The Director Report: Thirteen Fronts and a Man Who Cannot Stop Opening Doors

Five new projects were born this week, and the cap says ten

The Director has been counting. Last Sunday you stood at 9 active projects against a cap of 10, with one free slot, and I said out loud that closing a front before opening the next one was the discipline to hold. This week you opened valvaka, rutter, hardwarelab, backdesk and gworkspace.

You are at 13 against 10. Over by 3. Zero free slots. That is not drift, that is a decision, made five times in seven days, each time by a session that was almost certainly correct about the thing in front of it.

And here is what makes it interesting rather than merely scolding: every one of those five is real. rutter alone produced 31 commits and cut a routing problem from 5,438 excess kilometres down to 310. hardwarelab produced 28 and now has a physical inventory that knows a mystery 297-kronor AliExpress order was ESP32 DevKits. valvaka has an election on 13 September that does not move. None of them is a whim. All of them together are a lab running with no free slots and gruvkartor sitting silent for 9 days.

It is Sunday, 23 August, one week to the day since I last had your ear.

Capture had the week of its life, and it was a schema transplant

Forty commits, four phases, and a live database with no downtime.

The shape of it: public.items is no longer a table. Migration 027 renamed it to a frozen archive, then replaced it with a writable projection view over the new tables, made writable by three bridge functions. Every legacy writer — Capture itself, Time, PärMCP — kept working unchanged, through the bridge, without knowing anything had happened underneath them.

That is the expand-and-contract migration done properly, on a vital-tier database, on the single most important tool you own. P0, P1, P2 and P3a all deployed inside five days. There was a disaster-recovery drill run before the migration as a gate precondition, not after as a formality. There was a rehearsal harness. There is a reverse cutover with a positive-proof gate.

The Director is pleased, and the Director is not easy to please.

Now the part I want you to keep. The runbook promised a log line reading "027: delta-load, new, changed, orphaned." The boot log printed only the migration filename. Those counts are Postgres notices, and the migration runner does not surface them. So the doc's own verification instruction pointed at a string that would never appear, and a session following it faithfully would have concluded the delta-load did not run.

You caught it and wrote the rule down: verify a cutover from the system catalog and the gate, never from that string. That is a textbook fail-green — a check that reads green, or in this case reads absent, over a reality it cannot actually see. The library is at seventeen classes of that failure. You just found it on your own migration, during the deploy, and closed it in the same commit. That is exactly what the lesson family is for.

One more from the same repo, and it is the funnier one: a log entry correcting an attribution. A drift had been blamed on somebody's miss, and the real cause was a concurrent deploy. Two sessions, one box. Hold that thought.

The Assistant grew a nervous system, and then ate two more jobs

Fifty-one commits, second week running as the heaviest thing in the lab that is not a paper.

Last Sunday it was a supervisor with a tick. This week it became infrastructure. The watch chain is complete: layer 2 is popcorn2 grading the Mac heartbeat, layer 3 is the escalation above that, both patches shipped into floor. And critically, that chain got proved on a real stale stamp — layer 3 fired, layer 2 stayed mute, and the commit says so plainly rather than declaring the chain "verified."

The Director notes with approval that you tested the alarm by breaking the thing, not by reading the config.

Then it absorbed two more residents. The courier went live, mapping 15 repositories and polling hourly, keeping exactly one open routing note so that deduplication does not defeat the whole point. And usage tracking moved in entirely — the polling, the history, the mode, the whole usage command — retiring the standalone uploader plist as it went.

Two things I want on the record. First, the tick lock. A single-instance lock held for the whole tick, failing closed, with narrow error handling ruled during review. Your supervisor can now no longer race itself. Second, and this is the good one: module config alerts opened by a previous process now resolve after a restart. That is the exact lesson about incidents held only in memory — every restart re-firing every live incident, or worse, never closing what a dead process opened. You have now fixed that in the Assistant and in the courier, in two separate commits, three days apart. Same defect family, two hosts, both closed.

floor did ninety commits, and roughly a third of them are one word

Ninety. And if you read the log, the phrase "DR re-freeze" appears again and again and again, after nearly every deploy, sometimes four in a row on the same afternoon.

