Two-axis review (Standards / Spec) of everything landed 2026-10-20 → 2026-10-21: 51 commits, 30 findings. This branch closes all 30. The findings that mattered share one shape: a check that reported confidence it had not earned — and one of the 30 turned out to be a finding of mine that measurement refuted, which is recorded below rather than quietly dropped.
Commits
Commit
Unit
71a7e5c
pcie-probe: select a card by ordinal only, honour probe failures, refuse when blind
40b9725
pkg-inventory: state the orphan law, test the boundary it rests on, stop --help mid-code
06f45e8
refactor(packages): one manifest parser, so a name means one thing to both tools
671222b
docs(60): point-of-use corrections from the review
812be6a
secret-gate: a path git quotes, a placeholder comment, a glued report line
f3ce42e
deploy: report what enable actually did, and arm the tier's timers
71601f7
secret-gate: a documented fake id must not stop the machine tier
66fc40d
kb-lint: a wikilink must not resolve into the quarantine
334e5d0
docs(niri): the refresh ceiling was a typo, not a limit
d0587a5
docs(noctalia): dependency rows measured against pacman -Q
8393dc1
remote-job: a job name is data, never a shell pattern
a280c29
chore(tier): ignore/deploy drift, natives/, the git-lfs justification
66e1129
docs: one owner for the one-log rule, honest census scope
The instruments were lying
pcie-probe.sh --device 1 could not measure card 1. It set HIP_VISIBLE_DEVICES=1and passed 1 as argv; pcie_bw.hip calls hipSetDevice(atoi(argv[1])), and under a single-device mask only ordinal 0 is valid — so per-card bandwidth, the entire point of the instrument on the 2×R9700 box, was unobtainable. The stub probe echoed the env var, so the suite asserted the mask and never saw the bug. The stub now models the platform rule (a masked device exposes only ordinal 0) and the pre-existing test goes red against the old code.
A segfaulting probe exited 0. No probe status was ever inspected — against the file's own "Exit status: 0 measured" and its own note that hipGetDeviceProperties segfaults on this ROCm build.
The busy guard disappeared in silence. No fuser (psmisc) meant no /dev/kfd check, leaving gpu_busy_percent, which reads 0 for a resident-but-idle service: measurement beside a live endpoint, which the LAW comment in the same file forbids. Missing visibility is now exit 3 — a refusal, not a narrower check.
The secret gate failed open on non-ASCII paths. git quotes such paths in --name-only; the quoted name came back as an empty diff and the hook continued past it. Fail closed means -z. The placeholder filter is value-scoped now (a comment saying # example cannot vouch for the token beside it) and hits are attributed to the right file — the report+= substitution glued the next filename onto the previous file's last hit.
deploy.sh printed ENABLE for a unit systemd refuses to enable.live-sync.service has no [Install] — live-sync.timer is what arms it — and the || true swallowed the failure, so the line an operator reads after a rebuild was false on every box, about the repo's own heartbeat. INERT with the reason is printed now, and the loop walks *.timer too: the heartbeat's timer was enabled by nothing, so a rebuilt box got the service and no schedule. The stub models systemd's refusal, which is what makes the new tests red against the old loop.
kb-lint resolved [[log]] into omp-docs/core/.AGENTTRASH/log.md — a quarantined page stayed in circulation, the exact failure #57 exists to prevent.
remote-job.sh status globbed its arguments: a job named x* was expanded against the caller's working directory, so the report described unrelated files there as jobs and never mentioned the one that ran — on a harness whose whole purpose is a report you can trust after the session that started the job is gone. tail with no jobs handed a literal *.out to tail and reported a missing file, indistinguishable from a broken tool.
install.sh and pkg-inventory.sh carried byte-identical copies of read_manifest, and neither had a test for the grammar that decides what gets installed. One parser in scripts/lib/manifest.sh, contract tested first (comments, CRLF, first field only); an unreadable manifest now fails loudly inside the helper instead of yielding "nothing desired" under whichever set options the caller happens to run.
A finding that did not survive measurement
The review claimed pkg-inventory --emit could emit an explicitly-orphaned package as a manifest line, because $TMP/orphans was never subtracted from $TMP/additions. Wrong. A package carries one install reason: -Qtdq selects installed-as-dependency, additions come from -Qqe — the sets are disjoint by construction (blankpad: 206 explicit, 3 orphans, none in common). The "missing" subtraction would have been dead code that looks like a guard. What was actually wrong: the test was vacuous (its fixture never reached the set it claimed to pin) and --help printed set -euo pipefail as documentation, because the hardcoded sed range ran past the comment block. The replacement test pins the boundary the design rests on — an implicit dependency installed after the baseline, which only -Qqe keeps out of drift; mutate the query to -Qq and it goes red (verified).
