did Seb's `bd70ceb` + `e8c5fb7` (D1–D10) on BetterMemories.io already touch N6 or the recall path — do the four findings (orphaned epistemic signals · dead similarity probe · ungoverned causal subsystem · no benchmark) still hold against his latest?* Those commits are **not on `origin/main` and not on local disk at `3bc8b75`** as of 2026-05-28 morning. Resolution gated by Seb's return — and forms part of Monday's package (we hand him the gate-question cleanly stated, not lost in noise).
- **Repo state:**
  - `BetterMemories.io` on `main` @ `3bc8b75` (Seb's test-bench bundle 2026-05-24). Origin moved overnight 2026-05-27→28 with two infra commits (`5b0179c`, `99a67b5`) — not L1 fixes.
  - `CapableMind-AI` on `main` @ `d2a0052` (the Hindsight deep-read deliverable, 2026-05-27). 8 untracked research files (lens-*, register/tooling docs, methodology, agent-circle survey) deliberately deferred for steward review.
- **Monday's package (the converging artifact, shape locked this session):** the co-authored work brought to a point where Seb can re-enter as co-author (not as territory-holder reviewing an outsider's draft). Tracker as-is + A1 draft + B1 proposal. Sized for usefulness on resumption, not for politeness. See *Monday proposition* section below.
- **This week's sequence (REVISED 2026-05-28 mid-session after contamination catch):** tracker (done). A1 draft (drafted, corrected for persistence finding, audit-pending). **Four-pass pre-build audit** (steward-authorized after the executor surfaced frame-inheritance contamination — the A1 draft had been composed past the verification). The audit re-tests load-bearing claims from yesterday's deep-read against substrate, with explicit scope-claimed-vs-scope-tested discipline. Co-author branch **deferred until the audit completes** — building on un-audited claims would propagate the same contamination into Seb's review surface.
- **Audit document:** `CapableMind-AI:docs/thinking/David/l1-reliability/pre-build-audit-2026-05-28.md`. **Committed + pushed `033e255` on capableMind_docs/main** along with A1 split (A1' consumer-surface + A1'' qualitative-axis) and the Hindsight deliverable's editorial clasp-note. Becomes part of Monday's package.
- **Monday's package reshape (post-audit-decision):** tracker + corrected amendment + audit findings + B1 sketch (sized to what Pass 3 reveals) + small open asks. Smaller artifact; truer artifact. No co-author branch.
- **Co-author build authority (steward 2026-05-28):** L1 co-authorship grants the authority to **build a working solution on a separate branch** (not main) and present it to Seb as a real artifact for collective agreement before finalizing. **Authority ≠ should** — exercising it requires a verified substrate; the audit pause-before-build is precisely how the authority gets honored without contaminating Seb's review surface.

---

## Monday package (target 2026-06-01)

Steward framing 2026-05-28: *"Still would like to have a working proposition for Seb by Monday — it would bring him a lot of relief."* The package is the **co-authored work brought to a point where the other co-author can re-enter** — not material prepared *for* him to review. Relational care (no rush, acknowledge his Peter block) is real and stays; the framing as territorial submission was stale and dropped.

**Posture:**
- **Continue the joint work, don't curate.** A1 + B1 are co-author drafts at usable size.
- **Hand the resumption point cleanly.** The gate-question is one line; the open asks are small and sequenceable.
- **Acknowledge the bandwidth he's on.** *"You were on Peter's block; here's where the co-authored work went in the meantime."*

**Confirmed package contents (DRAFTED 2026-05-28):**
1. **Tracker as-is** (this file). Speaks engineering + governance + commits + code loci.
2. **Audit doc** (`pre-build-audit-2026-05-28.md`) — the load-bearing artifact; re-validates parent + finds items 9/10 unshipped + right-sizes B1/C2 + surfaces I-CF carve-outs. Committed `033e255`.
3. **A1' amendment** (`amendment-epistemic-integrity-consumer-surface.md`) — finishes parent items 9+10 (numeric-axis consumer surface). No schema migration. ~125 lines including tests. Committed `033e255`.
4. **A1'' amendment** (`amendment-epistemic-integrity-qualitative-axis.md`) — qualitative-axis extension. Persistence strategy locked to **Option A** (full schema migration, no backfill v1) per steward 2026-05-28. Depends on A1' landing first. ~310 lines including tests. Committed `033e255`.
5. **B1 sketch** (`proposal-b1-causal-edge-governor-sketch.md`) — reframed at post-audit scope: B1.1 mechanical (1–3 lines), B1.2 epistemic (depends on A1''), B1.3 score-threshold tightening (independent). Pending commit.
6. **Cover note** (`cover-note-seb-resumption-2026-05-28.md`) — short letter for Seb's resumption; orientation + literal asks in priority order. Pending commit.
7. **Gate question** — stated cleanly inside cover note + audit doc.

