A generated See Also pass left `- ](index.md)` style links on the gitea pages, tools/cachyos.md,
and tools/applications.md. Rendered, an empty-text link is a bullet with nothing clickable in it,
so it reads as a formatting quirk and never as the broken reference it is. All five now name the
page they point at and use the absolute bundle path the spec recommends; the grep that finds them
is recorded in the log so the sweep is repeatable.
Refs #64
The day had three `## 2026-10-21` headings — three logs wearing one date, which is the sprawl the
spec's one-dated-section rule exists to prevent. One date now, one `###` per campaign. `okf-maintenance.md`
states the multi-campaign shape explicitly so nobody has to infer it, and names `AGENTS.md` as the
co-owner of the entry law so an editor changes both.
The new entry records what the dedupe sweep actually taught: an index that restates its own
reference pages becomes the stale authority, and a subagent ledger is a claim until it is re-read
against the file it accuses — most rows returned by the audit fan-out were checkably false, and
half the ledgers never arrived at all. `skills/ecosystem.md` gains the `resource:` frontmatter the
bundle's other externally-sourced pages carry.
Refs #64
The intro carried "388 engine entries" from a 2026-10-19 probe; upstream is at 385 today. The
number moves every week, which makes a precise one a liability in a runbook. The page now states
the size class, names `/config` as the only authority for what an instance loads, and keeps the
fleet's live 262 with today's date.
Refs #64
The chezmoi overview was one 488-character sentence-block; the git-crypt mechanism and verdict
lines were the same shape. Reflowed to ~100 columns with no wording lost, so the pages read the
same in an editor as they do rendered.
Refs #64
The overview page carried `docker run` invocations (including a CUDA variant, on a fleet with no
NVIDIA card left in it) and the `LLAMA_ARG_` environment rule, while `setup.md` — the page whose
own intro promises "build instructions, Docker, and systemd deployment" — carried the Compose
example and the same env form in use. Two places to look, one place to be wrong.
`setup.md` now states the env-prefix rule where the flags live (and why units prefer it: one
flag per line is auditable, a forty-flag command line is not), and the overview keeps only the
API surface and the GGUF format, pointing at the sections that absorbed the rest.
Refs #64
Two independent copies of the same law, and each page cited its own numbers. The finish rule —
stop when independent sources agree, when the retrieval budget is spent, or when every claim is
met; report gaps, never invent a source — stood in full in `agentic-search-best-practices.md`
(with the loop caps: 20 steps, re-plan every 4) and again in `research-effectiveness.md` without
them. The operational page owns it; the measurement page keeps the pointer and the one thing
that is its business, which is that unbounded loops are why "infinite re-search" is a named
failure mode.
`tools/gitea/index.md` was a second copy of its own directory: an architecture table, a
management command table, a data-persistence path table and a boot-persistence paragraph, every
one of them a subset of `architecture.md`, `management.md` and `data-persistence.md` — verified
line by line before cutting, including the two facts that looked unique to the index (the
`dns_enabled: false` default network, the `/opt/gitea` leftover) and turn out to be owned
upstream with more detail. The index now answers "which page owns my question" and gives three
one-line orientation facts. Gitea's live version was re-read while I was in there: still 1.27.3.
Refs #64
`tools/ghostty/index.md` had its own Custom Shaders section and its own eight-row default
keybinding table. `configuration.md` owns both, in more detail, and the copies had already
drifted: the index claimed `ctrl+` raises the font size where the reference's appendix lists
`ctrl+=` / `ctrl++`. An index exists to route a reader to the page that owns the fact; a second
summary of the same facts just guarantees two versions that age differently.
What the index keeps is the routing plus the one fact worth having at hand (`ctrl+shift+,`
reloads the config), and the config-syntax "Key Points" — repeatable options, `option = ""`
resets, `?` optional includes — which the reference never states as a set, only per option.
Refs #64
Three pages described the fleet; two of them still described the pre-September arrangement.
Re-read live on 2026-10-21 (`/v1/models`, `systemctl`, `lspci`, `nproc`, `resolvectl`):
- `system/network.md` called Dankclaw the "large inference model" box and Dankserver the
"small" one — that is the topology from before the RTX 3090 moved in September. The served
ids today are `frank-archon` on Dankserver:7770 (the main model) and `frank-dragoon`
(:7770) + `frank-zealot` (:7771) on Dankclaw. The gateway and the DNS pin were re-read too.
- `system/dankserver.md` claimed `frank-medium` is *masked*: the unit file does not exist
(`is-enabled` answers `not-found`), which is a different fact with a different remedy. And it
claimed 8C/16T: this 7700X exposes **8 threads** (`nproc` = 8), so anything sized for 16 is
sized for a machine that is not this one.