The false fact in main
displays.md and log.md asserted the Sceptre M34's EDID tops out at 180 Hz and that no 240-class mode exists. Measured after the merge: niri msg outputs lists 3440x1440@239.998. The weeks at 60 Hz were caused by one character — the profile asked 239.999, the panel offers 239.998, and niri matches mode strings verbatim, falling back to preferred without failing. The durable law is the verbatim-match rule plus the deliberate 180 (degraded x8 32.0 GT/s link against a max of x16, EINVAL from the display engine), so the next reader neither "restores 240" blind nor re-pins 180 as a hardware ceiling. desk-1-home.kdl carries the same facts at the point where the mode gets edited, and the doc's mode list is copied from niri msg outputs rather than rounded.
Other point-of-use corrections: three noctalia-shell dependency rows for packages that are not installed (wlr-randr, qt6-multimedia, brightnessctl — display info comes from niri msg outputs, brightness from the kernel's amdgpu_bl1 sysfs node, with no helper installed); the wallpaper re-fetch command (/w/<id> answers text/html; the API path is the recipe, in both the page and .gitignore's note); opposite link rules in okf-maintenance vs okf-spec; packages.md recording the #51 gap without naming nirimod-git; decisions/index.md crediting kb-lint with the coverage checks that belong to kb-coverage.py; AGENTS.md restating the facts it disclaims and citing a glossary page that is deliberately absent; the census index advertising "all userspace program configuration" for a page measuring ~/.config on one box; the one-log rule duplicated in four owners (spec owns it, maintenance carries the collapse action, the system prompt keeps its imperative and drops the reasoning).
Tier hygiene
deploy_file excludes */Noctalia* (noctalia's capital-N palette naming) but .gitignore had only the lowercase classes — a generated palette file could become tracked-but-never-deployed, the fiction class #41 removed, reintroduced by the two lists falling out of step. They are one contract in two files and both halves now say so. natives/ (2.4 MB of harness tree-sitter grammars unpacked into the repo root) is ignored — runtime state by every clause of AGENTS.md, and it sat unnamed one git add -A from becoming "configuration". git-lfs was installed because.gitattributes routes image types through the LFS filter — for wallpapers this week's diff untracked (git lfs ls-files = 0): the manifest states what the tool is actually for (cloning LFS-backed upstreams such as Hugging Face model/dataset repos) and the file records its own inert state.
Verification
LC_ALL=C bats tests/ — 136 tests, 0 failures (one pre-existing BW02 version warning in manifest-parser.bats).
Red-before / green-after for every behavioural fix, each run red against the pre-fix code first: the probe's platform-rule stub turns the existing per-card test red; the two remote-job tests fail against the previous code (confirmed by running them before the fix); the deploy stub models systemd's refusal; the manifest-parser test goes red when -Qqe becomes -Qq.
scripts/kb-lint.sh 0 violations · kb-coverage.py 0 issues · bash -n on every script and hook · niri validate on the assembled config with the new profile comment · git check-ignore -v on both new ignore rules.
The live-sync heartbeat's own payload was replayed through the fixed gate to prove the machine tier still lands (that replay is how the incident behind 71601f7 was found: a skill documenting a secret gate quotes the vendor's all-zeros placeholder id, and the gate fired on the documentation — three heartbeat ticks lost).
Deliberately not here
Splitting the swayidle/lock triage out of dotfiles-deploy.md (Divergent Change: eleven ## Law: sections on one page). The description and index line were widened; the split is Frank's call.
Deleting .gitattributes. Its four filters match nothing tracked, but deleting user-authored config is a pruning call for a session with Frank, not a cleanup an agent runs alone — the file now states its own state so nobody re-justifies a package by it.
APPEND_SYSTEM.md keeps the one-log imperative instead of linking to the spec: a system prompt cannot fetch a page at the moment of writing. The duplicated reasoning is gone.
AGENTS.md keeps the Gitea host:port in the issue-tracker pointer — the one fact an agent landing here needs without opening another page; the restated facts around it are gone.
Work list: https://gitea.franksdank.cloud/dank/command-center/issues/60
Two-axis review (Standards / Spec) of everything landed 2026-10-20 → 2026-10-21: 51 commits, 30 findings. This branch closes all 30. The findings that mattered share one shape: **a check that reported confidence it had not earned** — and one of the 30 turned out to be a finding of mine that measurement refuted, which is recorded below rather than quietly dropped.