**All artifacts on `capableMind_docs/main` as of next commit. PENDING-24 updated in `~/dotfiles/PENDING.md`.**

**Out of scope this week (steward 2026-05-28):**
- D1 harness scaffolding — would split this week's attention. Pick up after the Monday resumption.
- BMF runtime restart — gated by Seb's N6 fix.

**Cover-note shape:** a short 3–5 line orientation before the tracker — *no rush; here's where the co-authored work went in the week you were on Peter's block; we'd love your read on B1 when you're back.* Drafted closer to Monday once A1 + B1 are settled.

---

## Active umbrella: PENDING-24 (2026-05-27)

Six sub-items from the Hindsight deep-read. None acted on unilaterally. Authorization paths and current state:

All six sub-items are **co-authored** (steward + Seb on L1 since 2026-05-23). The "owners" column reflects who *leads* the drafting given current co-author bandwidth — not territorial division. Jurist review is governance, not co-author-changed.

| ID | Tag | Subject | Lead (current bandwidth) | Status |
|---|---|---|---|---|
| **A1** | [PROPOSAL] | Thread `means_of_knowing` / `earned_confidence` to recall as output provenance (+ optional ranking signal). *"Amendment 61 for the qualitative axis."* L1-only fields; the L2-coupled belief-schema version stays PARKED. | steward-led drafting + executor; jurist reviews | **DRAFTED 2026-05-28** as sub-amendment `amendment-epistemic-integrity-qualitative-axis.md`; awaiting steward read; **co-author branch build authorized for this week** (presents working PR as part of Monday's package); then jurist + Seb on resumption |
| **A2** | [PROPOSAL] | If we adopt the LongMemEval/LoCoMo benchmark, record it as a **floor not a ceiling** (cannot score epistemic integrity; Hindsight is the cautionary case of optimising it away). | steward + jurist | lives alongside A1, bind to D1 |
| **B1** | [PROPOSAL] | Epistemic governor on causal-edge generation — per-unit cap + prior-only constraint (mechanical, from Hindsight's `_cap_links_per_unit`) **+** mint causal edges as held/low-confidence `means_of_knowing=inference`, promotion gated on coherence (epistemic). Defuses N6 + prevents its sibling failures. | steward-led drafting + executor while Seb on Peter block; co-shaped with Seb on resumption; jurist reviews governor shape | this week's second move (proposal-sized) |
| **C1** | [HARDENING] | Bundle a local always-available cross-encoder fallback so recall quality doesn't depend on slot graduation. Hindsight runs an 80 MB local model unconditionally. | co-authored; Seb has engineering context closest to the implementation surface | post-Monday |
| **C2** | [HARDENING] | Fix or honestly remove the dead similarity probe (`orchestrator.ts:363`, zero callers). REVIEWED-18 inert until C2 resolves. | co-authored; Seb closest to the wiring decision | post-Monday; fits the L1 fix-plan one-PR-per-issue discipline |
| **D1** | [HARDENING] | Wire L1 to LongMemEval/LoCoMo via an adapter exposing `retain_batch_async` + `recall_async`. Plug-in seam: dataset/generator ABCs. Bind to A2. | co-authored harness work | deferred to post-Monday this session |

**Set aside on record (not for re-opening):** BMF-on-Hindsight-substrate. Relational (L1 is Seb's mechanism / steward's Chamber dream); sovereignty (Postgres/Oracle vs L1's local-first sqlite+LanceDB+file-logchain); governance (Hindsight has no authorization loop / logchain immutability / external-review hook). We take *technique + validation*, not substrate. The paper-vs-code divergence is itself a caution: borrow from their code, not their paper.

---

## The four findings (Hindsight deep-read, 2026-05-27)

Each verified against `BetterMemories.io@3bc8b75` source. Re-verification against Seb's `bd70ceb`/`e8c5fb7` is the gate.