- `system/dankclaw.md` transcribed the engine's slot/KV/context math — `2×262,144 slots over
one 524,288 pool, unquantized f16 K+V, MTP off` — while the live unit says `3x200704 slots
over one 602112 pool, f16 K + q8_0 V, MTP armed`, and dragoon's ctx had moved too. That math
belongs to the serverAppConfigs runbook the page already names: the unit's `ExecStart` is a
wrapper script, so any copy here rots on the next engine change. The page now keeps the
contract — id, unit, port, engine family, which GPU, and how to prove it — and disowns the
numbers, with the reason stated so the next agent does not re-transcribe them.
Also recorded, because it is how this audit nearly missed a stopped service: `curl :7770/v1/models`
answered normally while `frank-dragoon.service` sat `inactive` with `Result=exit-code` — the
container is running outside systemd. A serving port is not a healthy unit. (Flagged for Frank
separately; no production unit was touched.)
Refs #64
Two pages described Dankclaw's search stack from memory, and one of them invented a port.
`searxng-tuning.md` claimed "`:8081` (UI) / `:8082` (JSON API)". Re-probed 2026-10-21: JSON is
served on **8081** (`/search?q=…&format=json` returns results) and **8082 is not SearXNG at
all** — it publishes container port 8085, which is Marreta's nginx, moved off 8080 because
SearXNG owns that port inside the shared namespace. Four containers print the same port list in
`podman ps` because they share gluetun's namespace, which is exactly the detail that gets
mistaken for "the JSON API is on another port". The policy-drift flag now carries today's
reading: `/config` still reports 262 engines and zero disabled, unchanged since 2026-10-19, so
the tuned engine policy is still not live — still an operator decision, still not silently
re-applied.
`vpn-routing.md` gave a mullvad-shaped gluetun example and no fleet shape at all, while the
bundle's own work log says the manual-WireGuard law lives "on concept pages". It lives here now,
read from the running container: `VPN_SERVICE_PROVIDER=custom` + `VPN_TYPE=wireguard` + the
single-peer `WIREGUARD_*` names (`protonvpn` and the plural `WIREGUARD_PEERS_*` family are both
wrong for this image), `FIREWALL_ENABLED_DISABLING_IT_SHOOTS_YOU_IN_YOUR_FOOT=on` — whose name
is the warning that disabling it leaks egress while every check keeps passing — and
`tun0` present. The mullvad block stays as the generic illustration, now labelled as one.
Refs #64
An index is the skim layer: its entries decide whether a reader opens the page, so an entry
that runs 250 characters is a paragraph wearing a bullet. Four entries in `tools/index.md`
(`dotfiles-deploy`, `packages`, `pcie-probe`, `remote-job`) now say what the page is for in one
line and let the page carry the detail — which is the whole argument for progressive disclosure
having an index at all.
`engineering/infra/index.md` pointed at `../sdlc.md` with no description at all; it now carries
the one from that page's frontmatter, like its four siblings.
Refs #64
504 lines, 4,496 words — the log had become the largest page in the bundle, and the reason was
not history: twelve entries dated 2026-10-18 → 2026-10-21 each re-narrated the incident AND
re-stated the law AND pointed at the page that owns the law. Three copies of one fact, dated
three ways. 384 lines / 3,251 words now.
What was cut: the restatements. The refuse-by-default guard belongs to
`tools/pcie-probe.md`, the completion-sentinel law to `tools/remote-job.md`, the verbatim
mode-string law to `tools/niri/displays.md`, the enable-snapshots-a-path trap to
`tools/dotfiles-deploy.md`, the sorted-directive rule to `caddy/caddyfile.md`, the effort-map
contract to `pi/models.md`, the tier law and the footer/`xdg-open` fleet laws to `AGENTS.md`,
and the gate's mechanics to `.githooks/pre-commit` plus its tests — each now named once, from a
short entry.
What was kept deliberately: laws with no other owner anywhere in the bundle. Fail-closed on a
blind `git diff`; a stub that echoes its environment instead of its argument cannot see the bug;
a name is data, never let the shell expand it; extensions must never await work that can exceed
30 s; `systemctl --user enable` snapshots an absolute path; agents never run
sudo/yay/pacman/pkexec (faillock incident, with the reset command); a claim about what the
harness sends is worth exactly its last capture; a number in a page is a claim, not a
measurement. Deleting those would have been the actual loss.
The 2025-08-05 entry is annotated rather than deleted: this repo's history dates that file's
arrival at 2026-08-28 (the OKF rebuild copied it), so 2025-08-05 is a legacy-tree date and the
entry now says so instead of silently contradicting `git log`.