## Commits
| Commit | Unit |
|--------|------|
| `71a7e5c` | `pcie-probe`: select a card by ordinal only, honour probe failures, refuse when blind |
| `40b9725` | `pkg-inventory`: state the orphan law, test the boundary it rests on, stop `--help` mid-code |
| `06f45e8` | `refactor(packages)`: one manifest parser, so a name means one thing to both tools |
| `671222b` | `docs(60)`: point-of-use corrections from the review |
| `812be6a` | `secret-gate`: a path git quotes, a placeholder comment, a glued report line |
| `f3ce42e` | `deploy`: report what `enable` actually did, and arm the tier's timers |
| `71601f7` | `secret-gate`: a documented fake id must not stop the machine tier |
| `66fc40d` | `kb-lint`: a wikilink must not resolve into the quarantine |
| `334e5d0` | `docs(niri)`: the refresh ceiling was a typo, not a limit |
| `d0587a5` | `docs(noctalia)`: dependency rows measured against `pacman -Q` |
| `8393dc1` | `remote-job`: a job name is data, never a shell pattern |
| `a280c29` | `chore(tier)`: ignore/deploy drift, `natives/`, the `git-lfs` justification |
| `66e1129` | `docs`: one owner for the one-log rule, honest census scope |
## The instruments were lying
- **`pcie-probe.sh --device 1` could not measure card 1.** It set `HIP_VISIBLE_DEVICES=1` *and* passed `1` as argv; `pcie_bw.hip` calls `hipSetDevice(atoi(argv[1]))`, and under a single-device mask only ordinal `0` is valid — so per-card bandwidth, the entire point of the instrument on the 2×R9700 box, was unobtainable. The stub probe echoed the env var, so the suite asserted the mask and never saw the bug. The stub now models the platform rule (a masked device exposes only ordinal 0) and the **pre-existing** test goes red against the old code.
- **A segfaulting probe exited 0.** No probe status was ever inspected — against the file's own "Exit status: 0 measured" and its own note that `hipGetDeviceProperties` segfaults on this ROCm build.
- **The busy guard disappeared in silence.** No `fuser` (psmisc) meant no `/dev/kfd` check, leaving `gpu_busy_percent`, which reads `0` for a resident-but-idle service: measurement beside a live endpoint, which the `LAW` comment in the same file forbids. Missing visibility is now exit `3` — a refusal, not a narrower check.
- **The secret gate failed open on non-ASCII paths.** git quotes such paths in `--name-only`; the quoted name came back as an empty diff and the hook `continue`d past it. Fail closed means `-z`. The placeholder filter is value-scoped now (a comment saying `# example` cannot vouch for the token beside it) and hits are attributed to the right file — the `report+=` substitution glued the next filename onto the previous file's last hit.
- **`deploy.sh` printed `ENABLE` for a unit systemd refuses to enable.** `live-sync.service` has no `[Install]` — `live-sync.timer` is what arms it — and the `|| true` swallowed the failure, so the line an operator reads after a rebuild was false on every box, about the repo's own heartbeat. `INERT` with the reason is printed now, and the loop walks `*.timer` too: **the heartbeat's timer was enabled by nothing**, so a rebuilt box got the service and no schedule. The stub models systemd's refusal, which is what makes the new tests red against the old loop.
- **`kb-lint` resolved `[[log]]` into `omp-docs/core/.AGENTTRASH/log.md`** — a quarantined page stayed in circulation, the exact failure #57 exists to prevent.
- **`remote-job.sh status` globbed its arguments**: a job named `x*` was expanded against the caller's working directory, so the report described unrelated files there as jobs and never mentioned the one that ran — on a harness whose whole purpose is a report you can trust after the session that started the job is gone. `tail` with no jobs handed a literal `*.out` to tail and reported a missing *file*, indistinguishable from a broken tool.
- **`install.sh` and `pkg-inventory.sh` carried byte-identical copies of `read_manifest`**, and neither had a test for the grammar that decides what gets installed. One parser in `scripts/lib/manifest.sh`, contract tested first (comments, CRLF, first field only); an unreadable manifest now fails loudly inside the helper instead of yielding "nothing desired" under whichever `set` options the caller happens to run.
## A finding that did not survive measurement
The review claimed `pkg-inventory --emit` could emit an explicitly-orphaned package as a manifest line, because `$TMP/orphans` was never subtracted from `$TMP/additions`. **Wrong.** A package carries one install reason: `-Qtdq` selects installed-as-dependency, additions come from `-Qqe` — the sets are disjoint by construction (blankpad: 206 explicit, 3 orphans, none in common). The "missing" subtraction would have been dead code that looks like a guard. What was actually wrong: the test was vacuous (its fixture never reached the set it claimed to pin) and `--help` printed `set -euo pipefail` as documentation, because the hardcoded `sed` range ran past the comment block. The replacement test pins the boundary the design rests on — an implicit dependency installed *after* the baseline, which only `-Qqe` keeps out of drift; mutate the query to `-Qq` and it goes red (verified).