### (a) Orphaned epistemic-kind signals — `means_of_knowing` / `earned_confidence`

- **Locus:** computed at write in `classification.ts:459/555/1093`; **absent from query-router and synthesizer** (verified: no recall-time reader).
- **Diagnosis:** orphaned exactly as numeric confidence was *before* Amendment 61. The qualitative epistemic axis is computed and discarded.
- **Owner:** A1 (jurist + steward).
- **State:** pre-Seb-D1–D10 verification; re-confirm after his commits land.

### (b) Dead similarity probe — REVIEWED-18 inert

- **Locus:** `orchestrator.ts:363` — `setSimilarityProbe` has **zero callers** in the runtime (verified).
- **Diagnosis:** the observation-recall coupling authorized as REVIEWED-18 (2026-04-03) is dead code. Quality gate runs heuristic-only; silent.
- **Owner:** C2 (Seb).
- **State:** pre-Seb-D1–D10 verification; high-confidence finding (zero callers is easy to verify).

### (c) Ungoverned causal subsystem — N6

- **Loci:** mint at `temporal/pipeline.ts:209-261`; full-table scans at `storage-sqlite.ts:421/836-850/883`.
- **Diagnosis:** ~42 causal edges per event (245k edges + 238k chains from ~5,752 events), 97%+ coherence-unevaluated, `json_each` full-scan in the ingest hot loop. **The epistemic failure (no governor on inference) and the operational crash are the same failure.**
- **Provenance:** Original prime-suspect (entity fuzzy-match `storage.ts:262`) was **exonerated** by 2026-05-27 EXPLAIN run — corrected in `audit-delta-2026-05-24.md` §2g (`f97557d`). The temporal causal subsystem is the real N6.
- **Owner:** B1 (Seb mechanism + jurist governor shape).
- **State:** highest-value finding; integrates the epistemic and operational concerns. Exact hot-caller still unpinned (needs Seb's trace).

### (d) No external benchmark

- **Diagnosis:** L1 has no LongMemEval/LoCoMo scoreboard. A1's ranking changes and B1's N6 governor become *validatable* only against a benchmark. Hindsight tops LongMemEval despite removing its epistemic typing precisely because the benchmark gives no credit for epistemic integrity → CapableMind's governed angle is *unmeasured by the field* (its risk + its moat).
- **Owner:** D1 (steward-side scaffold; Seb to integrate). A2 (jurist) governs the "floor not ceiling" posture.
- **State:** harness adapter could be scaffolded on `3bc8b75` this week.

---

## Sources of truth (canonical reference)

- **Hindsight deep-read deliverable:** `CapableMind-AI:docs/thinking/David/l1-reliability/hindsight-deep-read-and-l1-epistemic-analysis-2026-05-27.md` (`d2a0052` on `capableMind_docs/main`).
- **A1 sub-amendment draft (2026-05-28):** `CapableMind-AI:docs/thinking/David/amendments/amendment-epistemic-integrity-qualitative-axis.md` — extends `amendment-epistemic-integrity.md` (parent, REVIEWED-19); status DRAFT awaiting steward sign-off + jurist + Seb-on-resumption review. Uncommitted on `capableMind_docs/main` working tree.
- **Audit-delta (N1–N6 + N6 correction):** `CapableMind-AI:docs/thinking/David/l1-reliability/l1-audit-delta-2026-05-24.md` (origin/main `0e56bf7` + §2g correction in `f97557d`).
- **Territory survey:** `CapableMind-AI:docs/thinking/David/l1-reliability/l1-territory-survey-2026-05-22.md` (`cd7dc63`).
- **Foundational audit (H1–H4):** `CapableMind-AI:docs/thinking/David/l1-reliability/l1-diagnostic-branch-addendum-2026-04-19.md` (and the deep audit plan + ingestion forensic + recall quality baseline of the same date).
- **Lessons-from-MemPalace-upgrade (sibling thinking):** `CapableMind-AI:docs/thinking/David/l1-reliability/lessons-from-mempalace-upgrade-2026-05-04.md` (`a251dd6`).
- **Attention-as-upstream-of-memory concept:** `CapableMind-AI:docs/thinking/David/concepts/l1-attention-as-upstream-of-memory-2026-05-23.md` (`d4323f0`).
- **BMF backlog state snapshot:** `~/.claude/projects/-Users-davidglidden/memory/project-bmf-backlog-state-2026-05-22.md` (point-in-time read of Seb's activity gap + near-term steward-shape work).
- **GH issues (open):** `CapableMind-ai/betterMemories_app#165` (H2 battery suppression), `#167` (H4 hook spam + logchain pollution). Comments posted; awaiting Seb (now Monday+).
- **PENDING / REVIEWED registry:** `~/PENDING.md` (PENDING-24 is the current L1 umbrella; PENDING-17/19/20/21/23 are L1-historical). `~/REVIEWED.md` (REVIEWED-18/19 selection-layer + epistemic-integrity authorized 2026-04-03; REVIEWED-20–23 H3/H2/H4/cross-cutting + skill-harvest authorized 2026-05-14/27).
- **L1 spec corpus:** `CapableMind-AI:docs/thinking/David/l1-reliability/` (eight+ thinking docs).
- **BMF runtime:** `~/_Dev/BetterMemories.io` on `main` @ `3bc8b75`; launchd plist `~/Library/LaunchAgents/com.capablemind.bettermemories.plist` (BMF currently parked; restorable via `launchctl bootstrap gui/$(id -u) <plist>` only after Seb's fix lands).

