What was actually wrong
A week of diagnosis, three wrong conclusions, and one shape underneath all of them. The estate was healthier than reported and broken in narrower, older ways than anyone had found. This supersedes the 8 August map, which is wrong in several places and should not be relied on.
Start here
Three wrong diagnoses, one error
| Claimed | Actually | Disproved by |
|---|---|---|
| "The Tower has been down since 8 Aug" | Never down. context-push ran throughout. |
GET /status — hub.lastContact 11 minutes old |
| "The Goose job plane died" | Also running. It posted 156 calendar events and committed an agenda update the same day. | calendar_events_freshness |
| "The vault has been silent for five days" | 670 commits since 8 August, 60 of them that morning. | git log origin/main |
"The vault's last commit is 2026-08-08 07:30" was true of the session's local clone, made when its container started, and false of the vault. Every downstream conclusion — a dead miss log, a broken measurement gate, five lost nights — inherited that single unchecked assumption and none of it was true.
A stale read of a moving system, reported with the confidence of a live one. Which is the same failure the estate keeps committing against itself, arrived at from the other side.
The thing everything was gated on
The miss log has its answer
It never stopped. Nine of ten nights answered; 4 August is the only genuine gap. Recovered from Git history after the working copies were deleted (see below).
| Night | Miss |
|---|---|
| 3 Aug | CE Plus cert expired Saturday; Bruno's remediation email ~5d old, unanswered |
| 4 Aug | genuinely absent — the one real gap |
| 5 Aug | None. |
| 6 Aug | None. |
| 7 Aug | Schema migration due 10 Aug, urgent and unassigned, no owner into the weekend |
| 8 Aug | None. |
| 9 Aug | Payment module review flagged "must be done today" — no completion, never re-surfaced |
| 10 Aug | NZ deadline last safe window — not pushed at the start of the day by any channel |
| 11 Aug | Bruno's two Slack threads sitting in Needs Response all week, never surfaced |
| 12 Aug | None. |
Five real misses in ten nights. The measurement spec set the condition plainly: "if two weeks of misses come back empty, the rest of this should not be built." They did not come back empty.
And they share a shape. Not unanswered messages — the axis the board was built on and the reframe already rejected. They are things surfaced once and never raised again, and things that arrived while he was heads-down. That is the demand-on-time model, evidenced rather than argued.
What was genuinely broken
Two faults, both invisible
1. The agenda signal has been dead for 27 days
signal:agenda last updated 17 July 17:08 UTC — 161× its own
four-hour TTL. Meanwhile calendar-sync demonstrably runs: 156 rows in
calendar_events out to 27 August, and an agenda update (77 events)
committed to the vault the same morning.
So the same job's output reaches D1 and does not reach KV. A shipper fault in
context-push, not a producer fault — and the composer's availability input has
been a month stale without anything noticing, because signalsHealth() computed
fresh = ANY and one survivor was always enough.
2. A vault backup wiped 192 files
Commit f78b1bc, 13 August 06:21, message "vault backup", removed
~190 files in one go: five skills (reflect, harden,
journal, escalate, week-visual), the entire
System/ tree, 28 daily notes and weekly reviews, 31 meeting transcripts, 12 Claude
conversations, the July journal. Sixty commits landed after it and nothing restored them.
Consistent with an Obsidian install syncing a partial vault, whose backup job then committed
every absent file as a deletion. Nothing was lost — the retention policy's
promise that Git history is the archive held exactly as written. But the working tree is what
Obsidian and the jobs read, and eod-reflect executes reflect/SKILL.md
by path. Restored.
The through-line
Every one of these is an aggregate hiding its members
fresh = ANY— one live producer reports four healthy for 27 days.max(ts)— the newest signal conceals the oldest.viewrecords/— every surface collapses into one route.push_sentwritten before fan-out — intent indistinguishable from delivery.- A stale clone read as a live system — one timestamp standing in for a moving repository.
The last of those is mine, not the estate's, and it is the same error: a single summary trusted in place of the thing it summarised. The fix is identical in every case — report the members, not the roll-up. That is what the per-producer witness now does, and it is the one design rule worth carrying into everything downstream.
Shipped 13 August
What changed
| Change | Why |
|---|---|
| Per-producer witness | Names which signal died and for how long. The first version asked the collapsed health check and stayed silent through the outage it was built for. |
| CI on pull requests | 1,187 tests existed and none gated a merge, while merge is the deploy. Review from a phone was shipping unverified code. |
| Measurement layer finished | Board reads recorded, acted written, push_sent counts real deliveries, nudgeId threaded where a ledger row genuinely exists. |
| Migrations + diagnostics from a phone | Both previously required wrangler --remote from a laptop. This is what found everything above. |
| Reminder pushes coalesced | One digest per tick instead of one push per reminder, against 139 pushes / 11 opens / 0 taps. |
| Unwired-job guard | Static check that every cron module is actually dispatched. Verified to fail on a deliberately unwired probe. |
Still open
What is not done
- The
context-pushagenda shipper — 27 days dead, now visible, not yet fixed. - Runtime self-update — merged and inert.
mallory-runtimestill cannot pull itself, which is the bug it fixes; it needs one bootstrap on the Tower. - Notification mute from a phone — scoped, not built. Reminder categories are configurable in KV but not yet reachable without
wrangler. - 4 August — the one night the miss log genuinely produced nothing, still unexplained.
- The gate decision itself — the evidence is in and it is not empty. That call is Alex's.
design.mallory.chat/reviews/briefings · 2026-08-13 · supersedes the 2026-08-08 estate map.