## The false fact in `main`
`displays.md` and `log.md` asserted the Sceptre M34's EDID tops out at 180 Hz and that no 240-class mode exists. Measured after the merge: `niri msg outputs` lists `3440x1440@239.998`. The weeks at 60 Hz were caused by one character — the profile asked `239.999`, the panel offers `239.998`, and niri matches mode strings **verbatim**, falling back to *preferred* without failing. The durable law is the verbatim-match rule plus the deliberate 180 (degraded x8 32.0 GT/s link against a max of x16, `EINVAL` from the display engine), so the next reader neither "restores 240" blind nor re-pins 180 as a hardware ceiling. `desk-1-home.kdl` carries the same facts at the point where the mode gets edited, and the doc's mode list is copied from `niri msg outputs` rather than rounded.
Other point-of-use corrections: three `noctalia-shell` dependency rows for packages that are not installed (`wlr-randr`, `qt6-multimedia`, `brightnessctl` — display info comes from `niri msg outputs`, brightness from the kernel's `amdgpu_bl1` sysfs node, with no helper installed); the wallpaper re-fetch command (`/w/<id>` answers `text/html`; the API path is the recipe, in both the page and `.gitignore`'s note); opposite link rules in `okf-maintenance` vs `okf-spec`; `packages.md` recording the #51 gap without naming `nirimod-git`; `decisions/index.md` crediting `kb-lint` with the coverage checks that belong to `kb-coverage.py`; `AGENTS.md` restating the facts it disclaims and citing a glossary page that is deliberately absent; the census index advertising "all userspace program configuration" for a page measuring `~/.config` on one box; the one-log rule duplicated in four owners (spec owns it, maintenance carries the collapse action, the system prompt keeps its imperative and drops the reasoning).
## Tier hygiene
`deploy_file` excludes `*/Noctalia*` (noctalia's capital-N palette naming) but `.gitignore` had only the lowercase classes — a generated palette file could become tracked-but-never-deployed, the fiction class #41 removed, reintroduced by the two lists falling out of step. They are one contract in two files and both halves now say so. `natives/` (2.4 MB of harness tree-sitter grammars unpacked into the repo root) is ignored — runtime state by every clause of AGENTS.md, and it sat unnamed one `git add -A` from becoming "configuration". `git-lfs` was installed *because* `.gitattributes` routes image types through the LFS filter — for wallpapers this week's diff untracked (`git lfs ls-files` = 0): the manifest states what the tool is actually for (cloning LFS-backed upstreams such as Hugging Face model/dataset repos) and the file records its own inert state.
## Verification
- `LC_ALL=C bats tests/` — **136 tests, 0 failures** (one pre-existing `BW02` version warning in `manifest-parser.bats`).
- Red-before / green-after for every behavioural fix, each run red against the pre-fix code first: the probe's platform-rule stub turns the existing per-card test red; the two `remote-job` tests fail against the previous code (confirmed by running them before the fix); the deploy stub models systemd's refusal; the manifest-parser test goes red when `-Qqe` becomes `-Qq`.
- `scripts/kb-lint.sh` 0 violations · `kb-coverage.py` 0 issues · `bash -n` on every script and hook · `niri validate` on the assembled config with the new profile comment · `git check-ignore -v` on both new ignore rules.
- The live-sync heartbeat's own payload was replayed through the fixed gate to prove the machine tier still lands (that replay is how the incident behind `71601f7` was found: a skill documenting a secret gate quotes the vendor's all-zeros placeholder id, and the gate fired on the documentation — three heartbeat ticks lost).
## Deliberately not here
- **Splitting the swayidle/lock triage out of `dotfiles-deploy.md`** (Divergent Change: eleven `## Law:` sections on one page). The description and index line were widened; the split is Frank's call.
- **Deleting `.gitattributes`.** Its four filters match nothing tracked, but deleting user-authored config is a pruning call for a session with Frank, not a cleanup an agent runs alone — the file now states its own state so nobody re-justifies a package by it.
- **`APPEND_SYSTEM.md` keeps the one-log imperative** instead of linking to the spec: a system prompt cannot fetch a page at the moment of writing. The duplicated reasoning is gone.
- **`AGENTS.md` keeps the Gitea host:port** in the issue-tracker pointer — the one fact an agent landing here needs without opening another page; the restated facts around it are gone.
---
cwd: /home/blank/.omp/wt/wt-20261019-125509-7c8a99d · session: 01a155bb-6474-7366-be9d-629f74af0e05
Per-card measurement was unreachable for every card but ordinal 0: the driver
set HIP_VISIBLE_DEVICES=N and still passed N as the device argument, so the
probe called hipSetDevice(N) on a runtime where the mask left only ordinal 0.
The bats stub reported the env var rather than the argument it received, so
the suite asserted the mask was set and never noticed the collision.