Refs #64
The note in `references/okf-spec.md` claimed the bundle keeps a "`tags` discipline". It does
not: 22 of 76 concept pages carry `tags`, and neither `kb-lint.sh` nor `kb-coverage.py`
reads that field or `verified` — so the note was a claim about intent that an agent would
believe and pay the wrong cost for (adding tags to a page helps no tool, while `verified`
silently does the real work: it is the date someone last re-checked the page against the
fleet, and its absence means nobody ever has).
The note now states the measured usage instead of the aspiration, records the house link
style (bundle-absolute, 99 links already written that way), and says plainly that Obsidian
`[[wikilinks]]` are not OKF links — with the count this bundle had and the date they were
converted. The spec's own repository is now cited under `# Citations`, which the page was
missing while it lectured others about skipping citations.
Refs #64
`key-bindings-syntax.md` told you to run `wev` and read `sym: XXXX` — a placeholder nobody
fills in, for a tool that is not on the machine: `command -v wev` is empty, `pacman -Ss
--sync wev` is empty on CachyOS, and the AUR carries it as `wev-git`. The bind token is an
XKB keysym, and the complete list is already on every box that links libxkbcommon, so the
page now leads with the grep against `/usr/include/xkbcommon/xkbcommon-keysyms.h` (run here:
`a A Escape Left Return Tab`), and keeps `wev` as the "press the key and see" option with its
real package name and where to get it.
`screenshots.md` line 35 read `(FIXME upstream).`, which scans as unfinished work in a page
that is finished: the defect is upstream's, tracked in the two issue links six lines below.
Reworded to say that.
Refs #64
The page explained matcher ordering beautifully and never said where the file lives — so the
next agent hunts for a Caddyfile on the host and finds nothing. Measured on Dankclaw
2026-10-21: Caddy is a rootless Quadlet container (`caddy.container`, a *user* unit, so a
root `systemctl is-active caddy` answers `inactive` and means nothing), its config is
`/etc/caddy/Caddyfile` **inside the container**, `/etc/caddy` does not exist on the host, and
`pgrep -a caddy` prints a config path that no host path satisfies. Version is v2.11.7, which
closes the one version-dependent rule on the page: the leading-`/` `rewrite` form needs
2.8.0+, so the `*` disambiguator is legacy in this fleet's config.
Also: the seven caddyserver.com links sat in a mid-page "Sources:" paragraph. OKF wants
external claims under `# Citations`, so they move there and each entry says which claim it
supports. The validate section now points at the container instead of telling you to run the
validator on a file that is not there.
Refs #64
`[[page|Label]]` is Obsidian syntax, not OKF. `kb-lint` resolves it Obsidian-style — by
filename, anywhere in the bundle — so it has never tripped the link gate, while every other
consumer of the bundle (an OKF renderer, a Gitea wiki export, `grep` for reachability) sees
bracketed text where a link should be. That is how two generated pages ended up with no
inbound link at all and nobody noticed: the my-first link census of the bundle reported them
as orphans because their only inbound edges were wikilinks.
Mechanical conversion, 52 links across 17 pages, each resolved against the same page set
`kb-lint` uses: an explicit `|Label` is kept verbatim, an unlabelled link takes the target's
frontmatter `title`. Targets are emitted bundle-absolute (`/tools/niri/tips.md`), the form
the spec recommends and the form 99 existing links in this bundle already use.
Two links were `[[index]]`, which resolves by filename to 21 pages — the ambiguity that
filename-resolution invites. Both meant their own directory's index, so both are now written
out in full: `/tools/gitea/index.md`, `/tools/niri/index.md`.
The linter still tolerates wikilinks; whether it should reject them outright is an open
question on #64, because that would replace the two tests pinning today's tolerance.
Refs #64
The link-integrity pass ended in `is_file()`, and `.AGENTTRASH/` is a real directory on
this machine: a page pointing at `[x](.AGENTTRASH/gone.md)` passed the gate here and was a
dead link everywhere else, because the quarantine is gitignored. This is incident #57 — the
wikilink resolver resolving `[[log]]` onto a quarantined copy — reproduced in markdown
clothing, which is to say: fixing one resolver while leaving the identical assumption in the
other one is not a fix.
A link that lands inside the bundle must land on a page that belongs to the bundle. A link
that leaves the bundle is still honoured (`tools/live-sync.md` -> `../../AGENTS.md` points at
the operating contract, which is not bundle content and is real on disk). Red test added
first, both link spellings covered; nothing previously green changed.
Refs #64
Frank