bitvid/fleet/RULE-CHANGES.md

# Rule changes

Newest first. One `## YYYY-MM-DD` heading per day, then a line per change.
Read this file newest first now and before every backlog item. These lines
override a stale system prompt. Nothing filters them down to a window of days.

The session manager adds a line here whenever a rule, a prompt, a tool's usage, or
a landing rule changes.

## 2026-10-23

- Owner campaign continuation "ok lets get the fleet working some more" relayed12:48:12. Resume existing6 priorities, no further routineyes: client exactHLS prep/sole unchangedgate after resourceclearance; QA same-script EPERM/hostlaunchprep; storage disjoint read-only RangeGET audit. Interpreter freezes direct/setup targetwrites during productgates and requires actual dispatch slotACK before any heavy validation. Kit logs prove overlap12:42:49–12:46:15 with HLS interruptedgate12:41:48–12:46:14; do not attribute heat exclusively to unrelatedapps. Both rejectedruns preserved. Dispatch requires2coolingsnapshots<75C/~30sapart/load<8/ampleRAM for nextlonggate; sustained85C stop unchanged; no configoverride/gateweakening.

- Interpreter12:35:35 relays owner "I would like to not have extra processes like this running when the fleet is down or paused". All scheduled/headless work must respect down/PAUSED, including weekly restart; prior ignorePause allowance superseded for these jobs. Interpreter owns local bitvid-schedule-guard.mjs and unique focused tests/cron routing; avoid concurrent edits. Guard effectiveness pending evidence; no process kills outside its owned scheduled child group, no global kit/settings scope. Preserve active HLS gate/landing, no new heavy job.

- Interpreter12:32:43Z reports owner quote "All seven jobs shown above" and installation/readback of existing checkin/hygiene/triage/summary/winddown/restart/resources schedules, scoped PATH/FLEET_CONFIG and preserved prior crontab. Record as relay/interpreter evidence, not independent verification or dispatch install authority. Earlier no-cron-installed statements are historical; no execution-success claim. One heavy job maximum and restricted-action boundaries remain; no denied-action retry or assumed effective MCP approval config.

## 2026-10-22

- Client9 HLS follow-on explicitly routed after HEAD productf41ac656/evidenced04d501e durable. Dispatch independently ran actual observer/controller/cache/probeHlsManifest scratch12=7pass/5fail/cancelled0/naturalexit1/165.17ms atd04d501e: final-owner GET1/abort0/timer1/unsettled, stale same-source rejoin and late cache; body-read disposal also fails, media slots0. Temporary ownership ONLY js/ui/urlHealthController.js HLS lifecycle handoff + js/services/hlsPlayback.js manifest-probe optional cancellation plumbing across fetch/body + unique focused lifecycle/helper tests and strict spec/integrity notes. Explicit Stage3 contract extends final-owner prompt null settlement/abort/timer-hook cleanup/no obsolete cache/fallback/mirror/badge writes to HLS fetch AND body-read, even ignored abort or absent AbortController. Shared/cross-controller/legacy/live success/error/timeout and same-source replacement identity preserved; existing helper callers/signature behavior preserved without lifecycle. No HLS engine/player/session/config changes, torrent/RangeGET/app.js excluded. Focused+mutants+lint only, no full/build/browser/submission until resource grant; storage4 currently sole full/normal slot, QA4 held.

- Storage4 separately routed after dispatch exact89f8923c registered Recent/Explore+productionstages+actualVideoListView/Card JSDOM reproduction4=2pass/2fail/naturalexit1/203.65ms: old sameview result restores deletedDOM and old Recent overwrites remounted Explore metadata. Temporary ownership ONLY js/app/feedCoordinator.js async request/result/error/lifecycle eligibility + unique new registered lifecycle tests/notes. No app.js/view/engine/service/buffer edits for4; preserve live rendering/source/filter/moderation/ranking/return contracts. Guard stale success AND failure metadata/render/telemetry/sideeffects, newer refresh/view identity/disposal, preserve valid delayed pipeline/fallback. Freeze+submit existingstorage3 candidate first; storage4 separatecommit/item/normalgate, focused/mutants/lint then resource request. Current slot storage3 full/build;client9 next full;QA4 mobile HOLD/sourceprep, no unannounced competing jobs.

- QA3 native original instrumentedTest/globalsetup/3callbacks passed3/0fail/0flaky/0skip/retries0 with private genuine Buffer/public-deny guard; CI2 terminal assertions remain unreproduced, no causal fix. Retain docs-only checkpoint, keep CI issue open pending equivalent evidence; no speculative concurrency/repeated local runs. Existing QA moves to QA4 actual-app mobile Upload overflow360/390 plus1280 control, focus/touch/source-culprit measurement first, scratch/unique evidence only. Exclusive bounded Chromium browser slot granted after START; no product/CSS/tests/config/full/build before reproduced cause+ownership routing. Preserve original strict overflow failure, genuine fixture dependency provenance, preview3000, and live/manual limits.