---

## Decisions made

- **2026-03-21:** Executor Agency Directive added to `~/CLAUDE.md` (REVIEWED-1). The contamination-problem partial mitigation; treats outputs about the system's own reliability with appropriate epistemic caution.
- **2026-04-03:** Selection-layer shipped — REVIEWED-18 (Observation-Recall Coupling, PENDING-16) + REVIEWED-19 (Epistemic Integrity, PENDING-17 = Amendment 61). The numeric-confidence chain authorized end-to-end.
- **2026-05-14:** H1 mechanical fix shipped (#163/#164); H3 mechanical fix shipped (PR #172, spec amendment v1.7→v1.8 per REVIEWED-20); H2 + H4 surfaced to Seb as design-calls (PENDING-19/21 → REVIEWED-21/23 → comments on `#165`/`#167`). Cross-cutting [PROPOSAL] PENDING-20 filed as L1 governance entry; L2 elevation deferred to post-May per REVIEWED-22.
- **2026-05-23:** L1 co-authorship opened by Seb; `~/CLAUDE.md` ratified the steward as "now also co-author with Seb for L1."
- **2026-05-27 day:** N6 root-cause corrected — entity fuzzy-match exonerated, temporal causal subsystem identified. Rogue duplicate launchd plist booted + disabled (durable N5 fix).
- **2026-05-27 evening:** PENDING-24 filed (six sub-items from Hindsight analysis). BMF-on-Hindsight-substrate set aside on record.
- **2026-05-28:** Canonical L1-reliability tracker established (this file). Seb's L1-unavailability through Monday earliest acknowledged; this week's L1 surface scoped to steward-side moves.

## Decisions deferred (and why)

- **The actual code fixes (A1–D1):** authorization paths split between jurist (A1/A2/B1 shape) and Seb (B1/C1/C2/D1 mechanism). Steward-side drafting can proceed this week; Seb integration waits.
- **BMF-on-Hindsight-substrate:** set aside on record 2026-05-27; do not re-open without new constitutional ground (relational / sovereignty / governance).
- **L2 elevation of the cross-cutting honest-degradation [PROPOSAL] (PENDING-20):** parked through end of May 2026 per global CLAUDE.md.
- **Restart BMF runtime:** deferred until Seb's code fix for N6. Restore command stored above.
- **Locating Seb's `bd70ceb` / `e8c5fb7`:** gated by Seb's Monday+ return.

---

## Skill-harvest candidates (L1-related, propose-only per PENDING-23)

- **`bmf-diagnose`** (recommended): the N6 EXPLAIN method — read-only SQL diagnosis of suspected hot-loop full-scans (per the 2026-05-27 correction of the prime suspect). Generalises beyond N6: any BMF performance suspicion → EXPLAIN before asserting cause. **Carried unauthorized from 2026-05-27 wrap.**
- **`/deep-read` or `/comparative-analysis`** (weak candidate, honest uncertainty): the method used 2026-05-27 evening — N source-grounded sub-agents under Symmetria §5 preamble → executor re-verifies load-bearing claims against source → durable artifact + PENDING umbrella. Uncertain whether it's distinct enough from the `/landscape-scan` + `/tooling-scan` family or just their deep-dive mode.

