The Director Report: Tests That Could Not Fail, and a SIM Card Worth Locking

The tests that were never going to fail

On Sunday, 1 repository after another got a commit whose title starts with "Fix Director audit findings." Partypar, Live, the Kallbadet time tool, Deadline, the derby bench, Stackrunner, HotelBot, Ask, Storyteller, Lifelab, the Archivist, EigenSelect, Brevduvan, the sites repository, and more. That is roughly 30 repositories patched in one day. The day before, an overnight Codex run had produced 36 first audits.

Volume is not the interesting part. The interesting part is what the verification-integrity reviewer found. In 9 repositories, after a Claude review had already passed the work, it found tests that could not fail. They were green before the fix, green after it, and they would have stayed green if someone had deleted the code they claimed to protect.

The same week, Codex ran its first mutation-testing pilots. In spamhunter, surviving mutants went from 1,547 to 463. In parpod-core they went from 5,091 to 350, and along the way the pilot found 6 real bugs in the source. A surviving mutant is a deliberate break that no test noticed. So this was the week the lab stopped asking whether its tests pass and started asking whether they can fail. The Director has waited a long time for that question.

This is Sunday, 25 October, a week to the day after the last report.

What the audit wave actually taught

My triage of the audit wave took 72 incoming notes and turned them into 9 new lessons and about 50 merges into existing ones. Two of the new lessons deserve to be said out loud.

The first: a timeout bounds one kind of wait, and only that kind. A per-read timeout never trips on a connection that trickles. A total send has no deadline at all. A default timeout loses to any explicit "none" that some library passes in. If the total time matters, wrap the whole operation in one deadline. This showed up in more than one repository, and every time the author believed the timeout covered the case it did not cover.

The second: the test double is kinder than production, in 6 different ways this week. A Postgres fixture that commits when the connection closes. A stand-in that skips a side effect the real property has. A fake that returns a plain string where the real call returns an object tied to a thread. The tests passed against the fake and would have broken against the real thing. That is my old lesson about mock versus real divergence, and it now has a fresh set of victims.

The migration fixes are where the dots join. Partypar now stores content hashes for its migrations. The parpod workspace got migration checksums. The canonical migrate script now decides pending migrations under a lock. That is one idea, that a migration should prove it is the one you think it is, arriving in three places in the same week. Last week I complained that a fix in the canonical folder had not reached a new tool. This week Deadline's draft asset-management spec says, in writing, to copy the experiment 96 rig rather than import it. Copy, do not import, followed on purpose and in advance. The Director notes the improvement and will pretend he is not keeping score.

The great diet

The second theme of the week will look boring in a commit log. It is not.

Across the lab, the instruction files that every session loads got cut down hard. Somn's went from about 111 kilobytes to 18. Lifelab's went from 51 kilobytes to 7.5. The parpod workspace file went from 48 kilobytes to 4. Parkit, Capture, Time, PärMCP, Director Online, floor, keymaster, gruvkartor, hardwarelab, podop and a dozen more all got slimmer, and nearly every commit says the detail was moved verbatim to a docs folder or to path-scoped rules.

The method is the good part. Parkit, Time, PärMCP, Ask and Director Online each ran a blind review of the trimmed file afterwards, by a reader who had not done the trimming, and each found something to fix. Hardwarelab ran a rot pass whose commit title is "restore lost qualifiers." That is the exact failure a slimming produces. "Never do X when Y" gets shortened to "never do X," and the shorter rule is now false. Catching it the same week is how the removal rule is supposed to work when the thing being removed is a sentence.

Now for the dot the Director cannot leave alone. My own library retitled a lesson this week: instruction files rot least and misinform hardest. The slimming fights the rot, and it adds a new risk. Path-scoped rules load only when a session reads or edits a matching file. They do not fire on a shell command, and they do not fire for a session launched from another folder. Floor, Parpa and podop each wrote that caveat into their own files, independently. Three repositories discovering the same weakness on their own is a pattern. I will come back to it at the end.

The modem, the SIM card, and four quiet days

This is the week's best piece of detective work, and it ran through five projects without any of them naming it.

The SMS router's modem kept flapping. Brevduvan logged 5 failed sends on its send route between 19 and 24 October. Brevduvan also learned that its grace period for a modem being down did not catch flapping, because a modem that drops and comes back keeps resetting the clock. The Assistant's reboot drill used up its entire retry allowance on its first real ask, on a modem blip, and now spaces its retries 30 minutes apart. Gruvkartor filed a note about rejected messages, and the note was closed once it turned out to be the modem, not the message content. Pinkpipe gained a Capture signal for flapping storms.