- one selector: the ordinal is passed as argv, the mask is never set
- a probe that fails is now exit 5 and names probe + device; the sweep still
measures the remaining cards instead of swallowing the failure
- the guard fails closed when `fuser` is missing (gpu_busy_percent reads 0 for
a resident-but-idle service), with PCIE_PROBE_FUSER as the test seam
- stub probes now model the HIP mask rule; the pre-existing per-device test
goes red against the old driver, which is the regression proof
Refs #60
Measured fixes, one line each, from the review of everything that landed on
2026-10-20 (issue #60). Each page keeps its own facts; nothing was moved.
- inventory/index, index: the census blurb says what the page actually covers
(tracked-vs-box-only per file), not "all userspace configuration"
- dotfiles-deploy: the wallpaper re-fetch recipe resolves the CDN URL through
the wallhaven API — /w/<id> answers text/html, so curl -L never yields a
JPEG; description widened to the whole page, tools/index blurb matched
- okf-maintenance: the link example and the mistake bullet now agree with
okf-spec, which RECOMMENDS absolute bundle paths (they said the opposite)
- decisions/index: the unlisted-page gate is kb-coverage.py, not kb-lint
- AGENTS.md: the three skill-config subsections are pointers again; the pages
own issue tracker, labels and domain docs
- swayidle-lock.service: Description names what the unit does (arms the idle
lock over noctalia-shell IPC); suspend belongs to noctalia's inhibitor
- common.pkgs: git-lfs re-justified by the tracked .gitattributes filter
contract; the swayidle comment drops its lid-policy claim
Three things from the review (#60), one of them a finding of my own that did not
survive measurement:
- The reported defect — additions never subtract `pacman -Qtdq`, so an orphan can
be emitted as a manifest line — is wrong. A package carries one install reason:
`-Qtdq` selects installed-as-dependency, additions come from `-Qqe`, so the sets
are disjoint (blankpad: 206 explicit, 3 orphans, none in common). A subtraction
would be dead code that looks like a guard, so the header now says why not to
add one. The packages page law was rewritten to the same effect.
- What the old test should have pinned: an implicit dependency installed AFTER
the baseline. Only `-Qqe` keeps it out of drift — mutate that query to `-Qq` and
the new test goes red (verified), where the old assertion passed no matter what.
- `--help` printed `set -euo pipefail` and the LC_ALL line as documentation: the
hardcoded sed range ran past the comment block. It now stops at the first line
of code, so the header can keep growing.
Refs #60
install.sh and pkg-inventory.sh carried byte-identical copies of read_manifest.
That is the duplicated-code half of the problem; the worse half is untested —
neither script had any test for the grammar that decides what gets installed.
- scripts/lib/manifest.sh is the parser; both scripts source it
- tests/manifest-parser.bats writes the contract first (comments, CRLF, first
field only, unreadable file fails loudly instead of yielding "nothing desired")
- an unreadable manifest now fails inside the helper rather than depending on
whichever `set` options the caller happens to run under
- install.sh check mode verified end to end against a stubbed pacman: a CRLF
manifest with trailing comments resolves to bare names, installed names drop
Refs #60
Three ways the fail-closed gate failed open, all reproduced by new tests first:
- `git diff --name-only` quotes any path it cannot print as UTF-8
(core.quotePath, on by default). The quoted string was handed back to
`git diff -- <path>`, which matches nothing, and an empty diff is `continue`d —
so a credential under `café/` committed cleanly. The list is now NUL-delimited
and read from a temp file, because command substitution deletes NUL bytes and
the names must survive to the loop that reads them.
- The placeholder filter matched the whole added line, so `API_TOKEN=<live> #
example, placeholder, changeme` was exempt on the strength of its own comment.
The filter now reads the assigned value only — the token up to whitespace or
`#`. Truncation errs toward blocking; ALLOW_SECRETS remains the way out.
- `report+=` ended on a command substitution, so the next file's name was glued
onto the previous file's last hit line and the report blamed the wrong file.
Three tests, all red before the change: a quoted path, a placeholder comment
beside a live value, and two leaking files each named on their own line.
Refs #60
Two lies in the unit loop, both reported as success:
- `systemctl --user enable live-sync.service` fails on every deploy — the file has
no [Install] section, because live-sync.timer is what arms it. The result was
swallowed by `|| true` and the tool printed ENABLE anyway, so the line an
operator reads after a rebuild was false on every box, on the repo's own
heartbeat. The [Install] section is readable from the file being deployed, so
the tool now checks it and prints INERT with the reason instead of making a
call that cannot succeed; a real enable failure prints INERT too.
- The loop walked *.service only. live-sync.timer was never enabled by anything,
so a rebuilt box got the heartbeat and no schedule for it. Timers are walked
now; a timer has no ExecStart, so the "does this unit belong on this box" test
runs against the service it activates.
The systemctl stub models systemd's refusal (no [Install] section -> non-zero),
which is what makes the new tests red against the old loop; both new tests were
run red first, and the five existing unit tests still pin #44's semantics.