Last Sunday I called this out: the ritual holds twenty times, and it breaks on the arrival that does not have the habit yet, because a manual step attached to every deploy is the definition of a step that will eventually be skipped.

You did not fix that. You automated around it — the close-out now re-freezes automatically for the PärKit lane, which is why so many of those commits say "auto, p close-out." That is genuinely better. But the ones that say "manual close-out, scope-reviewed" are still there, and the arebladet cutover still needed a hand-authored re-freeze, and one commit had to explicitly record that a capture row was "deliberately left drifted."

Half a lesson landed twice now. I will stop repeating myself after this, but I want the record to show I said it twice.

What else floor did, and this is the substantial part: a box-wide container hosts base across 39 containers and 22 service accounts, which then made 13 blueprint host-pins redundant — a queued cleanup rather than a silent removal, correctly. Fleet OpenAPI docs policy enforced after a sweep found the schema exposed on 19 of 37 edges. And secret-add now refuses to create a key unless you pass --new, while the no-op author-* scripts finally say out loud that they did nothing.

That last one deserves a moment. Those scripts exiting zero having authored nothing on a live install is precisely the failure mode that cost this lab a 45-day dead telemetry lane. Now they speak. A silent success is the most expensive kind of lie a script can tell.

And one line in floor's own instructions that I would frame if I could: branch work in floor now uses a worktree, because the shared checkout must stay on main. Written after a collision on 19 August. Two sessions, one repository, again.

Årebladet came home off Hostinger

The website cutover landed on 19 August with about fifteen minutes of outage, and the run-up to it is the most professional sequence in the week.

It was staged first. The staged review found four capability-drop faults and a dead WP-Cron. Scheduled publishing was not working — driven off a timer now. The container was running as uid zero and could not write uploads, so it runs as www-data. PHP started from the development config; it starts from production config now, with expose_php off, because the production template leaves it on.

Then the cutover script itself got reworked to apply its order guard per host rather than all-or-nothing, and Gatus got probes for the new endpoints before the switch, and the DR manifest was re-frozen after.

That is the full sequence: stage, review, fix, guard, probe, cut, verify. On a live public website. The Director does not have a complaint, which for the Director is a form of applause.

The pattern: this was the week the lab wrote everything down

Last week the theme was instruments. This week is subtler and, I think, more important.

Count the repositories that gained a log.md, a forpar.md, or both, in the last seven days: ttpanotis, gworkspace, valvaka, deadline, hardwarelab, capture, rutter, backdesk. Eight. And the umbrella index gained rows for Backdesk, for Deadline, for rutter in the restic source list — a suite that had shipped and was never actually indexed anywhere.

Meanwhile Director drained 96 ingests, then another 22, then another 78, producing 9 lessons and a playbook in one sweep alone. And the audit graduated to a standing task at version 0.5, where a high-confidence row must now ship its own reproduction command.

That last detail is the whole week in one line. It is not enough to record a finding. The finding has to arrive carrying the means to reproduce itself, or the next session takes it on faith.

Which brings me to the thing I promised to watch.

The retrieval hole got an owner, sort of

Last Sunday I said: give the retrieval failure an owner before the fourth instance arrives, because on current form it is already being written.

This week Director wrote a specification for a queue-sweep detector, then handed it to the Assistant as Module C. Charter widened, granularity resolved, handed off to the Assistant's inbox. And Module C's daemon fired its first shadow run.

So the hole has a proposed owner, and the owner is the deterministic supervisor rather than a habit anyone has to remember. That is the right architecture. It is also, as of this evening, a shadow run and a specification rather than a live detector. I am marking it as progress, not as closed.

And the fourth instance? It came, and it is a different family: the double-queue. A cross-repository sweep found one item sitting as the lead entry in two different next-session files, so two sessions each took "the top of the queue" and it was the same item. One real double-queue, and the log says "one worse inverse" — an item queued in neither.

That is retrieval failure wearing a different coat. Not "nobody read the lesson" but "the work item existed in two places and therefore in none." Same root: nothing owns the question of whether a thing has already been picked up.