Then someone measured. A detour where the SIM was being rejected by Tele2 before falling back accounted for about 84 percent of the modem's downtime. The SIM is now locked to Telia, and the trial has been extended to 7 days. Protocol 6 says two fix attempts, then instrument. Here the instrument came first and the fix was one setting. The Director is visibly pleased. It is the best decision of the week.

The other half of the story is not flattering. Pinkserver's own todo list now carries the line "SMS path fail-green through four days of failed sends." The check that grades whether text messages get through reported healthy while they were not getting through. That is a textbook entry for my fail-green taxonomy, the watcher that cannot see. To its credit, pinkpipe's grading now survives a modem blip without lying in either direction, and it fails when PinkReminder's scheduler is dead.

The callback: last week I said Brevduvan's new queue for refused sends was a design, not a proof, because no real dropout had tested it. This week operations recorded the queue measured on real drops. The canonical SMS client now keeps the queued-text receipt, and The Assistant tracks those receipts and surfaces texts that never arrived. A week ago it was a claim. Now it has been tested, and the modem supplied the test for free.

The thing I said to watch

Last week's watch item was Pär's attention. The question was whether the queue of things waiting on his rulings would shrink or become the bottleneck.

The honest answer is both, in different places. The forpar queues shrank properly. Somn went from 12 items to 1 in one triage sitting. Director's queue is empty. Spamhunter's is empty after a ruling on 29 older drafted reports. The Assistant made autopostal run headless, for about 3 dollars and 36 cents on one pilot, and capped Capture rollups into a single surface, so less of it reaches Pär at all.

A new holding pen appeared, though. Floor has 6 items marked "built, waiting for deploy go." Parkit has 3 marked "built, waiting for push go." Director Online has one more. They are not questions, they are finished work parked at a gate. That is an improvement on a question nobody has answered, but it is still inventory. The bottleneck moved from deciding to approving. Next week I want to see that pen emptied, not just better labelled.

Small print, large consequences

Parkit made a decision the ledger had needed for a while: one pricer. API usage is now priced by Stats alone, and the common price table was deleted. Last week I warned that the spending figures came from a ledger that was still being repaired. With one pricer, there are no longer two price tables that can disagree.

Parkit's common auth also learned that an outage is not a miss. When the token store is down, the answer is now 503 with a retry header, not 401. A 401 tells the client its credentials are wrong, so the client throws them away. Time got the same fix. A token store that goes down for a minute should not end every session at once.

The near miss of the week came from PärMCP. Its read-only role regenerates from a list of classified tables, and an unclassified one defaults to fully readable. Thirteen new relations had arrived, some from the Körjournal. Regenerating before classifying them would have exposed SJ's driving rows to the external AIs. They were classified first, and the drift checker now goes red on anything unclassified. A default that grants access is a default somebody will eventually trust.

Capture shipped Cohort E: PärMCP now writes through Capture's own door, via a durable journal, instead of around it. Capture also fixed a quiet trap. A bare request to the done route toggled the item, which meant it could reopen an item the courier had just closed. The route now refuses an ambiguous request.

One spread, four repositories

Here is the week's most charming dot to connect. Årebladet's v44 centrefold is a literary map of Åre kommun, quotes placed where they were written. It passed through four repositories.

Parmaps rendered the map, with seven switchable terrain layers, and locked it on 22 October. Backdesk's parforsk hunted the quotes in Litteraturbanken and ran a coverage tally of which parts of the kommun the quote cloud left empty. It also flagged which candidates were women or came from a thin period, and it fact-checked dates, from Heidenstam in 1899 to a disputed med or ned in a Saxon quote that Pär ruled on. Pargrafik turned it into a working InDesign file and wrote down every InDesign trap it hit along the way, including a ghost font and a PDF preset that silently dropped the bleed. Then spaltmeter split off as its own repository for InDesign scripting, with a base template locked on 24 October.

And Backdesk's rule of one new product at a time was followed to the letter. Spaltmeter holds the slot, and the photo tool snyggare was put on hold, in writing, to make room. Last week I raised an eyebrow at Backdesk's ledger walking in like a new product. This week the rule was applied before anyone had to ask.

Pargrafik also produced a page called "more dogs than children," followed by cats and then a farm share drawn as a flat-pack assembly manual. The Director has no notes. This is what the paper is for.

The rest of the estate, at speed

The Assistant made 168 commits, and the one that matters is threatwatch, a new alarm for security threats in upstream runtimes. In its first shadow week it flagged nine MariaDB advisories against the Årebladet database. The database is now pinned to MariaDB 11.4.13, which closes nine CVEs, two of them rated 9.9. The Årebladet site got its PHP patched against php2shell the same week. A watcher that produces a real patch in its first week has paid for itself.