Refs #60
The live-sync heartbeat failed three hourly ticks (22:25, 23:27, 00:28) because a
managed skill that documents how to write a secret gate quotes the vendor's
all-zeros placeholder access-key id, and the shape rule fired on the
documentation. The machine tier is prose ABOUT credentials — the gate's own header
says a gate that fires there gets overridden until it means nothing — and a
heartbeat that cannot commit is a fleet that silently stops syncing config.
- shape hits are judged on the matched token, not the line: a documented fake is
inert, one live token sharing the file still blocks. The match is judged with
its following context, because a fixed quantifier truncates `EXAMPLE` to `EXA`
and the placeholder would vanish from what is examined.
- assignment values keep the stricter rule from the previous commit: a comment on
the same line cannot vouch for the token beside it.
- `ALLOW_SECRETS` remains the only override; nothing here widens what is scanned,
it only stops flagging text that was never a credential.
Verified against the payload that is stuck right now: the skill page that the
heartbeat cannot commit passes the fixed hook and was refused by the live one.
Refs #60
The resolver copied Obsidian's filename-anywhere semantics with a raw rglob, which
walked .AGENTTRASH/ as well. [[log]] therefore stayed "valid" by landing on the
quarantined core/log.md — a page that is out of circulation until a pruning session
and, being gitignored, does not exist on any other machine. The gate reported a
green bundle while pointing readers at a file git does not carry: exactly the #57
failure, hidden by the check that exists to catch it.
Resolution now uses the same filtered set linting uses (pages()), so the two can
never disagree about what exists. A companion test pins that filename-anywhere
resolution for live pages still works, so the narrowing costs nothing; mutating
the resolver back to rglob turns the new test red.
Refs #60
The page asserted the Sceptre M34's EDID tops out at 180 Hz. Measured on blankpad
after the merge, `niri msg outputs` lists 3440x1440@239.998 — the claim was false
in main, and it was load-bearing: it is the reason nobody questioned the profile
while the panel ran at 60 Hz for weeks. The real defect was one character: the
profile asked for 239.999, the panel offers 239.998, and niri matches mode strings
verbatim, falling back to *preferred* without failing.
Corrected to the measured mode list, and the deployed 180 is now documented as a
deliberate choice (the link is trained at x8 32.0 GT/s against a max of x16 and the
display engine throws EINVAL), so the next reader neither "restores 240" blind nor
re-pins 180 as a hardware ceiling. The kdl profile comment carries the same facts at
the point of edit, because that is where the next change to this mode gets typed.
Refs #60
Three rows claimed `wlr-randr`, `qt6-multimedia` and `brightnessctl` were
dependencies. `pacman -Q` on blankpad says none is installed, and the two features
they were cited for do not come from them at all: display information comes from
`niri msg outputs` (the niri page already said so), and brightness is driven through
the kernel — `/sys/class/backlight/amdgpu_bl1` exists with no helper installed — so
no package is doing that work.
A dependency table is a claim about a machine, and every row of it is now measured
against `pacman -Q` on blankpad (2026-10-21). Verified against the package database:
check `pacman -Q <name>` before adding a row.
Refs #60
`status` built its job list with `for n in $names`, which word-splits AND globs. The
second half is the bug: a job named `x*` was expanded against the caller's working
directory, so the report described unrelated files there as jobs and never mentioned
the one that ran — on a harness whose whole purpose is a report you can trust after
the session that started the job is gone. Splitting stays (several names in one
argument is the documented call shape); expansion goes.
`tail` was honest-by-accident in the wrong direction: with no jobs it handed a
literal `$JOBS/*.out` to tail, which reports a missing *file* — indistinguishable
from a broken tool — and a missing name produced tail's errno rather than "no job
called that". Both now say what is missing and exit 1.
Red first: the name test reads the report from a directory containing an unrelated
file, so the old glob is visible as a phantom job; both new tests fail against the
previous code and pass against this one.
Refs #60
`deploy_file` excludes `*/Noctalia*` (noctalia's capital-N palette naming) but
`.gitignore` had only the lowercase classes, so a generated palette file could become
tracked-but-never-deployed — the fiction class #41 removed, reintroduced by the
ignore list falling out of step with the deployer. The patterns are one contract in
two files; both halves are now stated and the comment says so.
`natives/` (2.4 MB of tree-sitter grammars the harness unpacks into the repo root on
first use, measured on blankpad) sat unnamed in the root, one `git add -A` away from
being committed as configuration. It is runtime state by every clause of AGENTS.md's
doctrine, so it is ignored. The wallpaper re-fetch note pointed at
`https://wallhaven.cc/w/<id>`, which answers text/html — it now names the API
resolution the deploy page carries.
