orchestra/HANDOFF-2026-08-28-burnin-4.md

Handoff: the chain is live-proven, run 5 is mid-review

Written 2026-08-28, 02:20 local (22:20 UTC). Read with BURNIN.md (the ledger, current through F40), HANDOFF-2026-08-27-burnin-3.md (the session before this one), AUDIT.md and CLAUDE.md.

Everything below was observed live unless it says otherwise.

The headline

Run 5 live-proved the whole workflow this project exists to build. Frame to review, four autonomous rotations, sealed artifacts, and an operator correction that reached shipped code.

frame -> research -> plan -> implement -> review

The render order in the implement launch is the load-bearing proof:

## Goal
## Acceptance
## Current human decisions      <- the correction
## Current phase                   implement
## Repository rules
## Verified git state
## Accepted research
## Accepted plan
## Continuity from the previous session
### Dead ends already tried

Human correction above accepted plan, above accepted research, stale continuity below all of them. The original failure mode is mechanically gone from this path. A new session no longer follows whatever the handoff liked instead of the latest human instruction.

The correction went from issue comment to live plan pane in three seconds, and was delivered exactly once. It was cited in plan.json as a human decision. It appears in the shipped script as snake_case JSON keys, with the default text path untouched.

Deployed state

Half	Revision	Evidence
Coordinator, homesrv container	bcaf0cc	image a5683b1869ae, /readyz 200, embedded stamp checked
Worker, workpc systemd	bcaf0cc	installed 02:32:37, sha256 verified

Branch webui-and-audit-reconciliation, HEAD bcaf0cc.

revision  bcaf0cc2851734f97105beb1cd608fda4e271964
sha256    7f2bee3d3c45a347d2f747b1aed624b3e45f8d255a47aaf710daad6fd10bc5d3

Confirm the installed worker checksum before believing anything else here. Half of tonight's diagnosis time went to reasoning about code that was not the code running.

Run 5, where it stands

Task 06G4A4F0TFXKZHJE48N05XN1HG, issue kami/test-e2e#5, workpc-claude.

It is parked in review. The review agent finished at 02:12 and stopped, correctly, because nothing had told it how to finish. That is F40, fixed in bcaf0cc but not deliverable to a session that already has its brief.

The recovery is the lease expiring. It renewed once to 22:56:10Z (02:56 local), because the agent's 02:12 output counted as real progress against its launch baseline. The next renewal window opens around 02:46 and must be refused, since the pane has not moved since.

On expiry the task requeues, review relaunches with the corrected brief, and the agent can write .orchestra/done.

Do not press anything into that pane. The relaunch is the proof.

Remaining chain after that:

.orchestra/done -> worker confirms idle -> finalise -> task PR -> human review -> merge -> completed

The implemented script is at /tmp/test-e2e-worktrees/06G4A4F0TFXKZHJE48N05XN1HG/scripts/orchestra_worktree_report.sh and satisfies the acceptance criteria and the correction.

What this session found

Twelve defects, F29 through F40, each reachable only after the previous fix. Tests passed throughout. Running the system is the only thing that surfaced any of them.

F28  CLOSED, live-proven both directions
F29  fixed efd0a5e, DEPLOYED, live-proven   operator could not act on a leased task
F30  fixed 2dc90bd, DEPLOYED, live-proven   unpushed release pinned the only slot
F31  fixed 6523002, DEPLOYED, live-proven   handoff action held to half its budget
F32  fixed 92adf04, DEPLOYED, live-proven   empty tmux server's reply unrecognised
F33  fixed 32220d9, DEPLOYED, live-proven   launch confirmed in 7ms against an unrendered editor
F34  fixed 92f32d6, DEPLOYED, live-proven   first renewal exempt, free period for a dead launch
F35  fixed 92f32d6, DEPLOYED, untested live no way to re-poke a pane
F36  fixed b9ca365, DEPLOYED, live-proven   validator refused the adapter's own reason
F37  fixed cb7782d, DEPLOYED, live-proven   handoff carried the write Orchestra asked for
F38  fixed 0bd86e2, DEPLOYED, live-proven   brief named the artifact, never its schema
F39  fixed 0bd86e2, DEPLOYED, live-proven   local refusals reached nobody
F40  fixed bcaf0cc, worker install pending  terminal phase never named .orchestra/done