- Client9 HEAD cancellation independently reproduced by dispatch11modes: disposed/same-turn/later fail3, shared/cross/legacy/live-success/error/timeout/late-success/error controls pass8, naturalexit/cancelled0. Finalowner retains HEAD1/abort0/timer1(5000ms)/unsettled inflight;media slots0 so no slot-leak claim. Route ONLY js/ui/urlHealthController.js HEAD lifecycle cancel/settle/timer-hook cleanup + focused lifecycle tests/unique strict integrity/spec notes. Explicit Stage3 contract extends immediate final-owner cleanup to active HEAD, preserving live/shared/legacy behavior. Abort transport AND settle via cancellation even if transport ignores abort; synchronous cancelled/rejoin identity safety; suppress obsolete fallback/cache/mirror/badge work. Preserve live error/timeout fallback, HEAD success/media handoff/FIFO, non-abort support. HEAD only; HLS/torrent and RangeGET separate. Focused/mutants/lint then request full/browser slot; QA conditional next narrow browser, no competing expensive gate.

- Storage3 independently reproduced by dispatch on runtime-equivalent7369f1fe: actual subscription/buffer/service/feed-engine/coordinator scratch7=3pass/4fail, naturalexit1/29.89ms/network0. Route storage3 implementation in separate small commits: first ONLY js/nostr/videoEventBuffer.js timestamp-safe active deletion + unique focused tests, then ONLY js/services/nostrService.js snapshot/persistent-cache deleted/invalid eligibility and affected-record cleanup + unique integration tests after buffer controls. Existing client.js tombstone/address/author semantics preserved; no root-only widened deletion. Temporary ownership overrides roster exclusion only for those modules/tests. Coordinator stale-render remains reproduced/open but app/feedCoordinator.js READ-ONLY until faithful registered-feed/lifecycle evidence and separate routing. Focused+mutants+lint now; full/normal product queue/browser via explicit slot. QA owns next narrow Firefox bootstrap diagnostic using pinned genuine cached Buffer; first app-less3pass is not CI reproduction. No gate/expectation weakening.

- Owner six-priority resume relayed by interpreter14:02:34UTC and routine YES14:03:29UTC supersedes local-review/quiet-hours hold for this foreground campaign. Existing client9 active HEAD cancellation first (HLS/torrent separately tracked); QA3 Firefox deterministic CI run39536282396/job119013565277; storage3 tombstone stale-refresh. Investigation/source/scratch evidence only until reproduced defect and explicit implementation routing. QA owns next browser/expensive slot, must announce start/release; no full suite/normal product submission without slot. Client/storage focused offline checks only. Playback enhancements, Amber and mobile remain tracked/acceptance-scoped, not dropped. All worktrees inspected clean, no unlanded unique commits; each worker safely fast-forwards own branch before work, reports SHA. No app.js writer, new launch, test weakening, kit/scheduler or restricted external authority. See campaign brief; newer current assignments override archived prompt bodies.

## 2026-10-20

- client8 minimal media-only fix routed after worker+dispatch9mode evidence: final-owner retains1src/3listeners/1timer/1slot/unsettled;7controls pass. Own controller cancellation/active media settle cleanup+focused lifecycle tests/unique integrity/spec notes only. Explicit Stage3 spec correction replaces disposed active cache/timeout/rejoin expectations with immediate cleanup/null/no cache/mirror/stale writes/fresh request; preserve separate live/shared/legacy success/error/timeout/cache/FIFO controls and identity safety. No observer/cache/HEAD/HLS/torrent/app edits. Focused+mutants+lint then request full/browser slot; unchanged normal gate/durable landing.

- Owner resumes bounded active-probe/URL cancellation via interpreter20:44:41UTC: client8 current-HEAD actual observer/controller active URL-media last-owner/shared/rejoin measurements first. Read-only source/scratch evidence until demonstrated defect and explicit fix/contract routing. Prior active cache tests express queued-only contract; do not silently weaken. Other2 workers idle. Local-review hold superseded only for this slice; no HEAD/HLS/torrent widening,app.js/kit/scheduler/external authority.

- Local-review hard blocker measured: coldTrending cache0 then relayEVENT3/EOSE ingests eligible3 but view remainsEMPTY/DOM0. client-reliability-7 temporary ownership ONLY nostrService.loadVideos subscription notification path, minimal service-owned current-consumer state/subscription-clear lifecycle where proven necessary, + new focused regression/integrity/evidence; reproduce current method before minimal fix. Existing app/feed modules read-only unless additional evidence/routing. Preserve access/filter/deletion/cache/event semantics; no forcedrefresh baseline substitute. QA retains actual-app/browser qualification; client cheapfocused until explicit fullslot.

- Owner stopmilestone is Ready for me to review and test locally. Finish current storage2/history6/faithful actual-app baseline+preview/handoff,then no new optional tasks before review. Reconcile upstream docs-only8d4622bb via area merge+normal queue;new playback promises stay explicit/open,do not churn current scope or declare them done from partial/static evidence. Genuine cached offline dependency mirror is testprep only,not CDN/deployed/offline production proof.