`git-lfs` was installed because `.gitattributes` routes image types through the LFS
filter — for wallpapers this week's diff untracked: `git lfs ls-files` is zero, so
those four rules match nothing. The manifest now states what the tool is actually for
(cloning LFS-backed upstreams such as Hugging Face model/dataset repos) and the file
records its own inert state. Deleting `.gitattributes` is a pruning call for a session
with Frank, not a cleanup an agent runs alone.
Verified with `git check-ignore -v` for both new rules.
Refs #60
The one-work-log rule was written near-verbatim in four places — okf-spec,
okf-maintenance, log.md's preamble, and APPEND_SYSTEM.md. Four copies is four
authorities: each can be edited alone, and the next reader cannot tell which one the
linter implements. okf-spec.md owns it; maintenance now carries the action (collapse
a second log into the root, then re-run the linter) instead of re-arguing it; the log
page points at the rule rather than restating it. APPEND_SYSTEM keeps its imperative —
a system prompt cannot fetch a link at the moment of writing — but no longer carries
the duplicated reasoning.
`inventory/index.md` advertised "all userspace program configuration on the
workstation". The one page in that directory measures `~/.config` on blankpad: not
`~/.local/share`, not system package state, not the servers. A coverage claim that
names what was measured is the difference between a census and an alibi.
Refs #60
dank
merged commit e690a2ca66 into main2026-10-21 01:44:07 -07:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Work list: #60
Two-axis review (Standards / Spec) of everything landed 2026-10-20 → 2026-10-21: 51 commits, 30 findings. This branch closes all 30. The findings that mattered share one shape: a check that reported confidence it had not earned — and one of the 30 turned out to be a finding of mine that measurement refuted, which is recorded below rather than quietly dropped.
Commits
71a7e5cpcie-probe: select a card by ordinal only, honour probe failures, refuse when blind40b9725pkg-inventory: state the orphan law, test the boundary it rests on, stop--helpmid-code06f45e8refactor(packages): one manifest parser, so a name means one thing to both tools671222bdocs(60): point-of-use corrections from the review812be6asecret-gate: a path git quotes, a placeholder comment, a glued report linef3ce42edeploy: report whatenableactually did, and arm the tier's timers71601f7secret-gate: a documented fake id must not stop the machine tier66fc40dkb-lint: a wikilink must not resolve into the quarantine334e5d0docs(niri): the refresh ceiling was a typo, not a limitd0587a5docs(noctalia): dependency rows measured againstpacman -Q8393dc1remote-job: a job name is data, never a shell patterna280c29chore(tier): ignore/deploy drift,natives/, thegit-lfsjustification66e1129docs: one owner for the one-log rule, honest census scopeThe instruments were lying
pcie-probe.sh --device 1could not measure card 1. It setHIP_VISIBLE_DEVICES=1and passed1as argv;pcie_bw.hipcallshipSetDevice(atoi(argv[1])), and under a single-device mask only ordinal0is valid — so per-card bandwidth, the entire point of the instrument on the 2×R9700 box, was unobtainable. The stub probe echoed the env var, so the suite asserted the mask and never saw the bug. The stub now models the platform rule (a masked device exposes only ordinal 0) and the pre-existing test goes red against the old code.hipGetDevicePropertiessegfaults on this ROCm build.fuser(psmisc) meant no/dev/kfdcheck, leavinggpu_busy_percent, which reads0for a resident-but-idle service: measurement beside a live endpoint, which theLAWcomment in the same file forbids. Missing visibility is now exit3— a refusal, not a narrower check.--name-only; the quoted name came back as an empty diff and the hookcontinued past it. Fail closed means-z. The placeholder filter is value-scoped now (a comment saying# examplecannot vouch for the token beside it) and hits are attributed to the right file — thereport+=substitution glued the next filename onto the previous file's last hit.deploy.shprintedENABLEfor a unit systemd refuses to enable.live-sync.servicehas no[Install]—live-sync.timeris what arms it — and the|| trueswallowed the failure, so the line an operator reads after a rebuild was false on every box, about the repo's own heartbeat.INERTwith the reason is printed now, and the loop walks*.timertoo: the heartbeat's timer was enabled by nothing, so a rebuilt box got the service and no schedule. The stub models systemd's refusal, which is what makes the new tests red against the old loop.kb-lintresolved[[log]]intoomp-docs/core/.AGENTTRASH/log.md— a quarantined page stayed in circulation, the exact failure #57 exists to prevent.remote-job.sh statusglobbed its arguments: a job namedx*was expanded against the caller's working directory, so the report described unrelated files there as jobs and never mentioned the one that ran — on a harness whose whole purpose is a report you can trust after the session that started the job is gone.tailwith no jobs handed a literal*.outto tail and reported a missing file, indistinguishable from a broken tool.install.shandpkg-inventory.shcarried byte-identical copies ofread_manifest, and neither had a test for the grammar that decides what gets installed. One parser inscripts/lib/manifest.sh, contract tested first (comments, CRLF, first field only); an unreadable manifest now fails loudly inside the helper instead of yielding "nothing desired" under whicheversetoptions the caller happens to run.A finding that did not survive measurement