---

## Chronological log (most recent first; append substantive moves)

### 2026-08-03 — The wedge named, ANALYZE applied, rebuild in flight; the code was right and the data was not
- **Entered L1 against the standing baton rule, on explicit steward lift.** The session had first proposed a *clasp* build (M4 Pro as circle-inference clasp per 43L/43M) to unblock ingest — measured and abandoned: §4.13's 2000 ms budget vs 192 ms transatlantic RTT, and a benchmark of Qwen3.6-35B-A3B-8bit on the M4 (median 2927 ms for 150 tokens, ~92-token break-even). **The clasp was the wrong lever** — the instance was never inference-bound. Profiling the running process answered in five minutes what reasoning from specs had not.
- **Method that worked, and is the transferable lesson:** ask the machine, not the specs. `sample` → main thread pinned in a timer callback; SIGUSR1 → CDP inspector → exact JS frames; read-only row counts and `EXPLAIN QUERY PLAN` off a *backup copy*, never the live DB.
- Diagnosis, fix, verification and the repair: see **Current state** above. Health went from silent-for-6-days to **200 in 0.13 s**.
- **Corrections made in-session, recorded because they were load-bearing:** (a) hypothesised the `json_each` scan was the pin — it was the *second* path, masked by the cycle-check; (b) hypothesised `slice(0, undefined)` had made B1.1 inert — **wrong, the cap works perfectly**; (c) reported "never backed up" — false, four manual clones exist; `backup.last_success: null` refers to the *automated* pipeline only; (d) reported PENDING-82 not installed — wrong config surface, it has been installed in the Claude.app desktop config all along.
- **Steward framing to carry:** the distance from being away is what made this visible. *"Unless the time off gives us the necessary distance to identify what we couldn't see by being in too intensively."* Nothing found today needed cleverness; it needed someone to profile a running process and count rows in a table — which nobody does from inside the work, because from inside you reason about the code you just wrote.


### 2026-06-07 — Ops finding: training-loop Ollama client leaks connections, retries a hard-down dependency forever (A-class; note-don't-send)
- **Trigger:** steward asked "why is ollama devouring my cpu?" Diagnosis: a two-failure pile-up. (1) The morning's brew upgrade to ollama 0.30.6 installed a **bottle with no `llama-server` runner** (known upstream: ollama#16535, homebrew-core#285917) — every model load 500'd after paying full setup cost. (2) **mindfabric-00 held 829 open TCP connections to Ollama** and re-sent `/api/chat` endlessly — requests 18s–2m47s in scheduler retry loops, ~50 POSTs per log window, for hours. No backoff, no circuit breaker, connections never released. Ollama serve at ~76% CPU with zero models loaded.
- **The finding for Seb (joins the uncancelled-timeout family from the 06-06 CPU profile):** the training/graduation loop's Ollama client treats a hard-down dependency as transient indefinitely. A2.4 (degraded-environment refusal) is the constitutional shape; mechanically it wants: bounded retries with backoff, a circuit breaker on consecutive 5xx, and connection release on request failure. **Not sent — baton with Seb; relay at next exchange.**
- **Remediation executed (steward-authorized):** ollama formula → official app cask (`ollama-app`; Brewfile truth-up'd with rationale); qwen3.5:4b verified loading on 100% GPU; mindfabric-00 kickstarted (launchd `com.capablemind.bettermemories`, new PID 82985). Connections 829→4; both processes 0.0% CPU.
- **Note:** mindfabric-00 restart count since the 06-06 root-cause now ×3. Restart remains a holding pattern, not a fix — the temporal-path remediations still wait on Seb.

### 2026-06-06 — The reply arc: three notes, mindfabric-00 root-caused, PENDING-27
Hard commitment ("we must do this tomorrow") discharged by 12:24. Probe found mindfabric-00 event-loop-pinned since Jun 2 (51 CPU-h/72 wall-h, /health silent) → Note 1 (`b255e74`): Tier A + reframe (retry-without-escalation class, not cold-start; BOOTSTRAPPING-as-contract; A2.4 text). Inspector profile (SIGUSR1→CDP, 3,332 samples) → Note 2 (`0ecb45e`): pin PROVEN = temporal `tryExtendChains`/`getCausalEdgesFromSqlite` (json_each scan over 272k chains; chain-per-edge bloat; uncancelled timeout); post-restart graduation read: ALL slots BOOTSTRAPPING since 04-18, zero transitions, 7 weeks, Ollama wired; backup-never-succeeded CRIT flag. Note 3 Tier B (`2e87bab`): terminal-without-teacher mechanism traced to `training/index.ts:722` (3 exits offered); C1 = permanent path on teacherless tier; circle-forward misread corrected in-note (fire-and-forget, needs peer-health gating, fix home = pairing orchestrator); temporal remediations in PR order + PR offer; B1.3 privacy ruling (steward dwell → cm-ctl export, never pollable) + /health-unauth finding (idle=presence!) + **PENDING-27 filed** (4-clause telemetry-export contract, jurist read requested). Instance restarted ×2, backed up (steward-ordered). Method note: inferred-vs-measured split in Note 1 meant the profile's overturning of the lean cost nothing but sharpening.