Older entries, unchanged:

F15  closed by detection, transport fix pending live proof
F16  closed
F17  fixed
F18  open observability, now the highest-value open item
F19  fixed
F20  live-proven by run 5's correction
F21  exercised throughout
F22  exercised throughout
F23  live-proven by run 5's correction
F24  open correctness, dormant on current topology
F25  live-proven
F26  live-proven
F27  live-proven

The pattern, worth carrying forward

Every defect tonight was a contract with two halves that named different things.

• F31: producer joined two lines, validator budgeted one
• F36: adapter emitted phase_changed, validator's list never gained it
• F37: prompt asked for a file, validator rejected the command that wrote it
• F38: brief named an artifact, never its schema
• F40: worker watched for .orchestra/done, no brief ever named it

The durable fix shape is to ask the other half rather than restate it, as continuity.IsCircularCommand does. The alternative is to assert the agreement in a test, as TestPhaseSealSchemasDecode and TestEveryReasonTheAdapterProducesIsAcceptedByTheValidator do. Prefer either to another matching constant.

F39 is the one that made the rest expensive. A local refusal recorded only in worker health is a silent stall, and worker health holds one slot (F18).

Next session, in order

1. Confirm the installed worker checksum matches the revision above.
2. Let run 5's lease expire and watch the review relaunch. Do not intervene. Expect .orchestra/done, an idle confirmation, then finalisation.
3. If it finalises, run 5 is a complete conformance proof. Record it and treat remaining work as hardening rather than redesign.
4. F18 is now the highest-value open item. One error slot on the worker cost real diagnosis time three times tonight. It is also what turns any local refusal into a silent stall.
5. F35's resubmit action is deployed but never exercised live. The next stuck pane is its proof.

Things that will bite

• Another session owns 22 uncommitted paths, including AUDIT.md, deploy/build.sh, web/, and new untracked final/, iterations/, orchestra-ui-spec.md, README.md. Commit by path. Never git add -A.
• Never docker compose build. The build context is /home/kami/apps/orchestra, the shared dirty checkout. Build from a detached worktree, as every deploy in this session did: git worktree add --detach /tmp/orchestra-build-<rev> <rev>, then docker build --build-arg BUILD_REVISION=... -f $T/Dockerfile.api -t orchestra-web-ui-orchestra-api $T, then docker compose up -d --no-deps orchestra-api.
• workpc-claude now declares a claude capability in the deployed config.jsonc, added this session so an operator test can pin placement. A task with capability: ["claude"] lands there deterministically.
• The worker state file is a cache, not truth, and editing it needs the worker stopped. Backups from tonight are in /var/lib/orchestra/worker-state/.
• /tmp is tmpfs with a 10-day sweep. Check /tmp/test-e2e and /tmp/test-e2e-worktrees exist before every run.
• Gitea writes need the token expanded on homesrv: /usr/bin/ssh kami@192.168.1.104 'TOKEN=$(docker exec orchestra-api printenv ORCHESTRA_GITEA_TOKEN); curl -H "Authorization: token $TOKEN" ...'. Base https://gitea.kvmx.ru, owner kami, repo test-e2e.
• The web surface is cookie-only. No bearer token exists for it, so any /v1/ui/* call needs a login through POST /v1/ui/session.
• This machine is workpc, hostname is bugmachine. homesrv is kami@192.168.1.104 with /usr/bin/ssh, not the ssh on PATH.
• Worker capacity is 1 per harness. One stuck task blocks the harness entirely, which is what F30 did for an hour.
• Three queued correx tasks will never lease. No worker declares that project.