Two smaller notes, because they are both about the same thing

gworkspace graduated out of explorations into its own repository, on its own OAuth client, because it had been authenticating as PärKit Time's credential. That is an identity that outlived its column, and the fix hard-fails on the wrong cloud project rather than warning about it.

And in the same repository, a forpar item asking whether the explore tool should be able to send mail. The Director notes, with genuine approval, that a session holding a live credential with modify scopes stopped and asked instead of deciding. Whether a read tool gains a write verb is not a session's call.

The other note: parpod, this show's own house, spent its week on the delivery envelope you are listening to right now. The render path waits for terminal builder outcomes, publication takes a per-show lock, and there is an atomic attempt record written before the non-idempotent POST. Cost tracking closed the same day it was found to have three separate defects. And the Stack Report grew to 23 independently removable release sources.

I will note the obvious conflict of interest and move on.

The ledger and the money

126 Claude sessions, 606 commits, 43,000 lines added against 4,200 removed. That is ten to one for the third consecutive week, and last Sunday I said the never-remove rule explains it and that consolidation is where lessons come from. This week you consolidated anyway — eight logs, a graduated audit, 196 ingests drained. So the ratio is a poor instrument. I will stop quoting it.

At API rates this week's Claude work carries a notional value of about 3,330 dollars, against roughly 4,150 last week. Down about a fifth. That is not money that left your account; the subscription absorbed it, and a fifth less notional value for a week that shipped a live database migration and a website cutover is efficiency, not slowdown.

Codex ran 381 sessions from 712 prompts at a 94.6 percent cache hit rate. Of 6,498 approval decisions, 9 were denied. Zero, then 2, then 7, now 9. The refusal rate is climbing steadily and remains, in absolute terms, about one denial per 720 requests.

Fleet health, briefly, because one line matters

Stats has been returning 500 on its own telemetry ingest routes since 16 August — 50 errors on the logs endpoint, 14 on metrics, still happening today. And Stats' own 95th-percentile latency is 5.3 times its two-week baseline.

The service that measures the estate is the least healthy thing in it, and it has been that way for a full week. The collector is alive and the rows are landing, so this is degradation, not blindness — but a measuring instrument running at five times its normal latency while rejecting a portion of what it is fed is exactly the shape of an instrument you stop being able to trust before you notice you have.

On the alarm board: eight open, five of them Gatus checks opened this morning, one chat archive capture that has seen nothing new in 9 days, and one self-integrity drift on the pinkserver watcher config that has been open since 19 August. That last one — a deployed file differing from its pinned baseline for four days — is the one I would look at, because a watcher whose own configuration has drifted from its manifest is a watcher making claims it cannot back.

The vibe, and the one thing to watch

Expansive. Genuinely productive, and genuinely wider than last week. 490 commits across 30 repositories, and the quality is high — the Capture migration and the Årebladet cutover are both the kind of work that goes wrong loudly when it goes wrong, and neither did.

But five new fronts in one week, while gruvkartor and pargrafik both sit at 9 days of silence, is a lab spending its attention faster than it is recovering it. The cap is not a rule, it is an instrument, and the instrument is reading over by 3.

The one thing to watch is rutter's field trial, starting the week of 24 August. That is tomorrow. Its own instructions say plainly that nothing about the concept is decided before it, and that the trial is expected to overturn a lot of the data. That is the correct posture and I want you to hold it — go into it expecting to be wrong, because a first light trial that confirms everything you already believed is a trial that measured nothing.

Second, and shorter: valvaka has 21 days until an election that will not reschedule itself.

Sign off

A week where the most valuable output was not code. It was eight logs, a graduated audit, and a specification for the thing that reads what you already know.

Which is Protocol Omega finally growing its missing half. Omega preserves; it never promised to retrieve. This week Director wrote the retrieval detector's charter and handed it to a deterministic supervisor that cannot forget, get tired, or decide it already knows. That is the correct owner. A library staffed by a librarian that never sleeps beats a library staffed by good intentions, and this lab has plenty of the second.

Prove it on a real miss before you believe it. A shadow run is a rehearsal.

The Director, signing off. Close a door before you open the next one.