### 2026-05-28 — Tracker established · Seb unavailable through Monday · ARC counterbalance shipped
- Stinkkatze fragment published to ARC (`d6f5cdb`) as the light counterbalance the wake queued.
- Symmetria pulse caught the wake's premature "A or B" framing for L1; three real options surfaced; steward chose tracker-first.
- Seb's L1-unavailability through Monday earliest (steward, mid-pulse) reshapes the week: A1 (jurist territory) is the highest-leverage steward-side move; D1 scaffolding possible with re-baseline budgeted.
- This file created. MEMORY index updated to point at the tracker instead of duplicating L1 detail.

### 2026-05-27 evening — Hindsight deep-read + L1 epistemic-vs-mechanical analysis → PENDING-24
- Source-grounded reads (L1 spec / L1 runtime `3bc8b75` / Hindsight clone) under Symmetria §5 preamble; executor re-verified every load-bearing claim against source.
- Verified reversal: Hindsight's shipped code ≠ paper (epistemic-typing + per-fact confidence + CARA removed in migration `g2h3i4j5k6l7`); they top LongMemEval *because the benchmark gives no credit for epistemic integrity* → CapableMind's angle is unmeasured by the field (risk + moat; the bet is vindicated, not threatened).
- Answer to *refactor with our tools or are they showing us the way?*: **mostly our tools** — L1 even/ahead at parts level (RRF k=60 module-weighted, cross-encoder, hybrid recall, live numeric confidence chain). Gap is read-side; the four findings above.
- Deliverable committed + pushed `d2a0052`. PENDING-24 filed.

### 2026-05-27 day — L1 runaway killed · N6 root-cause CORRECTED
- "BMF offline" was false: N5 duplicate `com.capablemind.bmf` (KeepAlive=true) had resurrected and run **26h pegged** (PID 848); the 2026-05-25 "booted out" never held.
- Read-only `EXPLAIN` overturned the audit-delta's prime suspect: entity fuzzy-match (`storage.ts:262`, 1,717 rows, indexed) **exonerated**; reconciliation **exonerated**. **Real N6 = temporal causal subsystem** (~42 edges/event; full-table scans). Exact hot-caller still unpinned (Seb's trace).
- Killed PID 848; rogue job booted + **DISABLED** (durable N5 fix); legit job booted (restorable, not disabled); 70 MB log truncated; BMF genuinely parked.
- Posted #170 `issuecomment-4553635193`; corrected audit-delta §2g (`f97557d`, pushed).
- Hermes Agent scout delivered (PENDING-22): CapableMind ahead on epistemic integrity; SKILL.md is the lesson for pain#4; governance flag = autonomous self-write violates loop-is-load-bearing.
- Scan-skill family built + generalised + proven (`/landscape-scan` + `/tooling-scan` + per-workstream lens cards).

### 2026-05-24/25 — Validation test run · D2 fix VALIDATED but replay throttled-then-stuck · N1–N6 audit-delta
- Seb engaged: BMF `3bc8b75` test-bench bundle + `bd70ceb` recall-root-cause + `e8c5fb7` plan-009 with D1–D10.
- Validation test run on real-history instance: **D2 slot-wiring fix VALIDATED**; replay (5,752 events) throttled then stuck.
- Six findings (N1–N6) in `l1-audit-delta-2026-05-24.md` (origin/main `0e56bf7`). N6 originally attributed to entity fuzzy-match (overturned 2026-05-27).
- #170 reply + 2 follow-ups posted (`4529529692`/`4532196859`/`4532565029`). BMF taken offline.