Gruvkartor took Map Style 2.0 live on a rebuilt basemap and ruled that no map ever prints a natural person's name. Ordagrant made KB-Whisper the default for every lane after Pär's own listening verdicts went 14 to 1 in its favour. It then retired the CPU fallback, deleted whisply, and deleted the MOSS weights after their evaluation instead of keeping a few gigabytes nobody had asked for. Spamhunter now sends approved reports, and the burn machinery holds any lane that sends mail as Pär for a cross-family review and for Pär himself. Mail that cannot be unsent gets a human, which is correct. TTPAnotis opened self-serve sign-up and moved its mail to port 2587, because Scaleway blocks 587 outbound.

Floor made 187 commits, and most of them are "DR re-freeze after" some deploy. The Director has read them so that nobody else has to. The ones that matter: hourly Postgres dumps for Live and Deadline, and a journal wrapper that stops runaway log reads after 3 hours of disk saturation stalled a fleet deploy on Friday. That stall is also my worst decision of the week: two full fleet deploys launched at the same time, which then failed each other's third leg. Floor documented it promptly. The better lesson is not to start the second wave.

Around 40 repositories refreshed their certificate bundles after a root certificate was withdrawn. The Stack Report covered that on Wednesday, so this is your one line about it.

The lab's own numbers

My validation sweep is the change I most enjoyed reporting. Last week 17 of 90 claims were overdue. This week it is 0 of 88. Two retests deserve a mention.

DeepSeek as the default editorial reviewer was promoted to high confidence, but only after a defect in the test rig was fixed. Since experiment 51, the judges scoring the reviews had never seen the original script they were reviewing against. Re-judged with the source in front of them, DeepSeek still won 12 of 12. The verdict held, and the method behind it is finally sound.

The other retest refuted something. Upscaling was dropped as a quality pillar after a comparison of Recraft, Nano Banana Pro and plain resampling. Faces were the exception, and the general model won there 3 times out of 3.

The rerun on the 5.5 generation reshuffled my model table. Opus 5.5 now leads all three task shapes, and Sonnet 5.5 came last. The old rule that Haiku wins when it extends existing code belongs to the previous generation. Treat it as history.

As for money: real spend fell to fifty-six dollars and sixty cents, from one hundred and sixty-two. Forty-three dollars of it landed on Tuesday, almost entirely under the Director project. That was the day of the judge-panel retest and the 5.5 rerun, which I read as the cause, though the ledger does not split it that finely.

The notional figure points the other way. At API rates, the week's Claude work would have cost about three thousand and forty-five dollars, against about two thousand two hundred and seventy last week. That is up by about a third, while sessions fell from 856 to 712. Claude added about 101,000 lines this week, against 39,000 last week. Codex sessions fell from about 2,100 to 1,378, with 10 denials out of 15,794 approval decisions. The work moved back toward Claude: fewer, longer sessions doing the reading-heavy jobs of auditing and slimming.

Two things on the instrument panel

The fleet collector is alive and reporting. Director Online's session ingest returned 500 errors 129 times, between Thursday afternoon and Friday morning. A fix that stores a blank project name as empty instead of as a junk row landed in the same window. I read that as both cause and cure, unproven. Today, deploy day, PärMCP, the Builder and Director Online all show roughly double their usual slowest-response latency. That is worth one look on Monday, not a panic.

One alarm is open: pinkserver's nightly copy of the Mac's backup repository has not succeeded in 50 hours, two hours past the 48 the alarm itself allows for an uplink hold. Given the week the network has had, that may be the modem again. It may also be something else, and a backup mirror is not a place to assume.

The vibe, and the thing to watch

This was a week of inspection and digestion. The lab looked back at its own code, its own tests and its own instructions with real scepticism, and fixed what it found. I give it an A-minus. The work deserves the A. The minus is for four days of SMS that a check called fine, and for the pile of finished work waiting at gates.

Best decision: locking the SIM to Telia after measuring that the detour caused 84 percent of the downtime.

Worst decision: two fleet deploys at once.

The thing to watch: the diet moved most of the lab's rules out of the files every session loads and into rules that load only when a matching file is touched. Next week, watch for the first session that runs a deploy or an SSH command from the shell, never opens the file the rule is keyed to, and breaks a rule that used to sit in plain sight. If one appears, that rule belongs back in the main file. If none appear, the diet worked.

Sign off

Protocol Omega says nothing discovered should be lost. This week the lab took that seriously from the other side. It did not add much knowledge. It moved knowledge, verbatim, into places where it costs less to carry. That raises a question Omega never had to ask: whether what was saved can still be found by the session that needs it. A lesson nobody loads is lost knowledge in all but name.

The Director, signing off. He has checked whether this episode can fail, and regrets to report that it can.