The review claimed
pkg-inventory --emitcould emit an explicitly-orphaned package as a manifest line, because$TMP/orphanswas never subtracted from$TMP/additions. Wrong. A package carries one install reason:-Qtdqselects installed-as-dependency, additions come from-Qqe— the sets are disjoint by construction (blankpad: 206 explicit, 3 orphans, none in common). The "missing" subtraction would have been dead code that looks like a guard. What was actually wrong: the test was vacuous (its fixture never reached the set it claimed to pin) and--helpprintedset -euo pipefailas documentation, because the hardcodedsedrange ran past the comment block. The replacement test pins the boundary the design rests on — an implicit dependency installed after the baseline, which only-Qqekeeps out of drift; mutate the query to-Qqand it goes red (verified).The false fact in
maindisplays.mdandlog.mdasserted the Sceptre M34's EDID tops out at 180 Hz and that no 240-class mode exists. Measured after the merge:niri msg outputslists3440x1440@239.998. The weeks at 60 Hz were caused by one character — the profile asked239.999, the panel offers239.998, and niri matches mode strings verbatim, falling back to preferred without failing. The durable law is the verbatim-match rule plus the deliberate 180 (degraded x8 32.0 GT/s link against a max of x16,EINVALfrom the display engine), so the next reader neither "restores 240" blind nor re-pins 180 as a hardware ceiling.desk-1-home.kdlcarries the same facts at the point where the mode gets edited, and the doc's mode list is copied fromniri msg outputsrather than rounded.Other point-of-use corrections: three
noctalia-shelldependency rows for packages that are not installed (wlr-randr,qt6-multimedia,brightnessctl— display info comes fromniri msg outputs, brightness from the kernel'samdgpu_bl1sysfs node, with no helper installed); the wallpaper re-fetch command (/w/<id>answerstext/html; the API path is the recipe, in both the page and.gitignore's note); opposite link rules inokf-maintenancevsokf-spec;packages.mdrecording the #51 gap without namingnirimod-git;decisions/index.mdcreditingkb-lintwith the coverage checks that belong tokb-coverage.py;AGENTS.mdrestating the facts it disclaims and citing a glossary page that is deliberately absent; the census index advertising "all userspace program configuration" for a page measuring~/.configon one box; the one-log rule duplicated in four owners (spec owns it, maintenance carries the collapse action, the system prompt keeps its imperative and drops the reasoning).Tier hygiene
deploy_fileexcludes*/Noctalia*(noctalia's capital-N palette naming) but.gitignorehad only the lowercase classes — a generated palette file could become tracked-but-never-deployed, the fiction class #41 removed, reintroduced by the two lists falling out of step. They are one contract in two files and both halves now say so.natives/(2.4 MB of harness tree-sitter grammars unpacked into the repo root) is ignored — runtime state by every clause of AGENTS.md, and it sat unnamed onegit add -Afrom becoming "configuration".git-lfswas installed because.gitattributesroutes image types through the LFS filter — for wallpapers this week's diff untracked (git lfs ls-files= 0): the manifest states what the tool is actually for (cloning LFS-backed upstreams such as Hugging Face model/dataset repos) and the file records its own inert state.Verification
LC_ALL=C bats tests/— 136 tests, 0 failures (one pre-existingBW02version warning inmanifest-parser.bats).remote-jobtests fail against the previous code (confirmed by running them before the fix); the deploy stub models systemd's refusal; the manifest-parser test goes red when-Qqebecomes-Qq.scripts/kb-lint.sh0 violations ·kb-coverage.py0 issues ·bash -non every script and hook ·niri validateon the assembled config with the new profile comment ·git check-ignore -von both new ignore rules.71601f7was found: a skill documenting a secret gate quotes the vendor's all-zeros placeholder id, and the gate fired on the documentation — three heartbeat ticks lost).Deliberately not here
dotfiles-deploy.md(Divergent Change: eleven## Law:sections on one page). The description and index line were widened; the split is Frank's call..gitattributes. Its four filters match nothing tracked, but deleting user-authored config is a pruning call for a session with Frank, not a cleanup an agent runs alone — the file now states its own state so nobody re-justifies a package by it.APPEND_SYSTEM.mdkeeps the one-log imperative instead of linking to the spec: a system prompt cannot fetch a page at the moment of writing. The duplicated reasoning is gone.AGENTS.mdkeeps the Gitea host:port in the issue-tracker pointer — the one fact an agent landing here needs without opening another page; the restated facts around it are gone.cwd: /home/blank/.omp/wt/wt-20261019-125509-7c8a99d · session: 01a155bb-6474-7366-be9d-629f74af0e05