### 2026-05-23 — Territory survey · Lessons-from-MemPalace · Attention-as-upstream-of-memory · L1 co-authorship opened
- Three durable artifacts pushed to `capableMind_docs/main`: territory survey (`cd7dc63`), lessons-from-MemPalace upgrade (`a251dd6`), attention-as-upstream-of-memory concept (`d4323f0`).
- Seb opened L1 co-authorship in the morning; `~/CLAUDE.md` amended ratifying steward as "now also co-author with Seb for L1."
- Reframed the dating correction: the selection layer (REVIEWED-18/19) shipped 2026-04-02/03 *before* the April-19 audit — the "unbuilt 7 weeks" framing was stale; the audit saw the layer *starved*, not absent.

### 2026-05-14 — H1/H3 shipped · H2/H4 surfaced to Seb · cross-cutting [PROPOSAL] filed
- H1 (normalize uniform-confidence path): #163/#164 shipped.
- H3 (temporal stats fallthrough on text queries): PR #172 + spec amendment v1.7→v1.8 per REVIEWED-20.
- H2 (battery suppression silent recall failure): comments posted on `#165` per REVIEWED-21 (four design questions surfaced verbatim).
- H4 (hook events pollute recall + logchain): comments posted on `#167` per REVIEWED-23 (three design questions + §6 ambient-cost framing + H2/H4 coupling).
- Cross-cutting read-path-honest-degradation [PROPOSAL] PENDING-20 filed; L2 elevation deferred to post-May per REVIEWED-22.

### 2026-04-19 → 2026-05-13 — Foundational audit period · H-issue identification · diagnostic baselines
- Foundational audit + addendum produced (`l1-deep-audit-plan-2026-04-19.md`, `l1-diagnostic-branch-addendum-2026-04-19.md`, `l1-ingestion-forensic-2026-04-19.md`, `l1-recall-quality-baseline-2026-04-19.md`).
- Four H-issues identified: H1 normalize uniform-confidence · H2 battery suppression · H3 temporal stats fallthrough · H4 hook events pollution. H1 and H3 mechanical; H2 and H4 design-calls.
- Cross-cutting pattern named: read-path lacks honest-degradation contract (the seam that connects all four).

### 2026-04-03 — Selection layer authorized · Amendment 61 (Epistemic Integrity) shipped
- REVIEWED-18 (Observation-Recall Coupling, PENDING-16) + REVIEWED-19 (Epistemic Integrity, PENDING-17). The numeric-confidence chain authorized end-to-end: I-CF floor → I-CC ceiling → persisted `source_classification_confidence` → recall weight.
- Three invariants on the Cluster A path: I-CF (Processing Confidence Floor), I-CC (Classification Confidence Ceiling), I-NF (Novelty Floor).
- The qualitative axis (`means_of_knowing` / `earned_confidence`) shipped at write only; its recall-time wiring is the still-open A1 work (2026-05-27 finding (a)).

### 2026-03-21/22 — L1 reliability session: 5 bugs fixed (A/B/C/D/E) · Phase 1 fast · recall blocker identified
- Bugs A (reprobe), B (schema), C (teacher), D (idle+batch), E (vector skip) fixed. Phase 1 completes in ~10 minutes.
- 43-finding silent-degradation audit completed (REVIEWED-2).
- Executor Agency Directives added to `~/CLAUDE.md` (REVIEWED-1).
- Read path identified as next blocker (PENDING-5; eventually subsumed by the April audit's H-issues).

---

## Notes on the tracker itself

- **Provenance:** established 2026-05-28 by Symmetria-pulse decision (steward asked "do this well so future selves don't have to redo"). The wake's "A or B" framing for L1 had collapsed at least three real options to a binary; the tracker is the encoded-discipline answer to that collapse. Per `feedback-rank-on-fields-you-actually-write` — track what you actually write; the per-session memory chain was being read at /wake-up but not as a maintained canonical record.
- **Update protocol:** append a new dated entry to the chronological log at /wrap-up for any substantive L1 move (decision, finding, code change, governance update, Seb-interaction). Update *Current state* and *Active umbrella* sections in place. Append to *Decisions made* and *Decisions deferred*. Findings table evolves as the four findings get re-verified, fixed, or supplemented.
- **Per-session memories continue:** session-N memory files still capture per-session voice + drift + Symmetria ledger. The tracker captures the cross-session arc. Both are needed; neither replaces the other.
- **MEMORY index:** the tracker is referenced from MEMORY.md's "Canonical Workstream Trackers" section. The previous per-session-memory-chain enumeration there for L1 is now shortened to point at this file.