- QA1 retained regression64143f42 landed1bb3a4fc,dispatch4/4. New QA2 actual-app local core/mobile baseline has bounded browser-only slot,no UI changes/full E2E. Client6 test-only actual history wiring regression routed after current pass/historical no-op failure. Storage2 temporary ownership deleteVideoStorage-only in r2Service+new test after2 real cached-metadata rejects/6controls;upload-copy logic unchanged,s3UploadService has no deletion counterpart,prove shared provider-aware delete for R2/S3. Full slots allocated only when validated-ready after browser release.


- Latest14:57:03 interpreter checkpoint prioritizes remaining storage/upload/delete safety for storage worker. storage-cors-2 now read-only best-effort delete safety/current followups audit;prior feed/view audit retained deferred as storage-cors-3. Client6 history audit unchanged. No product/test writes before evidence/routing;QA expensive slot stays exclusive.


- Owner continuation now extends beyond trial until project quality is evidenced,tracked in QUALITY.md with local/live gates distinct. Existing client worker item6 investigates real profile-history removal wiring;storage worker item2 temporarily investigates feed/view tombstone coverage. Both read-only scratch/evidence,no product or committed tests before routing. QA retains expensive full/normal slot. Same3 workers,disjoint scope,no app.js writers/new features/kit/scheduler/external authority.


- storage-cors-1 fix routed after worker+dispatch offline reproduction: preserve existing bucket CORS rules/fields; append default rule only for uncovered origins, idempotent no-PUT for equivalent coverage, only NoSuchCORSConfiguration permits absent config, other read errors no PUT. Own s3-multipart.js/s3-client.js+focused new test/integrity. No real cloud/credential operations or unrelated policy change; full gate slot follows client.


- Item5 narrow fix routed after worker+dispatch reproduction: prevent fresh mirror HEAD after disposed last-owner active-media error; controller+focused URL lifecycle tests only. Preserve bounded active/cache/shared/rejoin/timeout semantics, no active abort. Parallel trial CLI/agent/lander launches clear inherited NODE_TEST_CONTEXT transport; exact gate/assertions unchanged. Original roster gate hit binary capture cap, not identified product assertion. No kit patch.


- Owner authorizes bounded parallel trial via interpreter: dispatch plus existing client-reliability and two new areas storage-cors/playback-qa. Separate worktrees/disjoint write ownership; no competing app/grid/URL writers. QA initially owns browser; one expensive full gate at a time coordinated through dispatch. Each worker sends read/next-action and timed contention/evidence events. No new external authority or scheduler changes.


- client-reliability-5 assigned to existing worker: read-only active URL/torrent cancellation reproduction at current HEAD, starting active URL media last-owner/shared-owner controls. Evidence notes only; product/test changes need demonstrated defect and dispatch routing. Continue selecting bounded next actions under existing owner direction; no new routine approval required. No scheduler or external authority change.


- client-reliability-4 reproduced queued URL media work after last-feed disposal (obsolete starts1, expected0); dispatch independently confirmed failure and shared-owner control. Investigation restriction superseded for bounded implementation: urlHealthObserver.js, ui/urlHealthController.js, focused tests/integrity/evidence. Active abort, HEAD/HLS/torrent, shared observer/app/cache modules, limits/TTLs remain excluded. Normal gates and durable landing required.


- Owner continuation relayed by interpreter permits the requested bounded development step now despite quiet hours; recurring schedule/config unchanged. client-reliability-4 is read-only source-health cancellation reproduction at current HEAD, evidence notes only. Product/test fixes require dispatch routing after reproduction; mailbox tools now deliver short wakes, superseding prior no-wake limitation for updated runtime. No unattended monitoring claim.

## 2026-10-19

- client-reliability-3 redirects the existing single worker to queued torrent-probe ownership in js/gridHealth.js, an optional small queue helper, and focused lifecycle tests. Prior validation tasks are done. Active probes, URL checks, WebTorrent implementation, cache/concurrency policy and kit remain out of scope. Completion must send dispatch mailbox evidence; mailbox delivery is not a session wakeup. No scheduler/kit changes.


- Bounded routing: existing client-reliability worker temporarily owns tests/race/nostr-client-init-race.test.mjs plus its regression/integrity notes for client-reliability-2. Nostr product code and global runner remain excluded. Preserve assertions, separate commits, and normal landing gates.

- One-time first-worker bootstrap: the administrative roster/brief commit may land through a temporary queue configuration with an exact roster-and-documentation-only validator because the worker is assigned to the existing full-suite hang. No product/test/persistent-gate change is permitted by this check. Record the exception and actual result; subsequent code uses the normal full gate.

- Owner direction relayed from Codex desktop chat authorizes dispatch to operate tmux, start the approved single client-reliability worker, and make routine staffing, prioritization, test/build, fix, and local unstable landing decisions without repeated approval. Record relay provenance; this is not approval for deploys, spending, production data, real-wallet operations, or schedulers. Send owner-mailbox event updates and refresh the existing local preview after verified changes.